fix(FFESUPPORT-885): remediate July 2026 dependabot vulnerabilities

[aarsilv]

🤖 Generated from Claude

Remediates the 9 open Dependabot alerts in react-native-sdk, split across the published SDK's dev tooling and the non-shipped demo app. Jira: https://datadoghq.atlassian.net/browse/FFESUPPORT-885

Advisories closed

Main SDK (yarn.lock, dev/build tooling):

Advisory	Severity	Package	Before → After
GHSA-h67p-54hq-rp68	medium	js-yaml	3.14.2 → 3.15.0
GHSA-h67p-54hq-rp68	medium	js-yaml	4.1.1 → 4.3.0

Example demo app (example/yarn.lock, not published):

Advisory	Severity	Package	Before → After
undici	high/med/low	undici	6.26.0 → 6.27.0
tar	medium	tar	7.5.15 → 7.5.20
GHSA-h67p-54hq-rp68	medium	js-yaml	3.14.2/4.1.1 → 3.15.0/4.3.0

Approach

Lockfile-only re-resolution to patched in-range versions in both lockfiles — no package.json change, no resolutions. @babel/core in the main lockfile was already 7.29.7 (not vulnerable), so it wasn't touched. The example/ app is a local demo (not published), so its runtime-scoped alerts carry no consumer risk. No published-SDK runtime dependency moved (only prod dep is @eppo/js-client-sdk-common, untouched).

How the tests/CI protect this change

• yarn install --frozen-lockfile ✓ in both root and example/.
• yarn typecheck (tsc --noEmit) ✓, eslint "**/*.{js,ts,tsx}" ✓.
• yarn test — 38 tests / 2 suites pass.

Deferred advisories

None — all 9 alerts addressed; none left dismissed/auto-dismissed. (The @eppo/js-client-sdk-common version bump to pick up js-sdk-common's fix is tracked separately under FFESUPPORT-691.)

[Copilot]

Copilot wasn't able to review any files in this pull request.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[aarsilv]

🤖 Response from codex:

LGTM

• yarn.lock: vulnerable js-yaml 3.14.2/4.1.1 are absent; only patched 3.15.0/4.3.0 remain. @babel/core remains 7.29.7.
• example/yarn.lock: vulnerable undici 6.26.0 and tar 7.5.15 are absent; resolved versions are 6.27.0 and 7.5.20. Patched js-yaml versions also match the root lockfile.
• All bumps satisfy existing semver ranges and preserve dependency edges; affected packages are SDK dev tooling or private example/Expo tooling, not published SDK runtime dependencies.
• Scope is limited to the two lockfiles; no manifest/source changes or deferred advisories.

(codex ran locally via codex exec read-only; relayed here — GitHub blocked codex posting directly under the sandbox.)