[GSTJ]

Summary

Migrates the remaining vulnerable development tooling and backports deepmerge's unpublished fix. Keeps the plugin's public API and Expo peer requirement unchanged.

Details

• Moves to Jest 30 and a TypeScript transformer, removing the old Expo test-tooling dependency tree. Contributor commands and mock setup changes are documented in the security policy.
• Pins patched basic-ftp, Zod, minimatch and glob versions. Adds a CommonJS compatibility patch for legacy minimatch callers and exercises the APIs used by Expo and release tooling.
• Patches deepmerge's source and both bundled builds against prototype poisoning from either merge operand. npm still has no 4.3.2 release. Its narrow advisory exception is guarded by installed-source assertions and exploit regressions before the existing high-severity audit gate.
• Preserves the established patch-release policy for build(deps) security commits. The changelog control covers breaking notes, including hidden commit types, and rejects an intentionally broken preset. No consumer migration or new public breaking change is introduced.
• Command transcript, audit output and tested file hashes. The image below renders captured command output; it does not claim native device execution.

Testing steps

With Node 24 and pnpm 11.17.0, run:

pnpm install --frozen-lockfile
pnpm run lint
pnpm run format
pnpm run typecheck
pnpm run test --runInBand
pnpm run build
pnpm run changelog:check
pnpm run security:check
npm pack --dry-run

Each command should exit successfully. The security probes should reject the hostile inputs, preserve normal matching and merge behavior, and accept Expo's valid plugin schemas.