[Snyk] Security upgrade @actions/cache from 1.0.8 to 4.0.0

[revan-zhang]

Snyk has created this PR to fix 1 vulnerabilities in the yarn dependencies of this project.

Snyk changed the following file(s):

• expo-server/package.json
• expo-server/yarn.lock

Note for zero-installs users

If you are using the Yarn feature zero-installs that was introduced in Yarn V2, note that this PR does not update the .yarn/cache/ directory meaning this code cannot be pulled and immediately developed on as one would expect for a zero-install project - you will need to run yarn to update the contents of the ./yarn/cache directory.
If you are not using zero-install you can ignore this as your flow should likely be unchanged.

Vulnerabilities that will be fixed with an upgrade:

	Issue	Score
	Infinite loop SNYK-JS-BRACEEXPANSION-15789759	555

---

Important

• Check the changes in this PR to ensure they won't cause issues with your project.
• Max score is 1000. Note that the real score may have changed since the PR was raised.
• This PR was automatically created by Snyk using the credentials of a real user.

---

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report
📜 Customise PR templates
🛠 Adjust project settings
📚 Read about Snyk's upgrade logic

---

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Learn about vulnerability in an interactive lesson of Snyk Learn.

---

---

Note

Medium Risk
Upgrades a core GitHub Actions dependency (@actions/cache) across major versions, which could introduce behavior/API differences in caching and its transitive Azure/HTTP stack.

Overview
Updates expo-server to use @actions/cache ^4.0.0 (from ^1.0.8) to address a reported vulnerability.

Regenerates yarn.lock accordingly, pulling in newer transitive dependencies (notably updated @actions/* HTTP/core packages and newer Azure storage/cache-related libraries).

^{Written by Cursor Bugbot for commit d963624. This will update automatically on new commits. Configure here.}

[revan-zhang]

⛔ Snyk checks have failed. 5 issues have been found so far.

Status	Scan Engine	Critical	High	Medium	Low	Total (5)
⛔	Open Source Security	0	2	3	0	5 issues
✅	Licenses	0	0	0	0	0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	eslint@​8.6.0 ⏵ 7.32.0	+1
	eslint-config-prettier@​8.3.0 ⏵ 8.5.0
	@​types/​js-yaml@​4.0.5
	@​types/​shelljs@​0.8.11
	@​types/​jest@​27.4.0 ⏵ 26.0.24
	@​types/​node@​16.11.19 ⏵ 12.20.55			-1	-1
	needle@​2.8.0
	husky@​5.2.0
	@​vercel/​ncc@​0.33.1 ⏵ 0.27.0				-2
	@​actions/​io@​1.1.1 ⏵ 1.1.2				-3
	@​actions/​github@​5.0.0 ⏵ 4.0.0	+1			-7
	@​actions/​core@​1.11.1
	@​actions/​github@​5.0.0 ⏵ 6.0.1			+1	-3
	eslint-plugin-prettier@​4.0.0 ⏵ 3.4.1
	axios@​1.13.5
	axios@​1.13.6
	@​typescript-eslint/​eslint-plugin@​5.9.1 ⏵ 4.33.0	+1		+1
	@​typescript-eslint/​parser@​5.9.1 ⏵ 4.33.0
	eslint-plugin-jest@​24.7.0

View full report

[devin-ai-integration]

Devin Review found 1 potential issue.

View 2 additional findings in Devin Review.

[devin-ai-integration]

🔴 Build output not regenerated after @actions/cache v1→v4 upgrade, making the change a no-op at runtime

The build/ directory contains ncc-bundled code that GitHub Actions actually executes (per action.yml:19 → main: build/setup/index.js). The PR updates @actions/cache from ^1.0.8 to ^4.0.0 in package.json and yarn.lock, but does not regenerate the build output. The bundled build/setup/index.js still contains the old v1 cache library code — confirmed by the absence of any v4-specific symbols (getCacheServiceVersion, cacheTwirpClient, ACTIONS_RESULTS_URL) in the build output, while v1-only patterns remain. This means the dependency upgrade has zero effect at runtime and the commit message's stated goal ("reduce vulnerabilities") is not achieved. The CONTRIBUTING.md explicitly requires: "Run yarn build to ensure the build is up-to-date and runs correctly and without errors or warnings."

Prompt for agents

The build/ directory is bundled via ncc (see expo-server/ncc.js) and is what GitHub Actions actually runs at runtime (action.yml main: build/setup/index.js). After changing the @actions/cache dependency version in package.json, you must regenerate the build output by running `yarn build` (or `node ncc.js`) from the expo-server directory. Without this step, the bundled code in build/setup/index.js, build/command/index.js, and build/preview-comment/index.js still contains the old @actions/cache v1 code, making the entire dependency upgrade ineffective at runtime. Run the build and commit the updated build/ output.

---

Was this helpful? React with 👍 or 👎 to provide feedback.