Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Update libraries for dependabot alerts. #587

Merged
merged 1 commit into from
Jun 4, 2024

Conversation

coryzoon
Copy link
Contributor

@coryzoon coryzoon commented Jun 3, 2024

Updates the libraries that are being recommended to update by the dependabot alerts. Also addresses security advisories.

Note this does not include all dependabot alerts or security advisories:

  • Ramda library update introduces breaking changes that will require changes to the code base to support.
  • React Native update will not be as easy as updating the library version, will require additional work.
  • Any security advisory related to simple-markdown: This library is called by react-native-simple-markdown. It has not been updated in 3 years. To address security advisories would require us to fork the repo and fix them ourselves. The advisories seem more related to web clients and not mobile. Another option is to replace this library if possible.
  • Any security advisory related to node-fetch: This library is called by react-native-deck-swiper. There is an open PR to fix vulnerabilities but has not been merged and is not actively being worked on. 5 high severity vulnerabilities webraptor/react-native-deck-swiper#122 Update prop-types version to address vulnerability webraptor/react-native-deck-swiper#129

Everything else should be addressed by this PR. Keep in mind that the dependabot alerts are updated often and it is likely that new ones will be created by the time this PR is approved.

@coryzoon coryzoon merged commit 92765fb into release/v2.12.0 Jun 4, 2024
1 check passed
@coryzoon coryzoon deleted the dependabot_alerts branch September 3, 2024 10:36
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

1 participant