[ChiragAgg5k]

What

Fixes Dependabot alert GHSA-mrhx-c7xc-m3w5 (high): zod < 4.6.6 can exhaust memory while validating oversized arrays.

Why this approach

zod@3.25.76 was only pulled in by @expo/cli@58.1.14 (zod: ^3.25.76). The advisory covers every version below 4.6.6 and there is no patched 3.x release, so overriding to zod 4 would break a 3.x consumer. Instead, @expo/cli@58.1.18 (shipped with expo@58.0.22) drops the zod dependency entirely.

Changes

• expo ~58.0.17 → ~58.0.22 (stays on SDK 58; pulls @expo/cli 58.1.18 and patch bumps of other @expo/* packages)
• expo-router ~58.0.25 → ~58.0.29: the newer CLI's @expo/router-server calls getRouteInfoForMatchedRoute, which 58.0.25 doesn't export, so npm run build failed without this bump
• zod is no longer in package-lock.json (npm ls zod --all is empty)

The deepmerge alert GHSA-gcqx-w48m-w2h4 is left alone because there's no upstream fix yet.

Verification

• npm ci, then npm run build with the CI env vars: web export succeeds
• npx tsc --noEmit passes

[hansi-codes]

🟢 Tier S · Ready to merge

Updates the Expo SDK 58 and Expo Router patch versions and refreshes the npm dependency lockfile. The refreshed tree no longer includes Zod.

Verdict	New comments	Fixed	Still open
✅ Approved	0	0	0

📂 Walkthrough · 2

File	Change
package.json	Raises the Expo SDK and Expo Router patch constraints.
package-lock.json	Refreshes the Expo dependency tree and removes Zod.

🔇 Filtered out · 2

Findings Hansi considered but did not post.

Finding	Why
deepmerge remains flagged by npm audit	Below minSeverity (minor)
Expo fingerprint still resolves vulnerable glob and minimatch	Verifier: This identifies pre-existing, unrelated advisories rather than a gap in the Zod fix. The base lockfile already resolves glob 13.0.6 (lines 8023–8031) and minimatch 10.2.6 (lines 12812–12818), and @expo/fingerprint already requires the identical glob and minimatch ranges (base lines 1916–1918). The PR leaves those resolutions unchanged; updating fingerprint from 0.21.6 to 0.21.8 does not introduce them. Nothing in the provided scope requires fixing all audit advisories, and these advisories do not show that the targeted Zod advisory remains unfixed.

---

_{Reviewed 0e5d344 · Details · Comment @hansi-codes review to re-run, or mention @hansi-codes with a question.}

[hansi-codes]

🟢 Tier S · Looks good to merge. Summary