chore(protocol): patch vulnerable transitive dependencies

[markmur]

Summary

• Pin brace-expansion 1.x to 1.1.16.
• Pin nanoid 3.x to 3.3.18 to address the newly disclosed generator denial-of-service issue.
• Regenerate the Protocol lockfile without changing direct dependencies.

Stack

1. chore(protocol): patch vulnerable transitive dependencies #716
2. chore(web): patch vulnerable transitive dependencies #717
3. chore(react-native): patch vulnerable transitive dependencies #718
4. chore(react-native): replace vulnerable URI decoder #719

[github-actions]

React Native — Coverage Report

Lines	Statements	Branches	Functions
	90.97% (363/399)	87.29% (213/244)	100% (92/92)

[github-actions]

Web — Coverage Report

Lines	Statements	Branches	Functions
	94.4% (287/304)	81.11% (146/180)	98.7% (76/77)

[github-actions]

Package Size

Platform	Artifact	Base	Head	Delta
Web	npm tarball	70.2 KiB	70.2 KiB	-2 B
React Native	npm tarball	108.5 KiB	108.5 KiB	0 B
Android	release AAR	364.8 KiB	364.8 KiB	0 B

Web file breakdown

File	Base	Head	Delta
dist/index.js.map	191.6 KiB	191.6 KiB	0 B
dist/index.d.ts	44.9 KiB	44.9 KiB	0 B
dist/custom-elements.json	43.8 KiB	43.8 KiB	0 B
dist/index.js	31.5 KiB	31.5 KiB	0 B
README.md	19.0 KiB	19.0 KiB	0 B
package.json	2.9 KiB	2.9 KiB	0 B
LICENSE	1.1 KiB	1.1 KiB	0 B

React Native file breakdown

File	Base	Head	Delta
node_modules/@shopify/checkout-kit-protocol/src/generated/Models.ts	85.4 KiB	85.4 KiB	0 B
node_modules/@shopify/checkout-kit-protocol/src/generated/Models.d.ts	53.0 KiB	53.0 KiB	0 B
android/src/main/java/com/shopify/reactnative/checkoutkit/ShopifyCheckoutKitModule.java	16.0 KiB	16.0 KiB	0 B
ios/ShopifyCheckoutKit.swift	15.9 KiB	15.9 KiB	0 B
ios/AcceleratedCheckoutButtons.swift	14.1 KiB	14.1 KiB	0 B
src/components/AcceleratedCheckoutButtons.tsx	13.0 KiB	13.0 KiB	0 B
src/index.ts	12.7 KiB	12.7 KiB	0 B
lib/commonjs/index.js	12.4 KiB	12.4 KiB	0 B
lib/commonjs/components/AcceleratedCheckoutButtons.js	11.4 KiB	11.4 KiB	0 B
src/index.d.ts	11.1 KiB	11.1 KiB	0 B
lib/commonjs/components/AcceleratedCheckoutButtons.js.map	10.4 KiB	10.4 KiB	0 B
lib/module/index.js	10.4 KiB	10.4 KiB	0 B
lib/module/components/AcceleratedCheckoutButtons.js	10.2 KiB	10.2 KiB	0 B
node_modules/@shopify/checkout-kit-protocol/src/generated/ProtocolNotifications.ts	9.5 KiB	9.5 KiB	0 B
lib/module/components/AcceleratedCheckoutButtons.js.map	9.1 KiB	9.1 KiB	0 B
lib/module/index.js.map	8.1 KiB	8.1 KiB	0 B
src/present-dispatcher.ts	8.0 KiB	8.0 KiB	0 B
lib/commonjs/index.js.map	7.9 KiB	7.9 KiB	0 B
node_modules/@shopify/checkout-kit-protocol/src/generated/ProtocolNotifications.d.ts	7.6 KiB	7.6 KiB	0 B
node_modules/@shopify/checkout-kit-protocol/src/generated/ProtocolRenameMap.ts	7.2 KiB	7.2 KiB	0 B
…and 117 smaller files

Android file breakdown

File	Base	Head	Delta
classes.jar	388.4 KiB	388.4 KiB	0 B
res/layout/checkout_view_content.xml	2.6 KiB	2.6 KiB	0 B
res/layout/checkout_sheet_content.xml	2.0 KiB	2.0 KiB	0 B
res/values/values.xml	1.3 KiB	1.3 KiB	0 B
R.txt	1.2 KiB	1.2 KiB	0 B
AndroidManifest.xml	922 B	922 B	0 B
proguard.txt	798 B	798 B	0 B
res/drawable/close.xml	431 B	431 B	0 B
res/menu/checkout_menu.xml	354 B	354 B	0 B
META-INF/com/android/build/gradle/aar-metadata.properties	157 B	157 B	0 B

Measured from the PR base SHA and PR head SHA. The file breakdown shows uncompressed sizes within each package artifact, so individual files do not sum to the compressed artifact total. This comment reports package artifact sizes only; it is not a final app binary-size report.

[bitrise]

Install this build

Open Tophat, select your target device, then click Install. Links open on the Mac running Tophat.

SDK	Install
React Native	Install with Tophat
Swift	Install with Tophat
Kotlin	Install with Tophat

Checkout Kit E2E results

Status	Suite	Target	Platform	OS version tag	Device
✅	react-native-ios	react-native	ios	latest	iPhone 15 iOS 27 Beta
✅	react-native-android	react-native	android	latest	Google Pixel 9 Android 17.0
❌	kotlin-android	kotlin	android	latest	Google Pixel 9 Android 17.0
✅	swift-ios	swift	ios	latest	iPhone 15 iOS 27 Beta

Failures

Caution

These E2E checks are not yet required, so they do not block merging — but a failure may still indicate a real issue to resolve before merging.
If you believe an assertion is flaky, please raise a ticket in the #checkout-kit-devs channel so it can be addressed.

BrowserStack artifacts require BrowserStack access. Sign in to BrowserStack App Automate before opening artifact links.

Android — kotlin-android

Test	Status	Artifacts
./tests/shared/checkout-guest	❌	BrowserStack · Video · Screenshot · Maestro commands · Maestro log