The Bun audit reports GHSA-w3rx-r6r6-pgpr and GHSA-5p2g-fcmc-qvqq in Expo and React Native's Metro build-tooling path. The registry currently exposes image-size 2.0.2 as the latest release, and both advisories affect <=2.0.2. The shipped app runtime does not expose Metro's local asset inspection to users.
Disposition: time-limited accepted exception through 2026-09-30. CI must fail if the exact advisory set changes or any other high/critical finding appears.
Acceptance:
- Upgrade after a patched image-size release and compatible Metro call sites exist.
- Re-run Expo Doctor, app/Worker checks, and Android export.
- Remove the exception before its expiry.
The Bun audit reports GHSA-w3rx-r6r6-pgpr and GHSA-5p2g-fcmc-qvqq in Expo and React Native's Metro build-tooling path. The registry currently exposes image-size 2.0.2 as the latest release, and both advisories affect <=2.0.2. The shipped app runtime does not expose Metro's local asset inspection to users.
Disposition: time-limited accepted exception through 2026-09-30. CI must fail if the exact advisory set changes or any other high/critical finding appears.
Acceptance: