fix(spm): harden shell usage + hashing flagged by CodeQL

- download-spm-artifacts.js: the tar/cp invocations interpolated
  URL/env-derived paths into shell strings (js/shell-command-injection,
  incl. one new critical on the companion backfill path). All four now
  use execFileSync argv form — no shell involved.
- spm-pbxproj.js: generateUUID used md5 (js/weak-cryptographic-algorithm).
  Not a security use — the hash only derives deterministic pbxproj
  UUIDs — but sha256 (truncated to the same 24 hex chars) is just as
  deterministic and keeps the scanner green. Affects only not-yet-
  released injections; the marker records actual UUIDs so deinit of
  md5-era injections is unaffected.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Author: chrfalch

packages/react-native/scripts/spm/download-spm-artifacts.js

@@ -58,7 +58,7 @@ const {
   makeLogger,
   sharedCacheDir,
 } = require('./spm-utils');
-const {execSync} = require('child_process');
+const {execFileSync} = require('child_process');
 const fs = require('fs');
 const path = require('path');
 const stream = require('stream');
@@ -595,7 +595,7 @@ function extractXCFramework(
 ) /*: string */ {
   fs.mkdirSync(extractDir, {recursive: true});
   log(`  Extracting ${path.basename(tarPath)}...`);
-  execSync(`tar -xzf "${tarPath}" -C "${extractDir}"`, {stdio: 'pipe'});
+  execFileSync('tar', ['-xzf', tarPath, '-C', extractDir], {stdio: 'pipe'});
 
   const found = findFirst(extractDir, name => name.endsWith('.xcframework'), 8);
   if (found == null) {
@@ -660,7 +660,7 @@ function stageHermesHeaders(
   const dest = path.join(destRoot, 'hermes');
   fs.rmSync(dest, {recursive: true, force: true});
   fs.mkdirSync(destRoot, {recursive: true});
-  execSync(`/bin/cp -R "${src}" "${dest}"`, {stdio: 'pipe'});
+  execFileSync('/bin/cp', ['-R', src, dest], {stdio: 'pipe'});
   log('  Staged Hermes public headers → hermes-headers/hermes');
 }
 
@@ -738,7 +738,7 @@ async function ensureCompanionStaged(
   fs.rmSync(tmp, {recursive: true, force: true});
   fs.mkdirSync(tmp, {recursive: true});
   try {
-    execSync(`tar -xzf "${tarPath}" -C "${tmp}"`, {stdio: 'pipe'});
+    execFileSync('tar', ['-xzf', tarPath, '-C', tmp], {stdio: 'pipe'});
     stageCompanionXcframework(tmp, outputDir, name);
   } finally {
     fs.rmSync(tmp, {recursive: true, force: true});
@@ -784,7 +784,7 @@ async function ensureHermesHeadersStaged(
   fs.rmSync(tmp, {recursive: true, force: true});
   fs.mkdirSync(tmp, {recursive: true});
   try {
-    execSync(`tar -xzf "${tarPath}" -C "${tmp}"`, {stdio: 'pipe'});
+    execFileSync('tar', ['-xzf', tarPath, '-C', tmp], {stdio: 'pipe'});
     stageHermesHeaders(tmp, outputDir);
   } finally {
     fs.rmSync(tmp, {recursive: true, force: true});

packages/react-native/scripts/spm/spm-pbxproj.js

@@ -14,11 +14,13 @@ const crypto = require('crypto');
 
 /**
  * Generate a deterministic 24-hex-character UUID from a seed string.
- * Uses MD5 hash truncated to 24 chars (standard Xcode pbxproj UUID length).
+ * SHA-256 truncated to 24 chars (standard Xcode pbxproj UUID length). Not a
+ * security use — the hash only provides stable, collision-unlikely IDs — but
+ * sha256 keeps static analysis (CodeQL weak-crypto) quiet.
  */
 function generateUUID(seed /*: string */) /*: string */ {
   return crypto
-    .createHash('md5')
+    .createHash('sha256')
     .update(seed)
     .digest('hex')
     .substring(0, 24)