chore(deps): take Expo SDK 57, hold jest 29, document the two advisories we cannot fix

Expo SDK 56 to 57 (React Native 0.85 to 0.86, React unchanged at 19.2). Expo
ships this as an explicitly non breaking release, which is the deliberate SDK
move the react-native all-update-types dependabot ignore exists to wait for.

The sanctioned command does not work on its own: "expo install expo@^57 --fix"
rewrites every runtime pin and then fails npm install with an ERESOLVE, because
it only touches dependencies and never devDependencies, so jest-expo 56 still
demanded @react-native/jest-preset ^0.85 against the freshly written
react-native 0.86. jest-expo and babel-preset-expo are moved by hand to the SDK
57 pins from bundledNativeModules.json in the same install.

Jest stays on 29 on purpose: jest-expo 57 IS a jest 29 package, depending on
babel-jest, @jest/globals and jest-snapshot at ^29.2.1, so jest 30 would install
a second runtime beside the preset that runs the suite. Reason recorded in
dependabot.yml so the hold stops looking like neglect.

Security: the upgrade moves the top level brace-expansion from the vulnerable
5.0.7 onto the patched 5.0.8 (GHSA-mh99-v99m-4gvg). The 4 residual copies are
jest 29 devDependency internals that predate this change and stay. An override
to ^5.0.8 clears the alert count and silently breaks minimatch 3, whose CJS
build gets an object rather than a callable and throws on any brace pattern
while the test suite stays green, and jest 30 does not clear the advisory
either. The uuid moderates remain the known unreachable build time xcode chain.

Verified: npm ci, tsc, tests, expo-doctor 20/20, and expo export for android,
which is the only check that proves Metro still bundles on the new React Native.

Also takes @roxyapi/sdk 1.2.51 and npm-check-updates 23. README and AGENTS.md
claimed Expo SDK 54, stale by three majors.

Author: ph33nx

.github/dependabot.yml

@@ -15,11 +15,16 @@ updates:
       # THE EXPO SDK OWNS THESE VERSIONS. The SDK template pins react, react-native and every
       # native module to exact versions that are built and tested against each other, and
       # "npx expo install --fix" is the only thing allowed to move them. React Native is on 0.x,
-      # so a 0.85 -> 0.86 bump is a BREAKING release that Dependabot happily classifies as a minor
-      # and auto-merges. That is not theoretical: it landed once, and it broke "npm ci" outright,
-      # because jest-expo still wanted @react-native/jest-preset ^0.85 while react-native demanded
-      # 0.86. Ignore ALL update types here, not just majors. Upgrading these means upgrading the
-      # Expo SDK, deliberately, with expo install --fix and expo-doctor.
+      # so an 0.x -> 0.x+1 bump is a BREAKING release that Dependabot happily classifies as a minor
+      # and auto-merges. That is not theoretical: 0.85 -> 0.86 landed once on its own and broke
+      # "npm ci" outright, because jest-expo still wanted @react-native/jest-preset ^0.85 while
+      # react-native demanded 0.86. Ignore ALL update types here, not just majors. Upgrading these
+      # means upgrading the Expo SDK, deliberately, with expo install --fix and expo-doctor.
+      # Current baseline: SDK 57 / React Native 0.86 / React 19.2.3 (taken 2026-07-27). The pins are
+      # authoritative in expo/bundledNativeModules.json, and expo-doctor is the validator, not
+      # "expo install --fix", which reports "up to date" on an already broken tree. Note --fix only
+      # rewrites dependencies, never devDependencies, so jest-expo and babel-preset-expo must be
+      # moved to the new SDK major BY HAND in the same install or npm ERESOLVEs on the jest preset.
       - dependency-name: "react"
       - dependency-name: "react-dom"
       - dependency-name: "react-native"
@@ -38,6 +43,10 @@ updates:
         update-types: ["version-update:semver-major"]
       - dependency-name: "babel-preset-expo"
         update-types: ["version-update:semver-major"]
+      # Jest stays on 29 because jest-expo 57 IS a jest 29 package: it depends on babel-jest,
+      # @jest/globals, jest-snapshot and jest-environment-jsdom at ^29.2.1. Taking jest 30 installs
+      # a second jest runtime beside the preset that actually runs the suite. @types/jest tracks
+      # whatever jest resolves to, so it is pinned to the same major. Jest moves with the SDK.
       - dependency-name: "jest"
         update-types: ["version-update:semver-major"]
       - dependency-name: "@types/jest"

AGENTS.md

@@ -1,6 +1,6 @@
 # Agents Guide
 
-This is a RoxyAPI starter app. A Pythagorean numerology calculator built with React Native, Expo SDK 54, and TypeScript. Demonstrates Life Path, Expression, Soul Urge, Personal Year, full numerology charts, and compatibility, with Master Number and Karmic Debt detection, all powered by the RoxyAPI Numerology API through the official `@roxyapi/sdk`.
+This is a RoxyAPI starter app. A Pythagorean numerology calculator built with React Native, Expo SDK 57, and TypeScript. Demonstrates Life Path, Expression, Soul Urge, Personal Year, full numerology charts, and compatibility, with Master Number and Karmic Debt detection, all powered by the RoxyAPI Numerology API through the official `@roxyapi/sdk`.
 
 ## Setup
 - Get an API key at https://roxyapi.com/pricing

README.md

@@ -35,7 +35,7 @@ Fork it, set one environment variable, and ship.
 
 | Technology | Purpose |
 |-----------|---------|
-| [Expo SDK 54](https://expo.dev) | React Native runtime and build tooling |
+| [Expo SDK 57](https://expo.dev) | React Native runtime and build tooling |
 | [Expo Router](https://docs.expo.dev/router/introduction/) | File-based navigation with bottom tabs |
 | [@roxyapi/sdk](https://www.npmjs.com/package/@roxyapi/sdk) | Fully typed RoxyAPI client. One key, every domain. |
 | [NativeWind v4](https://www.nativewind.dev) | Tailwind CSS for React Native |