[Snyk] Fix for 9 vulnerabilities #479

leojoy95 · 2022-06-27T04:17:31Z

This PR was automatically created by Snyk using the credentials of a real user.

Snyk has created this PR to fix one or more vulnerable packages in the `npm` dependencies of this project.

Changes included in this PR

Changes to the following files to upgrade the vulnerable dependencies to a fixed version:
- packages/mobile/package.json

Vulnerabilities that will be fixed

With an upgrade:

Priority Score (*)	Issue	Breaking Change	Exploit Maturity
696/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 7.5	Regular Expression Denial of Service (ReDoS) SNYK-JS-ANSIREGEX-1583908	Yes	Proof of Concept
696/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 7.5	Prototype Pollution SNYK-JS-JSONBIGINT-608659	No	Proof of Concept
586/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 5.3	Open Redirect SNYK-JS-NODEFORGE-2330875	No	Proof of Concept
529/1000 Why? Has a fix available, CVSS 6.3	Prototype Pollution SNYK-JS-NODEFORGE-2331908	No	No Known Exploit
494/1000 Why? Has a fix available, CVSS 5.6	Improper Verification of Cryptographic Signature SNYK-JS-NODEFORGE-2430337	No	No Known Exploit
579/1000 Why? Has a fix available, CVSS 7.3	Improper Verification of Cryptographic Signature SNYK-JS-NODEFORGE-2430339	No	No Known Exploit
494/1000 Why? Has a fix available, CVSS 5.6	Improper Verification of Cryptographic Signature SNYK-JS-NODEFORGE-2430341	No	No Known Exploit
586/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 5.3	Regular Expression Denial of Service (ReDoS) SNYK-JS-WS-1296835	No	Proof of Concept
506/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 3.7	Regular Expression Denial of Service (ReDoS) npm:braces:20180219	No	Proof of Concept

(*) Note that the real score may have changed since the PR was raised.

Commit messages

Package name: jest

The new version differs by 22 commits.

ff9269b chore: bump most dated deps (Add contractkit function to return CIP8 storage roots array celo-org/celo-monorepo#8850)
7594141 chore: upgrade to eslint@6 (Reduce Attestation On-call Burden celo-org/celo-monorepo#8855)
b33ce0d chore: upgrade to micromatch v4 (Celo: <Issue Title>Wrong Transiotion and wrong addressed celo-org/celo-monorepo#8852)
d6ff72a chore: add node 12 to CI (Deliver frozen audit 51 scope to OpenZeppelin celo-org/celo-monorepo#8411)
7e9b4ea chore: upgrade jsdom ([on-call] look into discrepancy between validator AS dashboards celo-org/celo-monorepo#8851)
4bb7a2d Use `weak-napi` instead of `weak` in `jest-leak-detector`
ce47c6c Get rid of Node 6 support (Investigate Economic Test and Documentation Coverage celo-org/celo-monorepo#8455)
bc5c3c7 jest-snapshot: Remove only the added newlines in multiline snapshots (Add signature verification code for CIP-40 requests celo-org/celo-monorepo#8859)
d523fa8 bug.md: highlights placeholder should be removed (Fix bug in signature parsing for EIP712TypedData celo-org/celo-monorepo#8836)
08f109c expect: Display expectedDiff more carefully in toBeCloseTo (Merge release 5 to master celo-org/celo-monorepo#8389)
b09de2d chore: bump node-notifier for node v6 support
557a39f fix(linter): Fix linting failure introduced in Provide security guidance for ODIS key celo-org/celo-monorepo#8847 😓 (Exclude phoenix metrics in grafana cloud celo-org/celo-monorepo#8849)
012472b fix(docs): Update broken links in docs. (Provide security guidance for ODIS key celo-org/celo-monorepo#8847)
ee2bea1 chore: sort member in imports (Set vulnerable dependency to fixed version celo-org/celo-monorepo#8846)
9ba4594 add Chinese Jest work with AngularJS tutorial (LockedGold.slash() should only payout to reporters who are registered on Accounts celo-org/celo-monorepo#8828)
0e5b363 chore: reduce reliance on esModuleInterop ([Valora] Investigate Methods for identifying for Merchant Payments and Mirror Refunds in Valora Feed celo-org/celo-monorepo#8842)
d69f8d3 getTimerCount will not include cancelled immediates (Code cleanup celo-org/celo-monorepo#8764)
b4bd77b Fix grammar: "your jest's config"->"your Jest..." ([Valora] Show copy to indicate merchant payments and refunds in Transaction Feed celo-org/celo-monorepo#8843)
54b3dcf Fix grammar: "a known issues"->"a known issue" (Figure out how Wallets Recognize a Mirror Transaction as a Merchant Refund celo-org/celo-monorepo#8844)
e76c7da docs: update matchMedia methods (Add Result type guards celo-org/celo-monorepo#8835)
23b9860 chore: roll new version of docs
3cdbd55 Release 24.9.0

See the full diff

Package name: react-native

The new version differs by 250 commits.

7473ce1 [0.65.0] Bump version numbers
5f0b805 [0.65.0-rc.4] Bump version numbers
83d9b9b [LOCAL] yarn lock update
e775957 Revert "fix: Move react-native-codegen to be a direct dependency of react-native (fix for 0.65-stable)"
5f7deb5 [LOCAL] reintroduce generated codegen files
c0df3e0 [LOCAL] autogenerated files
54fbe0d - Bump CLI to ^6.0.0 (#31971)
5efad92 Codegen: Always prepare filesystem
dfd324e Extend codegen script to take library name, output dir arguments
1b7f95b Reorganize codegen script for clarity
041365e fix: codegen - project paths with spaces (#31141)
98e1734 fix: Move react-native-codegen to be a direct dependency of react-native (fix for 0.65-stable)
e8d725a [0.65.0-rc.3] Bump version numbers
e40f582 fix(deps): bump metro to 0.66.2 + dedup (#31886)
e53745e Bump Flipper + Bump hermes (#31872)
4476fbc Allow PlatformColor to work with RCTView border colors (#29728)
49253dc Fix support for blobs larger than 64 KB on Android (#31789)
626d25c Android: upgrading to OkHttp from 4.9.0 to 4.9.1 to fix java.lang.NullPointerException: bio == null crash (#31822)
db7aa7b [0.65.0-rc.2] Bump version numbers
121a6a4 Fix Android build sequencing
ba4424f Revert "Revert "bump buildToolsVersion to 30.0.2 (#31627)""
be9a669 Revert "Revert "Gradle 6.9, Android Gradle Plugin 4.2.1 (#31593)""
0e08b25 [0.65.0-rc.1] Bump version numbers
ca5b943 [LOCAL] lock files update for 065 branch