[Aikido] Fix 5 critical issues in thirdweb, wagmi, @changesets/parse and 4 more

[aikido-autofix]

Patches critical RCE vulnerabilities in React Native CLI, fixes cryptographic signature weakness, and mitigates potential prototype pollution and SDK supply chain risks.

✅ 4 CVEs resolved by this upgrade, including 1 critical 🚨 CVE

This PR will resolve the following CVEs:

Issue	Severity	Description
AIKIDO-2025-10854	🚨 CRITICAL	Metro dev server in React Native CLI allows unauthenticated remote attackers to inject and execute arbitrary OS commands via crafted POST requests, with potential for full remote code execution, especially on Windows systems.
AIKIDO-2024-10466	MEDIUM	Signature algorithm vulnerability allows private key recovery by exploiting nonce reuse, enabling attackers to compromise cryptographic system security through repeated transaction signatures.
GHSA-qj3p-xc97-xw74	MEDIUM	A malicious debug package version could interfere with dApp-to-wallet communication when installed during a specific time window, potentially compromising browser-based MetaMask SDK applications through dependency injection.
AIKIDO-2025-10809	MEDIUM	Prototype Pollution vulnerability in YAML parsing allows attackers to inject malicious properties into object prototypes, potentially leading to remote code execution, DoS, or other security breaches through crafted input.

🔗 Related Tasks

• https://linear.app/cube-labs/issue/CUB-2795/major-upgrade-for-react-native-communitycli

---

PR-Codex overview

This PR focuses on updating the package.json files across multiple packages, including dependencies, devDependencies, and adjustments to file structures, ensuring compatibility with newer versions and improving project organization.

Detailed summary

• Updated files array formatting in package.json files.
• Increased version of wagmi from 2.14.11 to 2.17.1.
• Updated @babel packages to 7.28.x.
• Adjusted react and react-dom versions to 19.2.3.
• Enhanced @privy-io/cross-app-connect version to 0.2.3.
• Updated viem version to 2.44.4.

The following files were skipped due to too many changes: pnpm-lock.yaml

✨ Ask PR-Codex anything about this PR by commenting with /codex {your question}

[changeset-bot]

⚠️ No Changeset found

Latest commit: 87bd286

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[cursor]

PR Summary

Focuses on dependency pinning and small package adjustments to address security and compatibility.

• Adds pnpm overrides to pin versions of @react-native-community/cli, @react-native-community/cli-server-api, react-native, metro, metro-config, @changesets/parse, and js-yaml
• Updates packages/agw-react dev dependency thirdweb to a specific nightly build
• Bumps wagmi devDependency in packages/web3-react-agw to ^2.17.1
• Minor JSON formatting cleanups (e.g., lint-staged, files, typesVersions)

^{Written by Cursor Bugbot for commit 87bd286. This will update automatically on new commits. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes and found 3 potential issues.

^{Bugbot Autofix is OFF. To automatically fix reported issues with Cloud Agents, enable Autofix in the Cursor dashboard.}

[cursor]

Nightly build used instead of stable release

Medium Severity

The thirdweb devDependency was changed from stable ^5.68.0 to a nightly build 5.72.0-nightly-393d0cfb504401d6449a75cbe8422946d157fc93-20241202000349 from December 2024. Nightly builds are inherently unstable and intended for temporary testing, not production dependencies. The peerDependency still specifies stable ^5.68.0, creating a mismatch. This appears unintentional for a security-focused PR and could cause unexpected test failures or behavior during development.

 

[cursor]

Security overrides may target vulnerable versions

High Severity

The pnpm overrides for metro and metro-config pin to version 0.83.2, but the Snyk vulnerability database shows 0.83.3 as the "latest non-vulnerable version." This suggests 0.83.2 may still be vulnerable to the Metro dev server RCE vulnerability (AIKIDO-2025-10854). The overrides would force users to a potentially vulnerable version instead of the patched 0.83.3.

 

[cursor]

Missing security overrides for newer vulnerable branches

Medium Severity

The pnpm overrides for @react-native-community/cli-server-api and @react-native-community/cli only cover versions <=17.0.1. However, the CVE-2025-11953 RCE vulnerability also affects versions 18.0.0, 19.0.0-alpha.0 through 19.1.1, and 20.0.0-alpha.x. If any transitive dependency requires these versions, the override pattern would not match and users would remain vulnerable to the critical RCE.