fix(deps): upgrade direct and transitive dependencies to reduce security alerts

[Copilot]

Affected Package(s)

• @forward-software/react-auth (lib)
• @forward-software/react-auth-google (packages/google-signin)
• Examples
• CI/CD / Repository configuration

Related Issue(s)

Addresses repository security/quality dependency alerts from direct and transitive packages.

Motivation

This PR reduces dependency risk by moving workspace packages to newer compatible versions and refreshing the lockfile to pick up patched transitive releases. The goal is to clear actionable alerts without changing runtime behavior.

Description of Changes

• Direct dependency bumps: updated @types/node across workspace packages; updated adapter-local dev deps (expo-modules-core in Apple adapter, internal @forward-software/react-auth dev reference in adapters).
• Transitive remediation via lockfile refresh: updated dependency graph to pull patched downstream versions (including prior brace-expansion/nanoid paths).
• Residual-risk note: remaining image-size alert is still upstream-unpatched in the React Native/Metro chain.

{
  "lib": { "@types/node": "^26.5.0" },
  "packages/google-signin": {
    "@forward-software/react-auth": "^2.1.0",
    "@types/node": "^26.5.0"
  },
  "packages/apple-signin": {
    "@forward-software/react-auth": "^2.1.0",
    "@types/node": "^26.5.0",
    "expo-modules-core": "^57.0.17"
  }
}

Breaking Changes

None

How to Test

1. CI Checks: Verify that all automated tests (Vitest) and build steps pass successfully on this PR.
2. Local Verification (Optional):
   • Run pnpm install to install dependencies.
   • Run pnpm --filter <affected-package> test to run tests for the affected package.
   • Run pnpm --filter <affected-package> build to verify the build succeeds.
   • Run pnpm --filter <affected-package> lint to check for linting errors.

Checklist

• My code follows the project's style guidelines
• I have added or updated tests to cover the changes
• I have updated relevant documentation
• All tests are passing locally
• CI checks are passing
• I have reviewed my own code and lock file changes
• I have checked for any potential security implications
• I have verified the changes work as expected
• My commit messages follow Conventional Commits format

Notes for Reviewers

Apple adapter (packages/apple-signin) was also updated, but this legacy template does not include an explicit checkbox for it.

[Copilot]

🔵 Needs a closer look

A lockfile refresh updates a broad set of transitive packages and should be validated by CI runs across the configured Node matrix before approval.

Pull request overview

This PR updates direct workspace devDependencies and refreshes the pnpm lockfile to pick up patched transitive dependency versions, aiming to reduce dependency/security alerts without changing runtime behavior.

Changes:

• Bumped @types/node from ^26.4.1 to ^26.5.0 across affected packages.
• Updated adapter devDependencies to reference @forward-software/react-auth ^2.1.0 and bumped expo-modules-core in the Apple adapter to ^57.0.17.
• Refreshed pnpm-lock.yaml to pull newer transitive versions (e.g., brace-expansion, nanoid, postcss, undici, rolldown bindings).

File summaries

File	Description
pnpm-lock.yaml	Lockfile refresh to incorporate direct bumps and patched transitive dependency versions.
packages/google-signin/package.json	Updates devDependency versions for @forward-software/react-auth and @types/node.
packages/apple-signin/package.json	Updates devDependency versions for @forward-software/react-auth, @types/node, and expo-modules-core.
lib/package.json	Updates @types/node devDependency version.

Review details

Files not reviewed (1)

• pnpm-lock.yaml: Generated file

• Files reviewed: 3/4 changed files
• Comments generated: 0
• Review effort level: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.