New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[Snyk] Security upgrade react-native from 0.61.5 to 0.68.0 #55

Open

Verdinjoshua26 wants to merge 1 commit into master from snyk-fix-c264c8c3be42ced20c38e86d7dc062d2

Owner

Verdinjoshua26 commented Sep 29, 2022

This PR was automatically created by Snyk using the credentials of a real user.

Snyk has created this PR to fix one or more vulnerable packages in the `npm` dependencies of this project.

Changes included in this PR

Changes to the following files to upgrade the vulnerable dependencies to a fixed version:
- packages/react-native-editor/package.json

Vulnerabilities that will be fixed

With an upgrade:

Severity	Priority Score (*)	Issue	Breaking Change	Exploit Maturity
	696/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 7.5	Regular Expression Denial of Service (ReDoS) SNYK-JS-ANSIREGEX-1583908	No	Proof of Concept
	519/1000 Why? Has a fix available, CVSS 6.1	Cross-site Scripting (XSS) SNYK-JS-HERMESENGINE-1015406	No	No Known Exploit
	569/1000 Why? Has a fix available, CVSS 7.1	Use After Free SNYK-JS-HERMESENGINE-1309667	No	No Known Exploit
	589/1000 Why? Has a fix available, CVSS 7.5	Out-of-Bounds SNYK-JS-HERMESENGINE-1727253	No	No Known Exploit
	519/1000 Why? Has a fix available, CVSS 6.1	Denial of Service (DoS) SNYK-JS-HERMESENGINE-2342071	No	No Known Exploit
	539/1000 Why? Has a fix available, CVSS 6.5	Prototype Pollution SNYK-JS-HERMESENGINE-608850	No	No Known Exploit
	544/1000 Why? Has a fix available, CVSS 6.6	Denial of Service (DoS) SNYK-JS-HERMESENGINE-629268	No	No Known Exploit
	544/1000 Why? Has a fix available, CVSS 6.6	Out-of-Bounds SNYK-JS-HERMESENGINE-629748	No	No Known Exploit
	711/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 7.8	Remote Code Execution (RCE) SNYK-JS-LOGKITTY-568763	No	Proof of Concept
	539/1000 Why? Has a fix available, CVSS 6.5	Information Exposure SNYK-JS-NODEFETCH-2342118	No	No Known Exploit
	520/1000 Why? Has a fix available, CVSS 5.9	Denial of Service SNYK-JS-NODEFETCH-674311	No	No Known Exploit
	589/1000 Why? Has a fix available, CVSS 7.5	Regular Expression Denial of Service (ReDoS) SNYK-JS-REACTNATIVE-1298632	No	No Known Exploit
	619/1000 Why? Has a fix available, CVSS 8.1	Remote Code Execution (RCE) SNYK-JS-SHELLQUOTE-1766506	No	No Known Exploit
	586/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 5.3	Regular Expression Denial of Service (ReDoS) SNYK-JS-WS-1296835	No	Proof of Concept
	601/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 5.6	Prototype Pollution SNYK-JS-YARGSPARSER-560381	No	Proof of Concept

(*) Note that the real score may have changed since the PR was raised.

Commit messages

Package name: react-native

The new version differs by 250 commits.

51f5ea1 [0.68.0] Bump version numbers
a4a6e23 [0.68.0-rc.4] Bump version numbers
e645629 Enable SonarKit and Flipper in React-Core (Add support for SVN sources in @wordpress/env WordPress/gutenberg#33499)
b3f19d7 [0.68.0-rc.3] Bump version numbers
cb28a26 Bump Flipper-Glog to 0.5.0.4
4163386 fix(ios, flipper): update flipper sub-pods to support macCatalyst (RNMobile: Slider and stepper text inputs not rendering correct color in dark mode WordPress/gutenberg#33406)
ccd1708 Re-apply: Consider relative to pwd installation root when looking for files in rn module via cocoapods (Missing Template selection in editor on Custom Post Type edit page, after update to 5.8-RC3 WordPress/gutenberg#33427)
4e34e6c fix: `cliPath` should handle absolute paths (Fix to remove default indent from Latest Posts and Latest Comments block in various editors WordPress/gutenberg#32983)
3e69592 Fix ios build error when use_frameworks is on and fabric is off (v2) (Template Editor: Preview Does Not Recognize Changes to Template Without Updating WordPress/gutenberg#33409)
5fd04fa Start surface after setting the delegate (RNMobile: Fix slider and stepper text inputs in dark mode WordPress/gutenberg#33402)
a761b79 Use relative installation root instead of absolute to avoid embedding absolute paths in pods project (File block prevents .zip and other files from being uploaded to a blog WordPress/gutenberg#33187)
d7d33c7 Revert D31628461
7b33f20 Ship enableNestedTextOnPressEventFix
4b370ce Include folly fabric headers in source files (Empty block creates error message in List View WordPress/gutenberg#33188)
63e4bd6 Fix Switch causing RetryableMountingLayerException (Social Links: Foreground color not being when used from Widgets Editor WordPress/gutenberg#32602)
762db49 Make sure configureNdkBuild* tasks are depending on preBuild
65e4d98 [0.68.0-rc.2] Bump version numbers
66b82ae chore(deps): bump CLI version to 7.0.3 to address web debugging issue ([WIP] Unit Control: Allow custom values with more specificity than step value WordPress/gutenberg#33156)
2cd3173 Remove optional codegen config inside template (When the widget area has a long name, the "Block" tab in the sidebar is broken in Japanese environment. WordPress/gutenberg#33108)
61f0d1a Release react-native-gradle-plugin 0.0.5
57cc524 Gradle: Deprecate `reactRoot` in favor of `root` and `reactNativeDir` (Remove block alignment wrapper in editor WordPress/gutenberg#33142)
bca4cf0 Set a resolution strategy for com.facebook.react:react-native when on New Architecture. (Release 11.0.0 WordPress/gutenberg#33134)
f5d371a Set Java source/target compatibility for react-native-gradle-plugin to 8
b1c30f8 fix: jvm 11 error message from ReactPlugin.kt and react.gradle (Navigation: use generic css class names for navigation items WordPress/gutenberg#33048)

See the full diff

Check the changes in this PR to ensure they won't cause issues with your project.

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report

🛠 Adjust project settings

📚 Read more about Snyk's upgrade and patch logic

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Regular Expression Denial of Service (ReDoS)
🦉 Cross-site Scripting (XSS)
🦉 Denial of Service (DoS)
🦉 More lessons are available in Snyk Learn


          fix: packages/react-native-editor/package.json to reduce vulnerabilities

0da6dca

The following vulnerabilities are fixed with an upgrade:
- https://snyk.io/vuln/SNYK-JS-ANSIREGEX-1583908
- https://snyk.io/vuln/SNYK-JS-HERMESENGINE-1015406
- https://snyk.io/vuln/SNYK-JS-HERMESENGINE-1309667
- https://snyk.io/vuln/SNYK-JS-HERMESENGINE-1727253
- https://snyk.io/vuln/SNYK-JS-HERMESENGINE-2342071
- https://snyk.io/vuln/SNYK-JS-HERMESENGINE-608850
- https://snyk.io/vuln/SNYK-JS-HERMESENGINE-629268
- https://snyk.io/vuln/SNYK-JS-HERMESENGINE-629748
- https://snyk.io/vuln/SNYK-JS-LOGKITTY-568763
- https://snyk.io/vuln/SNYK-JS-NODEFETCH-2342118
- https://snyk.io/vuln/SNYK-JS-NODEFETCH-674311
- https://snyk.io/vuln/SNYK-JS-REACTNATIVE-1298632
- https://snyk.io/vuln/SNYK-JS-SHELLQUOTE-1766506
- https://snyk.io/vuln/SNYK-JS-WS-1296835
- https://snyk.io/vuln/SNYK-JS-YARGSPARSER-560381

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet