[jphein]

From realmwatch-e5's fleet audit (2026-10-21, internet-facing table): forage.techempower.org's .nvmrc pinned Node 20 (EOL 2026-04-30), and npm audit showed 2 critical vulnerabilities.

Changes

• .nvmrc and setup-node in ci / deploy-web / release / sync-data: 20 → 22.
• overrides.shell-quote: ^1.8.5 (resolves to 1.12.0; CVE-2026-9277; vulnerable ≤1.8.4). Consumers are React Native CLI tools and react-devtools-core, which are dev and build tooling, not in the web bundle.
• Not changed: tar (critical, ≤7.5.20 via @expo/cli and cacache). Overriding to tar 7 breaks expo prebuild ("Cannot read properties of undefined (reading 'extract')", reproduced), and the release builds need prebuild. It's build-time only and clears with an Expo SDK upgrade.

Checked locally on Node 22

• clean npm ci from the lockfile;
• npm run typecheck;
• npm run lint (0 errors);
• npx expo export --platform web (the deploy command);
• npx expo prebuild --platform android --no-install --clean (the positive control: it fails under tar 7 and passes with tar 6.2.1).

npm audit: critical 2 → 1.

Not changed: EAS remote build workers. eas.json pins no Node version, so EAS keeps its image default; release.yml's Node only affects the runner that calls eas-cli.

Reviews

• Cross-vendor review (xreview, gpt-6.1-sol): MERGE-AFTER-FIXES. Items 1, 2 and 4 are answered above (lockfile committed plus clean npm ci, export run, consumers listed); item 3 is the EAS note.
• gitleaks clean.

Merged by vale after CI.

🤖 Generated with Claude Code

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

[coderabbitai]

Note

Currently processing new changes in this PR. This may take a few minutes, please wait...

⚙️ Run configuration

• Configuration used: defaults
• Review profile: CHILL
• Plan: Advanced
• Run ID: aeb415b2-3645-4699-9800-1679ce89d868

📥 Commits

Reviewing files that changed from the base of the PR and between f422689 and f286d01.

⛔ Files ignored due to path filters: 1

• package-lock.json is excluded by !**/package-lock.json

📒 Files selected for processing: 6

• .github/workflows/ci.yml
• .github/workflows/deploy-web.yml
• .github/workflows/release.yml
• .github/workflows/sync-data.yml
• .nvmrc
• package.json

+----------------------------------------------------------------------------------------------------------------------------------------------------+
| There are no final decisions. No decision is cast in stone. Instead, consider each as being written in the sand at the beach, and plan for change. |
+----------------------------------------------------------------------------------------------------------------------------------------------------+
  \
   \     /)/)
        ( '')
        /  |
      o(___)

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[jphein]

Merged by vale. Gates:

• CI green (checks: success);
• local checks on Node 22: clean npm ci, typecheck, lint 0 errors, expo export web, expo prebuild android;
• perturbation: tar 7 broke prebuild, so it was reverted;
• cross-vendor review (gpt-6.1-sol): MERGE-AFTER-FIXES, items answered in the PR body;
• gitleaks clean.