Dependency audit exceptions

Reviewed 20 October 2026 while upgrading to Expo SDK 58 (#702).

The before report, from current main plus the security cleanup PR, has 43 entries (26 high, 16 moderate, one critical). The after report has 37 (25 high, 12 moderate, zero critical). These reports use the same audit database on the same day; old September reports are historical, not the current baseline.

SDK 58 uses Metro 0.87, which removed image-size, and Expo Router 58 no longer depends on query-string / decode-uri-component. The image-size and decoder advisory chains named in #702 are gone from the installed lockfile. The lockfile was regenerated from an empty install to include the complete SDK 58 native graph; compatible patch updates also change other entries and parent-package counts. The decoder adapter, Metro redirect and decoder regression test are removed. The asset-format ban is removed; the assertion that Metro retains Expo's default extensions stays. Native version 1.3.0 creates a new runtime boundary and requires rebuilt binaries.

Remaining exception: fflate via the New Relic browser agent (2 moderate)

Not reachable. The agent imports fflate in exactly one place — the session replay aggregator, for gzipSync — and never calls unzipSync. TailSpend's web build composes the agent from individual features (apps/web/src/monitoring.ts) and does not include session replay, so fflate is not even in the shipped bundle. An npm overrides entry to 0.8.3 is not honoured against the agent's exact pin (npm keeps 0.8.2 and reports the tree invalid), so this is carried as an exception.

Exit condition. A browser-agent release that moves to fflate@0.8.3+.

Verification and remaining findings

The audit is not clean. The remaining 37 entries are listed in the linked report; they are not newly accepted exceptions or evidence that a vulnerable API ships in a production bundle. This SDK change does not remediate those independent findings. The existing fflate exception above remains unchanged.

Local validation covers dependency compatibility against the installed Expo SDK matrix, mobile Node regressions, TypeScript and JavaScript export. Native builds and device Maestro checks remain release gates; see the native release instructions.