Skip to content

Bump cross-spawn in steps fixture#3977

Merged
szdziedzic merged 2 commits into
mainfrom
szdziedzic-codex/fix-dependabot-228-cross-spawn
Jul 13, 2026
Merged

Bump cross-spawn in steps fixture#3977
szdziedzic merged 2 commits into
mainfrom
szdziedzic-codex/fix-dependabot-228-cross-spawn

Conversation

@szdziedzic

@szdziedzic szdziedzic commented Jul 7, 2026

Copy link
Copy Markdown
Contributor

Why

Resolve https://github.com/expo/eas-cli/security/dependabot/228 by updating the vulnerable cross-spawn transitive dependency in the my-custom-ts-function steps fixture lockfile.

How

Updated the Yarn v1 fixture lockfile entry for cross-spawn@^7.0.3 from 7.0.3 to 7.0.6.

Added a changelog entry for the fixture dependency bump.

Test Plan

  • corepack yarn fmt
  • corepack yarn lint-changelog
  • git diff --check

@codecov

codecov Bot commented Jul 7, 2026

Copy link
Copy Markdown

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 59.67%. Comparing base (c944298) to head (ff096cf).

Additional details and impacted files
@@           Coverage Diff           @@
##             main    #3977   +/-   ##
=======================================
  Coverage   59.67%   59.67%           
=======================================
  Files         941      941           
  Lines       41319    41319           
  Branches     8675     8675           
=======================================
  Hits        24654    24654           
  Misses      16571    16571           
  Partials       94       94           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
  • 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

@szdziedzic
szdziedzic requested a review from sjchmiela July 7, 2026 08:56
@szdziedzic
szdziedzic marked this pull request as ready for review July 7, 2026 08:56
@github-actions

github-actions Bot commented Jul 7, 2026

Copy link
Copy Markdown

Subscribed to pull request

File Patterns Mentions
**/* @douglowder

Generated by CodeMention

Warning: The preamble and epilogue options in commentConfiguration are deprecated. Use template instead.

@szdziedzic
szdziedzic requested a review from douglowder July 7, 2026 09:11
@szdziedzic
szdziedzic force-pushed the szdziedzic-codex/fix-dependabot-228-cross-spawn branch from 5f2f9ed to ff096cf Compare July 13, 2026 11:42
@github-actions

Copy link
Copy Markdown

✅ Thank you for adding the changelog entry!

@szdziedzic
szdziedzic merged commit 6902462 into main Jul 13, 2026
10 checks passed
@szdziedzic
szdziedzic deleted the szdziedzic-codex/fix-dependabot-228-cross-spawn branch July 13, 2026 12:51
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants