Bundle Dependabot dependency bumps into one PR

[keiloktql]

Summary

Dependabot has not been able to land a single dependency update since #35. It cannot parse the pnpm 11 lockfile, so every bump it opened was closed unmerged with Dependabot can't parse your pnpm-lock.yaml. This PR applies all of them by hand in one batch, with the lockfile regenerated by pnpm itself.

Two of the bumps broke the repo in ways worth calling out before review:

• TypeScript 6 no longer auto-includes node_modules/@types. The jest globals silently vanished and pnpm typecheck failed in every test file. Fixed by naming "jest" explicitly in tsconfig.json's types.
• jest 30 pulls in unrs-resolver, whose postinstall is blocked by the repo's onlyBuiltDependencies: [] hardening — and pnpm 11 escalates an unaccounted-for ignored build into a hard pnpm install failure, which took down every script. pnpm 11 tracks these verdicts in an allowBuilds map rather than ignoredBuiltDependencies; the script is recorded there as denied. Its postinstall only links a prebuilt napi binary that pnpm already installs as an optional dep, so the suite resolves fine without it. No new build scripts are permitted by this PR.

Key changes

npm dependencies — replaces #36, #37, #38, #39, #40, #41, #42, #43, #44

• typescript 5.7.3 → 6.0.3, react 18.3.1 → 19.2.6 / @types/react → 19.2.14, react-native 0.77.0 → 0.85.3
• expo-application 6.0.0 → 55.0.15, expo-device 7.0.0 → 55.0.17 (Expo's SDK-aligned versioning, hence the jump)
• react-native-builder-bob 0.23.0 → 0.41.0, typescript-eslint (+ plugin, parser) 8.57.2 → 8.59.3, @babel/preset-env 7.29.0 → 7.29.5
• babel-jest 29.7.0 → 30.4.1, plus jest and @types/jest to 30 — Dependabot only offered babel-jest, but leaving the runner on 29 would have split the transform across majors

GitHub Actions (pinned SHAs) — replaces #46, #47, #52, #53

• actions/checkout v6.0.2 → v7.0.0, actions/setup-node v6.4.0 → v7.0.0, pnpm/action-setup v6.0.8 → v6.0.9, softprops/action-gh-release v3.0.0 → v3.0.2
• Only node-version and cache are used from setup-node and only persist-credentials from checkout, all still supported on v7

Verification

From a clean rm -rf node_modules && pnpm install --frozen-lockfile:

Check	Result
pnpm typecheck	clean
pnpm lint	clean
pnpm test	212 passed, 11 suites
pnpm build	commonjs + module + typescript all emitted

The expo majors are the least mechanical part of this. EventFactory.ts types both modules via typeof import(...), so tsc genuinely checked those call sites against 55.x; the untyped require("expo-application") in lifecycle/index.ts was verified by hand — nativeApplicationVersion, nativeBuildVersion, applicationId and applicationName all still exist.

Follow-ups, not addressed here

• react-native-builder-bob 0.41 emits three new warnings about the exports map (esm disabled while exports['.'].import is set; exports['.'].types set alongside import/require). Build succeeds. Changing the exports map alters published-package resolution, so it does not belong in a deps PR.
• onlyBuiltDependencies: [] and its comment in pnpm-workspace.yaml look to be pnpm 10-era config that pnpm 11 no longer consults — allowBuilds is what it actually reads now. Left alone here; worth a dedicated pass over the supply-chain settings.

🤖 Generated with Claude Code

---

^{Need help on this PR? Tag /codesmith with what you need. Autofix is disabled.}

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	jest@​30.4.2
	@​babel/​preset-react@​7.29.7
	@​typescript-eslint/​parser@​8.64.0
	@​babel/​preset-typescript@​7.29.7
	typescript-eslint@​8.64.0
	react-native-builder-bob@​0.41.0
	@​types/​jest@​30.0.0
	@​babel/​preset-env@​7.29.7
	expo-application@​55.0.16
	@​types/​react@​19.2.17
	wagmi@​3.7.1
	@​typescript-eslint/​eslint-plugin@​8.64.0
	expo-device@​55.0.18
	babel-jest@​29.7.0 ⏵ 30.4.1	+1		+6
	react@​18.3.1 ⏵ 19.2.7	+1
	@​tanstack/​react-query@​5.101.2
	typescript@​5.9.3 ⏵ 6.0.3	+1		+1
	eslint@​10.7.0
	react-native@​0.85.3

View full report

[socket-security]

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action	Severity	Alert  (click "▶" to expand/collapse)
Warn		Obfuscated code: npm @react-native/debugger-frontend is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: pnpm-lock.yaml → npm/react-native@0.85.3 → npm/@react-native/debugger-frontend@0.85.3 ℹ Read more on: This package | This alert | What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@react-native/debugger-frontend@0.85.3. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Obfuscated code: npm @react-native/debugger-frontend is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: pnpm-lock.yaml → npm/react-native@0.85.3 → npm/@react-native/debugger-frontend@0.85.3 ℹ Read more on: This package | This alert | What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@react-native/debugger-frontend@0.85.3. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Obfuscated code: npm @react-native/debugger-frontend is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: pnpm-lock.yaml → npm/expo-device@55.0.18 → npm/expo-application@55.0.16 → npm/@react-native/debugger-frontend@0.86.0 ℹ Read more on: This package | This alert | What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@react-native/debugger-frontend@0.86.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Obfuscated code: npm @react-native/debugger-frontend is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: pnpm-lock.yaml → npm/expo-device@55.0.18 → npm/expo-application@55.0.16 → npm/@react-native/debugger-frontend@0.86.0 ℹ Read more on: This package | This alert | What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@react-native/debugger-frontend@0.86.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Obfuscated code: npm yargs is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: pnpm-lock.yaml → npm/@react-native/babel-preset@0.85.3 → npm/react-native@0.85.3 → npm/jest@30.4.2 → npm/expo-device@55.0.18 → npm/expo-application@55.0.16 → npm/yargs@17.7.3 ℹ Read more on: This package | This alert | What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/yargs@17.7.3. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report