fix(deps): resolve security alerts and consolidate Dependabot updates

[Jason Morse (JasonVMo)]

Platforms Impacted

• iOS
• macOS
• win32 (Office)
• windows
• android

Shared dependency graph, build/test tooling, and CI workflows; no component API or visual changes.

Description of changes

Consolidates the eligible updates from 13 open Dependabot PRs and addresses all 35 open GitHub dependency alerts as inventoried on September 20, 2026. The full recursive Yarn audit also found an additional Browserslist advisory not listed in the open GitHub alerts.

The recursive audit drops from 36 findings across 10 packages (26 high, eight moderate, two low) to zero. Each GitHub alert's vulnerable range was reproduced against the original lockfile and checked against every matching locator in the updated graph.

Security fixes

Dependency	Vulnerable installed version(s)	Updated version(s)	Issues addressed
@xmldom/xmldom	0.8.14, 0.9.11	0.8.15, 0.9.12	XML validation/serialization injection, quadratic CPU/memory consumption, and output amplification; 19 alerts across both supported lines
js-yaml	3.15.1, 4.3.1	3.15.2, 4.3.2	CPU exhaustion through empty merge sources bypassing maxTotalMergeKeys; two alerts
sharp	0.35.3	0.35.4	Bundled libheif vulnerabilities; one alert
smol-toml	1.6.1	1.8.0	Denial of service from malformed TOML; one alert
morgan	1.11.0	1.12.1	Log forging through Unicode line separators; one alert
joi	17.13.4	17.13.8	Prototype manipulation through template rename targets and custom-message language keys; two alerts
svgo	3.3.4	3.3.5	removeScripts sanitization bypasses involving executable links and foreignObject content; two alerts
fast-uri	3.1.5	3.1.7	Host confusion and SSRF-related URI normalization defects; four alerts
qs	6.15.3	6.16.0	Array-limit bypass and attacker-controlled isBuffer denial of service; two alerts
browserslist	4.25.1	4.28.9	Untrusted custom-statistics crash/prototype write; one GitHub alert, plus audit-only GHSA-c83g-rgw3-j3cx for unbounded cache growth

The existing body-parser resolution advances from 1.20.6 to 1.20.8 so its qs dependency resolves to the patched line. New resolutions narrowly target Appium's pinned morgan@1.11.0 and sharp@0.35.3; no broad major-version overrides, new ignored packages, or audit suppressions are introduced.

GitHub dependency alert references

• xmldom: 500, 499, 498, 497, 496, 495, 494, 491, 490, 489, 488, 487, 486, 485, 484, 483, 482, 477, 474.
• js-yaml: 507, 506.
• sharp: 505.
• smol-toml: 504.
• morgan: 503.
• joi: 502, 501.
• svgo: 493, 492.
• fast-uri: 481, 480, 479, 478.
• qs: 476, 475.
• browserslist: 472.

Consolidated Dependabot updates

This PR supersedes the dependency updates proposed in #4312, #4311, #4310, #4309, #4305, #4304, #4299, #4281, #4213, #4212, #4182, #4180, and the grouped Actions update #4198. Existing PRs and alerts have not been manually closed or dismissed.

Additional npm updates include tmcp 1.20.0, @fluentui/react-native-icons 2.0.341, jscodeshift 17.4.0, and markdown-link-check 3.15.0.

The SHA-pinned Actions advance to checkout 7.0.1, RNTA setup-toolchain 5.4.10, create-github-app-token 3.2.0, CodeQL 4.38.0, setup-node 7.0.0, and Changesets Action 2.1.2.

Package-age policy is unchanged: all 98 newly selected npm versions and the selected Action releases were published before the exact seven-day cutoff, 2026-09-13T20:22:40.639Z. RNTA 5.4.11 and CodeQL 4.38.1 are intentionally not selected because they are newer than that cutoff.

Coupled Changesets migration

Changesets Action v2 requires CLI v3, so both are upgraded together: CLI 3.0.2 and Action 2.1.2.

• Migrate to explicit github-token, version-script, and create-github-releases inputs.
• Preserve Git CLI pushing and explicitly disable release/tag publishing. The workflow remains version-PR-only; package publishing stays in Azure Pipelines.
• Use the v4 config schema and explicitly select the repository's oxfmt formatter.
• Align the root Node engine with the release tooling: Node 22.x starting at 22.12, 24.x, or 26+.
• Document that yarn changeset:version fails when no unreleased changeset exists. The Action still skips versioning for absent or only-empty changesets.
• Include an empty changeset because this updates repository dependency resolution/tooling without requiring a public package release.

Verification

Before	After
35 open GitHub dependency alerts; 36 recursive audit findings	No affected locators for any of the 35 alert ranges; zero recursive audit findings
Changesets CLI v2 pending release plan	CLI v3 produces the identical 77-package pending release plan

Completed locally:

• yarn format, yarn lint-repo, yarn lint-lockfile, yarn change:check, and yarn check-publishing.
• yarn dedupe --check, yarn install --immutable --mode=skip-build, and yarn npm audit --all --recursive --json --no-deprecations.
• Full uncached build/test graph: 80 successful tasks; full uncached lint graph: 84 successful tasks.
• Fluent Tester bundles for Android, iOS, macOS, Windows, and Win32; Storybook bundles for macOS, Windows, and Win32.
• Native macOS Storybook build and a real Storybook MCP initialization request using updated tmcp.
• Real Appium dependency-path probes: PNG image resize/round trip using sharp 0.35.4 (bundled libheif 1.23.2), and Morgan Unicode line-separator escaping.
• Isolated, installed Yarn fixture covering Changesets v3 versioning, dependent patch bumps, private-package exclusion, changelog generation, and oxfmt integration.
• Action release-age/SHA/input compatibility checks and no/empty/nonempty-changeset routing probes.
• Scoped codemods link-check execution with the updated markdown-link-check.

Hosted workflow execution and Windows native builds remain CI validation. GitHub had no open code-scanning alerts at inventory time; the secret-scanning API returned 404, so secret-alert coverage was not assessed.

Pull request checklist

• Automated Tests
• Documentation and examples
• Keyboard Accessibility — not applicable; no interaction changes
• Voiceover — not applicable; no accessibility changes
• Internationalization and Right-to-left Layouts — not applicable; no UI changes

[github-actions]

Bundle size report

Tree-shaken production Metro bundles. Component costs are relative to their platform shell; shell costs are absolute.

Platform	Scenario	Baseline cost	Current cost	Cost delta	Change	Gzip delta	Module delta
macos	shell	801.3 KiB	801.3 KiB	0.0 KiB	0.00%	0.0 KiB	+0
macos	components-button	50.1 KiB	57.4 KiB	+7.3 KiB	+14.58%	+2.3 KiB	+17
macos	components-catalog	267.3 KiB	281.6 KiB	+14.3 KiB	+5.35%	+5.1 KiB	+24
macos	design-theme-state	33.3 KiB	33.7 KiB	+0.4 KiB	+1.34%	+0.2 KiB	+6
macos	design-themed-root	New	36.1 KiB	New	New	New	New
macos	design-color-lib	7.1 KiB	7.1 KiB	0.0 KiB	0.00%	0.0 KiB	+0
macos	design-theme-state-legacy-source	35.3 KiB	35.8 KiB	+0.4 KiB	+1.26%	+0.1 KiB	+6
macos	design-legacy-theme-from-flex	100.2 KiB	100.7 KiB	+0.4 KiB	+0.45%	+0.1 KiB	+6
windows	shell	810.2 KiB	810.2 KiB	0.0 KiB	0.00%	0.0 KiB	+0
windows	components-button	50.0 KiB	57.2 KiB	+7.2 KiB	+14.43%	+2.4 KiB	+17
windows	components-catalog	267.0 KiB	281.2 KiB	+14.2 KiB	+5.31%	+5.1 KiB	+24
windows	design-theme-state	33.2 KiB	33.7 KiB	+0.5 KiB	+1.36%	+0.1 KiB	+6
windows	design-themed-root	New	36.0 KiB	New	New	New	New
windows	design-color-lib	7.1 KiB	7.1 KiB	0.0 KiB	0.00%	0.0 KiB	+0
windows	design-theme-state-legacy-source	35.3 KiB	35.7 KiB	+0.4 KiB	+1.27%	+0.1 KiB	+6
windows	design-legacy-theme-from-flex	100.0 KiB	100.4 KiB	+0.4 KiB	+0.44%	+0.1 KiB	+6

The job is advisory: size changes are reported but do not fail the pull request. Bundle or analysis errors still fail.

---

View bundle-size workflow run