Fix dependency vulnerabilities, update rnx-kit, and remove legacy tooling

.changeset/security-tooling-cleanup.md

@@ -0,0 +1,30 @@
+---
+'@fluentui-react-native/codemods': patch
+'@fluentui-react-native/design': patch
+'@uifabricshared/foundation-compose': patch
+'@fluentui-react-native/avatar': patch
+'@fluentui-react-native/badge': patch
+'@fluentui-react-native/button': patch
+'@fluentui-react-native/checkbox': patch
+'@fluentui-react-native/chip': patch
+'@fluentui-react-native/contextual-menu': patch
+'@fluentui-react-native/divider': patch
+'@fluentui-react-native/icon': patch
+'@fluentui-react-native/input': patch
+'@fluentui-react-native/menu': patch
+'@fluentui-react-native/menu-button': patch
+'@fluentui-react-native/notification': patch
+'@fluentui-react-native/radio-group': patch
+'@fluentui-react-native/tablist': patch
+'@fluentui-react-native/experimental-activity-indicator': patch
+'@fluentui-react-native/experimental-checkbox': patch
+'@fluentui-react-native/dropdown': patch
+'@fluentui-react-native/experimental-menu-button': patch
+'@fluentui-react-native/overflow': patch
+'@fluentui-react-native/experimental-shimmer': patch
+'@fluentui-react-native/spinner': patch
+'@fluentui-react-native/tooltip': patch
+'@fluentui/react-native': patch
+---
+
+Refresh dependency alignment with current rnx-kit tools and remove retired depcheck configuration.

.yarn/patches/deepmerge-npm-4.3.1-4f751a0844.patch

@@ -0,0 +1,72 @@
+diff --git a/dist/cjs.js b/dist/cjs.js
+index 7c36cbdd06cc22c92d590be3f87a08a91ca06b40..f5a058f5680ae278304711b8413cd9a90b3fb328 100644
+--- a/dist/cjs.js
++++ b/dist/cjs.js
+@@ -71,7 +71,8 @@ function propertyIsOnObject(object, property) {
+
+ // Protects from prototype poisoning and unexpected merging up the prototype chain.
+ function propertyIsUnsafe(target, key) {
+-	return propertyIsOnObject(target, key) // Properties are safe to merge if they don't exist in the target yet,
++	return key === '__proto__' || key === 'constructor' || key === 'prototype'
++		|| propertyIsOnObject(target, key) // Properties are safe to merge if they don't exist in the target yet,
+ 		&& !(Object.hasOwnProperty.call(target, key) // unsafe if they exist up the prototype chain,
+ 			&& Object.propertyIsEnumerable.call(target, key)) // and also unsafe if they're nonenumerable.
+ }
+@@ -80,6 +81,9 @@ function mergeObject(target, source, options) {
+ 	var destination = {};
+ 	if (options.isMergeableObject(target)) {
+ 		getKeys(target).forEach(function(key) {
++			if (propertyIsUnsafe(target, key)) {
++				return
++			}
+ 			destination[key] = cloneUnlessOtherwiseSpecified(target[key], options);
+ 		});
+ 	}
+diff --git a/dist/umd.js b/dist/umd.js
+index 4071e7c56ec8e5273fe166f6e723ac460fab8b72..2936f900c75f44e618a31b756f27bcaede1a00a5 100644
+--- a/dist/umd.js
++++ b/dist/umd.js
+@@ -75,7 +75,8 @@
+
+ 	// Protects from prototype poisoning and unexpected merging up the prototype chain.
+ 	function propertyIsUnsafe(target, key) {
+-		return propertyIsOnObject(target, key) // Properties are safe to merge if they don't exist in the target yet,
++		return key === '__proto__' || key === 'constructor' || key === 'prototype'
++			|| propertyIsOnObject(target, key) // Properties are safe to merge if they don't exist in the target yet,
+ 			&& !(Object.hasOwnProperty.call(target, key) // unsafe if they exist up the prototype chain,
+ 				&& Object.propertyIsEnumerable.call(target, key)) // and also unsafe if they're nonenumerable.
+ 	}
+@@ -84,6 +85,9 @@
+ 		var destination = {};
+ 		if (options.isMergeableObject(target)) {
+ 			getKeys(target).forEach(function(key) {
++				if (propertyIsUnsafe(target, key)) {
++					return
++				}
+ 				destination[key] = cloneUnlessOtherwiseSpecified(target[key], options);
+ 			});
+ 		}
+diff --git a/index.js b/index.js
+index 77968aed5d456cccc294f60912ef381fa1e52a7b..4e3fc275860d43e9570fc5c0a76f644f3de791f2 100644
+--- a/index.js
++++ b/index.js
+@@ -46,7 +46,8 @@ function propertyIsOnObject(object, property) {
+
+ // Protects from prototype poisoning and unexpected merging up the prototype chain.
+ function propertyIsUnsafe(target, key) {
+-	return propertyIsOnObject(target, key) // Properties are safe to merge if they don't exist in the target yet,
++	return key === '__proto__' || key === 'constructor' || key === 'prototype'
++		|| propertyIsOnObject(target, key) // Properties are safe to merge if they don't exist in the target yet,
+ 		&& !(Object.hasOwnProperty.call(target, key) // unsafe if they exist up the prototype chain,
+ 			&& Object.propertyIsEnumerable.call(target, key)) // and also unsafe if they're nonenumerable.
+ }
+@@ -55,6 +56,9 @@ function mergeObject(target, source, options) {
+ 	var destination = {}
+ 	if (options.isMergeableObject(target)) {
+ 		getKeys(target).forEach(function(key) {
++			if (propertyIsUnsafe(target, key)) {
++				return
++			}
+ 			destination[key] = cloneUnlessOtherwiseSpecified(target[key], options)
+ 		})
+ 	}

.yarn/patches/glob-npm-13.0.6-864eb0cece.patch

@@ -0,0 +1,127 @@
+diff --git a/dist/commonjs/walker.js b/dist/commonjs/walker.js
+index cb15946d9a852cf8147b2c53f4021c796df36ef9..b98a40b382ec7c2cd3b3f674f4568bb9b24cc8c3 100644
+--- a/dist/commonjs/walker.js
++++ b/dist/commonjs/walker.js
+@@ -77,8 +77,6 @@ class GlobUtil {
+         }
+     }
+     onResume(fn) {
+-        if (this.signal?.aborted)
+-            return;
+         /* c8 ignore start */
+         if (!this.paused) {
+             fn();
+@@ -185,7 +183,7 @@ class GlobUtil {
+     walkCB(target, patterns, cb) {
+         /* c8 ignore start */
+         if (this.signal?.aborted)
+-            cb();
++            return cb();
+         /* c8 ignore stop */
+         this.walkCB2(target, patterns, new processor_js_1.Processor(this.opts), cb);
+     }
+@@ -193,7 +191,7 @@ class GlobUtil {
+         if (this.#childrenIgnored(target))
+             return cb();
+         if (this.signal?.aborted)
+-            cb();
++            return cb();
+         if (this.paused) {
+             this.onResume(() => this.walkCB2(target, patterns, processor, cb));
+             return;
+@@ -249,7 +247,7 @@ class GlobUtil {
+     walkCBSync(target, patterns, cb) {
+         /* c8 ignore start */
+         if (this.signal?.aborted)
+-            cb();
++            return cb();
+         /* c8 ignore stop */
+         this.walkCB2Sync(target, patterns, new processor_js_1.Processor(this.opts), cb);
+     }
+@@ -257,7 +255,7 @@ class GlobUtil {
+         if (this.#childrenIgnored(target))
+             return cb();
+         if (this.signal?.aborted)
+-            cb();
++            return cb();
+         if (this.paused) {
+             this.onResume(() => this.walkCB2Sync(target, patterns, processor, cb));
+             return;
+diff --git a/dist/esm/walker.js b/dist/esm/walker.js
+index 3d68196c4f175f6b314b444e409f9b8a77164963..c3d401c2246bca0822bbb8f29a576beb858aef8a 100644
+--- a/dist/esm/walker.js
++++ b/dist/esm/walker.js
+@@ -74,8 +74,6 @@ export class GlobUtil {
+         }
+     }
+     onResume(fn) {
+-        if (this.signal?.aborted)
+-            return;
+         /* c8 ignore start */
+         if (!this.paused) {
+             fn();
+@@ -182,7 +180,7 @@ export class GlobUtil {
+     walkCB(target, patterns, cb) {
+         /* c8 ignore start */
+         if (this.signal?.aborted)
+-            cb();
++            return cb();
+         /* c8 ignore stop */
+         this.walkCB2(target, patterns, new Processor(this.opts), cb);
+     }
+@@ -190,7 +188,7 @@ export class GlobUtil {
+         if (this.#childrenIgnored(target))
+             return cb();
+         if (this.signal?.aborted)
+-            cb();
++            return cb();
+         if (this.paused) {
+             this.onResume(() => this.walkCB2(target, patterns, processor, cb));
+             return;
+@@ -246,7 +244,7 @@ export class GlobUtil {
+     walkCBSync(target, patterns, cb) {
+         /* c8 ignore start */
+         if (this.signal?.aborted)
+-            cb();
++            return cb();
+         /* c8 ignore stop */
+         this.walkCB2Sync(target, patterns, new Processor(this.opts), cb);
+     }
+@@ -254,7 +252,7 @@ export class GlobUtil {
+         if (this.#childrenIgnored(target))
+             return cb();
+         if (this.signal?.aborted)
+-            cb();
++            return cb();
+         if (this.paused) {
+             this.onResume(() => this.walkCB2Sync(target, patterns, processor, cb));
+             return;
+diff --git a/package.json b/package.json
+index 03ed19143e0c566f9df9a8d158b303d75a4a60b6..8cb27a4806637f042c328a0345d4616b58a7acc4 100644
+--- a/package.json
++++ b/package.json
+@@ -20,8 +20,8 @@
+       }
+     }
+   },
+-  "main": "./dist/commonjs/index.min.js",
+-  "module": "./dist/esm/index.min.js",
++  "main": "./dist/commonjs/index.js",
++  "module": "./dist/esm/index.js",
+   "types": "./dist/commonjs/index.d.ts",
+   "exports": {
+     "./package.json": "./package.json",
+@@ -38,11 +38,11 @@
+     ".": {
+       "import": {
+         "types": "./dist/esm/index.d.ts",
+-        "default": "./dist/esm/index.min.js"
++        "default": "./dist/esm/index.js"
+       },
+       "require": {
+         "types": "./dist/commonjs/index.d.ts",
+-        "default": "./dist/commonjs/index.min.js"
++        "default": "./dist/commonjs/index.js"
+       }
+     }
+   },

.yarn/patches/joi-npm-17.13.8-be9813fa0c.patch

@@ -0,0 +1,13 @@
+diff --git a/lib/types/string.js b/lib/types/string.js
+index aa8d6afe5ad8c6883f750a4d9f45e6a3a594cc46..689b00fc33db59d49a502375db6c0fcee90a171f 100755
+--- a/lib/types/string.js
++++ b/lib/types/string.js
+@@ -294,7 +294,7 @@ module.exports = Any.extend({
+                 Assert(options.multiple === undefined || typeof options.multiple === 'boolean', 'multiple option must be an boolean');
+
+                 const address = internals.addressOptions(options);
+-                const regex = new RegExp(`\\s*[${options.separator ? EscapeRegex(options.separator) : ','}]\\s*`);
++                const regex = options.multiple ? new RegExp(`(?:(?<!\\s)\\s+)?[${options.separator ? EscapeRegex(options.separator) : ','}]\\s*`) : undefined;
+
+                 return this.$_addRule({ name: 'email', args: { options }, regex, address });
+             },

.yarn/patches/minimatch-npm-10.2.6-fd0d1cf467.patch

@@ -0,0 +1,62 @@
+diff --git a/dist/commonjs/index.js b/dist/commonjs/index.js
+index 5a6983481b78583d75c89a17c5a8371b059171ff..b7c02adf6c4f9c24c9e75265a3a3642c7dade936 100644
+--- a/dist/commonjs/index.js
++++ b/dist/commonjs/index.js
+@@ -453,6 +453,7 @@ class Minimatch {
+     // **/*/<rest> -> */**/<rest> <== not valid because ** doesn't follow
+     // this WOULD be allowed if ** did follow symlinks, or * didn't
+     firstPhasePreProcess(globParts) {
++        const { braceExpandMax = 100_000 } = this.options;
+         let didSomething = false;
+         do {
+             didSomething = false;
+@@ -480,7 +481,8 @@ class Minimatch {
+                         p === '..' ||
+                         !p2 ||
+                         p2 === '.' ||
+-                        p2 === '..') {
++                        p2 === '..' ||
++                        globParts.length >= braceExpandMax) {
+                         continue;
+                     }
+                     didSomething = true;
+@@ -537,6 +539,8 @@ class Minimatch {
+     // {<pre>/**/<rest>,<pre>/**/<p>/<rest>} -> <pre>/**/<rest>
+     // ^-- not valid because ** doens't follow symlinks
+     secondPhasePreProcess(globParts) {
++        if (globParts.length > 1000)
++            return globParts;
+         for (let i = 0; i < globParts.length - 1; i++) {
+             for (let j = i + 1; j < globParts.length; j++) {
+                 const matched = this.partsMatch(globParts[i], globParts[j], !this.preserveMultipleSlashes);
+diff --git a/dist/esm/index.js b/dist/esm/index.js
+index a5e6fa88fdc6d6ec05d26ab4975718824cbc8bdc..11465360cb9b66b6922ae83df4b40e4c24b330d9 100644
+--- a/dist/esm/index.js
++++ b/dist/esm/index.js
+@@ -444,6 +444,7 @@ export class Minimatch {
+     // **/*/<rest> -> */**/<rest> <== not valid because ** doesn't follow
+     // this WOULD be allowed if ** did follow symlinks, or * didn't
+     firstPhasePreProcess(globParts) {
++        const { braceExpandMax = 100_000 } = this.options;
+         let didSomething = false;
+         do {
+             didSomething = false;
+@@ -471,7 +472,8 @@ export class Minimatch {
+                         p === '..' ||
+                         !p2 ||
+                         p2 === '.' ||
+-                        p2 === '..') {
++                        p2 === '..' ||
++                        globParts.length >= braceExpandMax) {
+                         continue;
+                     }
+                     didSomething = true;
+@@ -528,6 +530,8 @@ export class Minimatch {
+     // {<pre>/**/<rest>,<pre>/**/<p>/<rest>} -> <pre>/**/<rest>
+     // ^-- not valid because ** doens't follow symlinks
+     secondPhasePreProcess(globParts) {
++        if (globParts.length > 1000)
++            return globParts;
+         for (let i = 0; i < globParts.length - 1; i++) {
+             for (let j = i + 1; j < globParts.length; j++) {
+                 const matched = this.partsMatch(globParts[i], globParts[j], !this.preserveMultipleSlashes);

.yarn/patches/minimatch-npm-9.0.9-3ee8f15008.patch

@@ -0,0 +1,62 @@
+diff --git a/dist/commonjs/index.js b/dist/commonjs/index.js
+index c12dc5e6476874f9dbba429a19e445a4a688e1df..84850bec3610e1002825d5f5b95b4212280d8c26 100644
+--- a/dist/commonjs/index.js
++++ b/dist/commonjs/index.js
+@@ -446,6 +446,7 @@ class Minimatch {
+     // **/*/<rest> -> */**/<rest> <== not valid because ** doesn't follow
+     // this WOULD be allowed if ** did follow symlinks, or * didn't
+     firstPhasePreProcess(globParts) {
++        const { braceExpandMax = 100_000 } = this.options;
+         let didSomething = false;
+         do {
+             didSomething = false;
+@@ -473,7 +474,8 @@ class Minimatch {
+                         p === '..' ||
+                         !p2 ||
+                         p2 === '.' ||
+-                        p2 === '..') {
++                        p2 === '..' ||
++                        globParts.length >= braceExpandMax) {
+                         continue;
+                     }
+                     didSomething = true;
+@@ -530,6 +532,8 @@ class Minimatch {
+     // {<pre>/**/<rest>,<pre>/**/<p>/<rest>} -> <pre>/**/<rest>
+     // ^-- not valid because ** doens't follow symlinks
+     secondPhasePreProcess(globParts) {
++        if (globParts.length > 1000)
++            return globParts;
+         for (let i = 0; i < globParts.length - 1; i++) {
+             for (let j = i + 1; j < globParts.length; j++) {
+                 const matched = this.partsMatch(globParts[i], globParts[j], !this.preserveMultipleSlashes);
+diff --git a/dist/esm/index.js b/dist/esm/index.js
+index 737c8095415235e69e4717b505d0ee4ea3c0b6fa..2f5c664caefe4ee02c87663def8c6e570f75a269 100644
+--- a/dist/esm/index.js
++++ b/dist/esm/index.js
+@@ -434,6 +434,7 @@ export class Minimatch {
+     // **/*/<rest> -> */**/<rest> <== not valid because ** doesn't follow
+     // this WOULD be allowed if ** did follow symlinks, or * didn't
+     firstPhasePreProcess(globParts) {
++        const { braceExpandMax = 100_000 } = this.options;
+         let didSomething = false;
+         do {
+             didSomething = false;
+@@ -461,7 +462,8 @@ export class Minimatch {
+                         p === '..' ||
+                         !p2 ||
+                         p2 === '.' ||
+-                        p2 === '..') {
++                        p2 === '..' ||
++                        globParts.length >= braceExpandMax) {
+                         continue;
+                     }
+                     didSomething = true;
+@@ -518,6 +520,8 @@ export class Minimatch {
+     // {<pre>/**/<rest>,<pre>/**/<p>/<rest>} -> <pre>/**/<rest>
+     // ^-- not valid because ** doens't follow symlinks
+     secondPhasePreProcess(globParts) {
++        if (globParts.length > 1000)
++            return globParts;
+         for (let i = 0; i < globParts.length - 1; i++) {
+             for (let j = i + 1; j < globParts.length; j++) {
+                 const matched = this.partsMatch(globParts[i], globParts[j], !this.preserveMultipleSlashes);

.yarn/plugins/@rnx-kit/yarn-plugin-dynamic-extensions.cjs

@@ -68,7 +68,8 @@ exports.factory = (require) => {
           return;
         }
 
-        workspace.project.workspacesByCwd.forEach(({ cwd, manifest }) => {
+        const workspaces = workspace.project.workspacesByCwd.values();
+        for (const { cwd, manifest } of workspaces) {
           const { name, version, raw } = manifest;
           if (!name || !version) {
             return;
@@ -83,7 +84,7 @@ exports.factory = (require) => {
 
           const descriptor = structUtils.makeDescriptor(name, version);
           registerPackageExtension(descriptor, data);
-        });
+        }
       },
     },
   };