[Jason Morse (JasonVMo)]

Platforms Impacted

• iOS
• macOS
• win32 (Office)
• windows
• android

Description of changes

Remediate active dependency vulnerabilities and refresh repository tooling without weakening the seven-day package-age gate.

• Update all 41 installed rnx-kit npm locators to their latest age-eligible versions, including align-deps 5, config 1, kit-config types 2, the CLI, Metro tools, Jest preset, lint tools, and formatting utilities. Refresh the dynamic-extensions Yarn plugin; the ignore plugin is already current. Adopt the alignment preset's updated SVG peer-range text.
• Upgrade both vulnerable body-parser paths to 1.20.9 and 2.4.0 (GHSA-27r3-jxmh-p828).
• Carry focused, same-major security backports for Joi's quadratic email splitting (GHSA-4528-x5fx-h6hg), glob's post-abort traversal (GHSA-3g3m-2fjr-6pw4), minimatch 9/10's pattern amplification (GHSA-g3hv-75wg-m249), and deepmerge's prototype poisoning (GHSA-gcqx-w48m-w2h4). Upstream sources and replacement criteria are documented in references/agents/repository/dependency-security.md. Glob's public entries use the patched unbundled modules rather than bypassing fixes through its prebuilt bundle.
• Remove legacy depcheck, its generated-template command, manifest exclusions, type surface, and version fallback. Enforce removal of furn.depcheck through the existing constraints. Knip remains the supported dependency checker.
• Remove the obsolete scripts-workspace bundlesize command/configuration; the existing yarn bundle-size workflow remains supported. Remove unused direct chalk, find-up, rimraf, tools-packages, and tools-typescript dependencies, obsolete version fallbacks, and the unused find-up-based helper. Retain active publishing/tooling dependencies rather than replacing them speculatively.
• Add installed-package regressions for CommonJS and ESM, cancellation, bounded expansion, email timing, prototype safety, and preservation of minimatch 3's callable API. Add changeset coverage for affected published manifests.

The npm graph shrinks from 1,780 to 1,745 locators. All 28 newly selected npm versions were checked against the exact age cutoff 2026-10-26T19:46:08.913Z.

Audit caveat: the recursive version audit still exits 1 with four advisory groups for the locally patched Joi, glob, minimatch, and deepmerge versions. This is not a clean version audit; nothing is excluded or suppressed. Minimatch 3.1.5 is also included in the advisory's broad version range, but has neither affected preprocessing method; the regression suite verifies that fact and its callable API. Fixed Joi/glob/minimatch releases are still inside the age gate, and deepmerge has no published fixed release. Dependabot may continue to report original versions until compatible published fixes replace the backports.

Verification

• yarn workspace @fluentui-react-native/scripts build - passed.
• yarn workspace @fluentui-react-native/scripts test - passed, 62 tests including security regressions.
• yarn workspace @fluentui-react-native/scripts lint - passed.
• yarn workspace @fluentui-react-native/bundle-size build - passed.
• yarn workspace @fluentui-react-native/bundle-size test - passed, 15 tests.
• yarn build - passed.
• yarn lint-repo - passed after resolving catalog/formatting issues.
• yarn check-agent-instructions - passed.
• yarn dedupe --check - passed, no candidates.
• yarn install --immutable --mode=skip-build - passed.
• yarn clean-lage-cache - passed; then yarn lage buildci --concurrency 4 initially failed on the new filesystem catalog entry and vendored-plugin formatting. After correcting both, the same command passed: 165 successful tasks, 11 freshly cached/skipped tasks, no failures.
• yarn change:check - passed after committing the changeset.
• yarn workspace legacy-mobile bundle:ios - passed.
• yarn workspace legacy-mobile bundle:android - passed.
• yarn workspace @fluentui-react-native/agentic-components-storybook storybook bundle --macos - passed, bundle only.
• yarn workspace @fluentui-react-native/agentic-components-storybook storybook bundle --windows - passed, bundle only.
• yarn workspace @fluentui-react-native/agentic-components-storybook storybook bundle --win32 - passed, bundle only.
• yarn npm audit --all --recursive --json --no-deprecations - exits 1 for the four explained advisory groups above; both body-parser findings are gone.
• Native app builds, native runtime tests, and Office qualification - not run. Bundle success is not native qualification.

Before	After
Vulnerable body-parser 1.20.8/2.3.0; unpatched Joi, glob, minimatch 9/10, and deepmerge; stale rnx-kit tools; legacy depcheck	Fixed body-parser; tested same-major backports; latest age-eligible rnx-kit tools; depcheck removed; 35 fewer npm locators; remaining version-only audit findings documented

Pull request checklist

This PR has considered (when applicable):

• Automated Tests
• Documentation and examples
• Keyboard Accessibility
• Voiceover
• Internationalization and Right-to-left Layouts

[github-actions]

Bundle size report

Tree-shaken, minified production esbuild bundles with React and React Native runtimes externalized.

Scenario	Modules-Mac (Δ)	Modules-Win (Δ)	Size-Mac (Δ)	Size-Win (Δ)
components-button	65 (+1)	66 (+1)	51.57k (+944b)	51.50k (+944b)
components-catalog	214 (+0)	215 (+0)	206.83k (+1.35k)	206.76k (+1.35k)
design-theme-state	34 (+0)	35 (+0)	30.15k (+0b)	30.08k (+0b)
design-themed-root	38 (+0)	39 (+0)	32.12k (+0b)	32.04k (+0b)
design-color-lib	6 (+0)	6 (+0)	6.33k (+0b)	6.33k (+0b)
design-theme-state-legacy-source	35 (+0)	36 (+0)	31.81k (+0b)	31.73k (+0b)
design-legacy-theme-from-flex	58 (+0)	59 (+0)	97.77k (+0b)	97.63k (+0b)

The job is advisory: size changes are reported but do not fail the pull request. Bundle or analysis errors still fail.

---

View bundle-size workflow run