[xernobyl]

Summary

Clears the Dependabot alerts on this repo that have an upstream fix. Oneleet flagged the open high-severity node-forge alert (#145, GHSA-86w9-cpqp-85rv) as past its SLA on 11 Nov.

None of these packages ship in @formbricks/react-native. The published SDK's only runtime dependencies are @react-native-community/netinfo and zod@4.6.6, which is already patched. Every alert is in dev tooling: the playground's Expo CLI or the Vitest test runner. SDK consumers are not affected, so no SDK release is needed.

Fixed

• node-forge 1.4.0 → 1.4.3 via a pnpm override. It comes in through expo > @expo/cli and @expo/code-signing-certificates, which pin ^1.3.3/^1.2.1, so 1.4.3 is in range. This closes 11 alerts (5 high, 3 medium, 3 low): #145 and #163–#173. GHSA-86w9 lists no patched version, but its range is <= 1.4.0, so 1.4.3 is outside it. 1.4.3 also covers the four advisories fixed in 1.4.3 that Dependabot raised on formbricks/formbricks today.
• vitest and @vitest/coverage-v8 4.1.11 → 4.1.12. This pulls in @vitest/mocker 4.1.12 and closes #154 and #159 (medium).

Not fixable in this PR

• zod 3.25.76 (high, GHSA-mrhx-c7xc-m3w5, #161). It comes in through expo > @expo/cli 55.x, which depends on zod@^3.25.76. No 3.x release is patched, since the fix is 4.6.6 only. Overriding it to v4 would change the API under the Expo CLI. Newer @expo/cli (SDK 58) drops zod entirely, but that is a playground Expo SDK upgrade with code changes. The vulnerable path is the CLI validating local config, which an attacker can't reach.
• deepmerge 4.3.1 (low, GHSA-gcqx-w48m-w2h4, #162). It comes in through @expo/config, and no patched release exists upstream.

Both remaining alerts are dev-only and need a dismissal with a reason, or the Expo SDK upgrade.

Test plan

Ran locally:

• pnpm install: the lockfile diff only touches node-forge and the vitest/@vitest/* packages, and dedupes two stale entries (@babel/helper-string-parser@7.29.7, picomatch@4.0.4).
• pnpm lint
• pnpm check-types
• pnpm test: 23 files, 225 tests passed on Vitest 4.1.12
• pnpm build
• Smoke test of node-forge 1.4.3 through its real consumer, @expo/code-signing-certificates. It generates a key pair and a self-signed code-signing certificate, round-trips the PEM, validates the certificate, signs and verifies with RSA-SHA256, and issues a development certificate from a CSR that verifies against the root. All steps passed.
• pnpm audit: 27 → 4 advisories. The 4 left are zod and deepmerge above, plus glob 13.0.4 and minimatch 10.2.3 (moderate), which Dependabot hasn't raised yet. Those two need major-version overrides under Expo tooling, so they are out of scope here.

Not verified: playground iOS/Android bundles. The override doesn't touch Metro, and Expo only loads node-forge for code signing.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[coderabbitai]

No actionable comments were generated in the recent review.

Walkthrough

The root package manifest adds a pnpm override that pins node-forge to version 1.4.3. The React Native package manifest updates @vitest/coverage-v8 and vitest from version 4.1.11 to 4.1.12.

Merge Risk: Minimal · up to c09c6

This change updates development tooling dependencies to close security alerts. It does not touch the shipped SDK runtime, and no actionable merge risk remains.

Pre-merge checks: 5

Check name	Status	Explanation
Title check		The title clearly and concisely identifies both dependency changes: the node-forge override and the Vitest update.
Description check		The description is directly related to the dependency updates, affected security alerts, remaining advisories, and validation performed.
Docstring Coverage		No eligible functions found in the changed files. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff with cyclomatic complexity of at least 2. Documentat…
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.

Full details: Docstring Coverage

Explanation

No eligible functions found in the changed files. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff with cyclomatic complexity of at least 2. Documentation-only edits and deletions within surviving functions are included; unchanged diff context and fully deleted functions are excluded. Analyzed 0 functions across 0 files. (2 skipped: 2 unsupported.)

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

Share

• X
• Mastodon
• Reddit
• LinkedIn

Recent review info

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: Organization UI
• Review profile: ASSERTIVE
• Plan: Advanced
• Run ID: 1faa2c56-3bb5-49d7-8a4b-a6fe749996d1

Commits

Reviewing files that changed from the base of the PR and between 5e7729d and c09c62a.

Files ignored due to path filters: 1

• pnpm-lock.yaml is excluded by !**/pnpm-lock.yaml

Files selected for processing: 2

• package.json
• packages/react-native/package.json

Included review availability: This review used your included allowance. Your plan provides up to 1 included review per hour; 0 remain after this review.