fix(SEC-7530): update react-server-dom-webpack to 19.0.1

[pkaeding]

Summary

Fixes SEC-7530 by adding a yarn resolution to override the vulnerable transitive dependency react-server-dom-webpack from version 19.0.0-rc-6230622a1a-20240610 to the safe version 19.0.1.

The vulnerable version was pulled in by jest-expo@~52.0.2. Using a yarn resolution is the standard approach to override transitive dependencies.

Link to Devin run: https://app.devin.ai/sessions/b4c805fbfef942e1adbe1b06a11d5f3c
Requested by: Patrick Kaeding (@pkaeding)

How did you test this change?

• Ran yarn install to verify the resolution is applied correctly
• Ran yarn format:all to ensure code formatting passes
• CI will validate that tests pass with the updated dependency

Are there any deployment considerations?

No deployment considerations. This is a dev/test dependency update only.

---

Note

Pins react-server-dom-webpack to 19.0.1 with a Yarn resolution and updates lockfile (peer ranges and webpack-sources).

• Dependencies:
  • Add Yarn resolutions entry to force [email protected] in package.json.
  • Update yarn.lock to resolve react-server-dom-webpack to 19.0.1 with updated peer deps (react, react-dom -> ^19.0.1).
  • Add webpack-sources@^3.2.0 dependency (resolved to 3.3.3) required by the updated package.

^{Written by Cursor Bugbot for commit dbecbbb. This will update automatically on new commits. Configure here.}

---

Related Jira issue: SEC-7530: Update react-server-dom-webpack in observability-sdk

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment and CI monitoring

[mayberryzane]

👍