[Snyk] Security upgrade expo from 33.0.7 to 50.0.0 #39

Open

morten-olsen wants to merge 1 commit from snyk-fix-9d977c645dda26d224f9c8003e45451f into master

morten-olsen commented

2024-01-18 15:54:44 +01:00

(Migrated from github.com)

This PR was automatically created by Snyk using the credentials of a real user.

Snyk has created this PR to fix one or more vulnerable packages in the `npm` dependencies of this project.

Changes included in this PR

Changes to the following files to upgrade the vulnerable dependencies to a fixed version:
- packages/demo/package.json

Vulnerabilities that will be fixed

With an upgrade:

Severity	Priority Score (*)	Issue	Breaking Change	Exploit Maturity
	631/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 6.2	Missing Release of Resource after Effective Lifetime SNYK-JS-INFLIGHT-6095116	Yes	Proof of Concept

(*) Note that the real score may have changed since the PR was raised.

Commit messages

Package name: expo

The new version differs by 250 commits.

1028996 Publish packages
be9dc2f chore(cli): hide the deprecated `export:web` command from the general help output. (#26480)
9b57e3b chore: move expo/server to be a dependency of expo-router (#25937)
94c137c [cli] remove versions from manual install command (#26457)
e3b49f4 [cli]: default web.bundler to metro for new projects (#26452)
43858c5 fix(cli): let last arguments take precedence when repeated on `export:embed` command (#26471)
91948dd feat: use public directory when metro web is enabled (#26473)
a5dcdcd feat(cli, config-plugins): [2/3] patch based config-plugin (#26414)
f1dfaa1 feat(cli, config-plugins): [1/3] patch based config-plugin (#26413)
6ea59d0 [cli] enhance cors support for dev-server (#26463)
8085d00 [metro-runtime] fix lazy component error on android (#26464)
f1850d3 update yarn.lock
3bbaf14 fix: pin `sucrase@3.34.0` to avoid yarn v1 incompatibilities with `@ isaacs/cliui` module aliases (#26459)
892827d [home][android] Update dev/prod home, bump Android Expo Go version
71e41ed [go][Android] Recreate root view each time the menu is opened (#26431)
d186593 [home] Adjust bottom sheet animation (#26432)
b9dfb00 [launcher][Android] Fix HMR not working (#26441)
1063249 [autolinking] Introduce universal "apple" platform (#26398)
e6631d7 [store-review] Remove expo-linking dependency and use React Native Linking instead (#26428)
e8abb0d Update templates to latest [skip ci]
4a0457e Publish packages
4b15eb1 [expo] Bump suggested @ sentry/react-native version [skip ci]
7c0e751 (router): warn if incorrect web.output when using api routes (#25931)
8c29963 feat(cli): add adb user option (#26388)

See the full diff

Check the changes in this PR to ensure they won't cause issues with your project.

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report

🛠 Adjust project settings

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Learn about vulnerability in an interactive lesson of Snyk Learn.

This PR was automatically created by Snyk using the credentials of a real user. <h3>Snyk has created this PR to fix one or more vulnerable packages in the `npm` dependencies of this project.</h3> #### Changes included in this PR - Changes to the following files to upgrade the vulnerable dependencies to a fixed version: - packages/demo/package.json #### Vulnerabilities that will be fixed ##### With an upgrade: Severity | Priority Score (*) | Issue | Breaking Change | Exploit Maturity :-------------------------:|-------------------------|:-------------------------|:-------------------------|:------------------------- ![medium severity](https://res.cloudinary.com/snyk/image/upload/w_20,h_20/v1561977819/icon/m.png "medium severity") | **631/1000** **Why?** Proof of Concept exploit, Has a fix available, CVSS 6.2 | Missing Release of Resource after Effective Lifetime [SNYK-JS-INFLIGHT-6095116](https://snyk.io/vuln/SNYK-JS-INFLIGHT-6095116) | Yes | Proof of Concept (*) Note that the real score may have changed since the PR was raised. <details> <summary>Commit messages</summary> <details> <summary>Package name: expo</summary> The new version differs by 250 commits. <ul> <li><a href="https://snyk.io/redirect/github/expo/expo/commit/102899632731658eecba006c0d1c79b98ba8f5f7">1028996</a> Publish packages</li> <li><a href="https://snyk.io/redirect/github/expo/expo/commit/be9dc2f1f5bf51a39cda76085d501ccab7fe55ff">be9dc2f</a> chore(cli): hide the deprecated `export:web` command from the general help output. (#26480)</li> <li><a href="https://snyk.io/redirect/github/expo/expo/commit/9b57e3ba4609b2d10fa09c62bc7b7126960a51f2">9b57e3b</a> chore: move expo/server to be a dependency of expo-router (#25937)</li> <li><a href="https://snyk.io/redirect/github/expo/expo/commit/94c137cd75eec186f4207b9c01e66a80f7017118">94c137c</a> [cli] remove versions from manual install command (#26457)</li> <li><a href="https://snyk.io/redirect/github/expo/expo/commit/e3b49f4d8ddd054f461d7dda853f3ed5185941b2">e3b49f4</a> [cli]: default web.bundler to metro for new projects (#26452)</li> <li><a href="https://snyk.io/redirect/github/expo/expo/commit/43858c5059715680a789df30d9da8ed20ee99a1a">43858c5</a> fix(cli): let last arguments take precedence when repeated on `export:embed` command (#26471)</li> <li><a href="https://snyk.io/redirect/github/expo/expo/commit/91948dd95b33678cb0dcf6ba9d3591a24364b734">91948dd</a> feat: use public directory when metro web is enabled (#26473)</li> <li><a href="https://snyk.io/redirect/github/expo/expo/commit/a5dcdcd196f279d5926b239d6cb954fcb0ca30f6">a5dcdcd</a> feat(cli, config-plugins): [2/3] patch based config-plugin (#26414)</li> <li><a href="https://snyk.io/redirect/github/expo/expo/commit/f1dfaa1f14dc82a6e27e60bf7fd781a22e04dc3f">f1dfaa1</a> feat(cli, config-plugins): [1/3] patch based config-plugin (#26413)</li> <li><a href="https://snyk.io/redirect/github/expo/expo/commit/6ea59d05ec4fcf5b36e663a0295dbb518c760728">6ea59d0</a> [cli] enhance cors support for dev-server (#26463)</li> <li><a href="https://snyk.io/redirect/github/expo/expo/commit/8085d00d23dcfbeb50b79cc16fa44c9501077cb0">8085d00</a> [metro-runtime] fix lazy component error on android (#26464)</li> <li><a href="https://snyk.io/redirect/github/expo/expo/commit/f1850d3b7d688a59879bc7da2c92095f8feab5c3">f1850d3</a> update yarn.lock</li> <li><a href="https://snyk.io/redirect/github/expo/expo/commit/3bbaf1473644b19cce1074a5eb73a224ad7d9264">3bbaf14</a> fix: pin `sucrase@3.34.0` to avoid yarn v1 incompatibilities with `@ isaacs/cliui` module aliases (#26459)</li> <li><a href="https://snyk.io/redirect/github/expo/expo/commit/892827da8c0a2689cc570e62e0af24b2cb679ae3">892827d</a> [home][android] Update dev/prod home, bump Android Expo Go version</li> <li><a href="https://snyk.io/redirect/github/expo/expo/commit/71e41edd04663cb480a77f21d76e559b9f01aece">71e41ed</a> [go][Android] Recreate root view each time the menu is opened (#26431)</li> <li><a href="https://snyk.io/redirect/github/expo/expo/commit/d1865937bccd5d6563b6f5e96e30f649fcaca70e">d186593</a> [home] Adjust bottom sheet animation (#26432)</li> <li><a href="https://snyk.io/redirect/github/expo/expo/commit/b9dfb00cabdc51a4112fa782f163ff3380b471a5">b9dfb00</a> [launcher][Android] Fix HMR not working (#26441)</li> <li><a href="https://snyk.io/redirect/github/expo/expo/commit/10632496aa4c40b1ee3017758dbad414c09b8647">1063249</a> [autolinking] Introduce universal "apple" platform (#26398)</li> <li><a href="https://snyk.io/redirect/github/expo/expo/commit/e6631d754ee382a886106765cd046bd9d4860f80">e6631d7</a> [store-review] Remove expo-linking dependency and use React Native Linking instead (#26428)</li> <li><a href="https://snyk.io/redirect/github/expo/expo/commit/e8abb0d9859ef0f91801dec64a2d6a940de5eea9">e8abb0d</a> Update templates to latest [skip ci]</li> <li><a href="https://snyk.io/redirect/github/expo/expo/commit/4a0457eb4024f4461be4f351b91ea06c37120806">4a0457e</a> Publish packages</li> <li><a href="https://snyk.io/redirect/github/expo/expo/commit/4b15eb176088069f13a11c4fc3267fc09608c592">4b15eb1</a> [expo] Bump suggested @ sentry/react-native version [skip ci]</li> <li><a href="https://snyk.io/redirect/github/expo/expo/commit/7c0e7519258b0d540b6c621ead2df33678b0615b">7c0e751</a> (router): warn if incorrect web.output when using api routes (#25931)</li> <li><a href="https://snyk.io/redirect/github/expo/expo/commit/8c29963b8afcf33bf95e17b6c419b3f0d2935fe6">8c29963</a> feat(cli): add adb user option (#26388)</li> </ul> <a href="https://snyk.io/redirect/github/expo/expo/compare/f213c9be2a909dae42a0a27d8aa4b9eac8e97be1...102899632731658eecba006c0d1c79b98ba8f5f7">See the full diff</a> </details> </details> Check the changes in this PR to ensure they won't cause issues with your project. ------------ **Note:** *You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.* For more information: <img src="https://api.segment.io/v1/pixel/track?data=eyJ3cml0ZUtleSI6InJyWmxZcEdHY2RyTHZsb0lYd0dUcVg4WkFRTnNCOUEwIiwiYW5vbnltb3VzSWQiOiJlMDllMGRiMy1jNDY1LTRiZGMtODZkZS1iYjkwN2QzOWIzYTciLCJldmVudCI6IlBSIHZpZXdlZCIsInByb3BlcnRpZXMiOnsicHJJZCI6ImUwOWUwZGIzLWM0NjUtNGJkYy04NmRlLWJiOTA3ZDM5YjNhNyJ9fQ==" width="0" height="0"/> 🧐 [View latest project report](https://app.snyk.io/org/morten-olsen/project/a90e32d7-b1f4-49fb-9bb1-80512396d067?utm_source=github&utm_medium=referral&page=fix-pr) 🛠 [Adjust project settings](https://app.snyk.io/org/morten-olsen/project/a90e32d7-b1f4-49fb-9bb1-80512396d067?utm_source=github&utm_medium=referral&page=fix-pr/settings) 📚 [Read more about Snyk's upgrade and patch logic](https://support.snyk.io/hc/en-us/articles/360003891078-Snyk-patches-to-fix-vulnerabilities) [//]: # (snyk:metadata:{"prId":"e09e0db3-c465-4bdc-86de-bb907d39b3a7","prPublicId":"e09e0db3-c465-4bdc-86de-bb907d39b3a7","dependencies":[{"name":"expo","from":"33.0.7","to":"50.0.0"}],"packageManager":"npm","projectPublicId":"a90e32d7-b1f4-49fb-9bb1-80512396d067","projectUrl":"https://app.snyk.io/org/morten-olsen/project/a90e32d7-b1f4-49fb-9bb1-80512396d067?utm_source=github&utm_medium=referral&page=fix-pr","type":"auto","patch":[],"vulns":["SNYK-JS-INFLIGHT-6095116"],"upgrade":["SNYK-JS-INFLIGHT-6095116"],"isBreakingChange":true,"env":"prod","prType":"fix","templateVariants":["updated-fix-title","priorityScore"],"priorityScoreList":[631],"remediationStrategy":"vuln"}) --- **Learn how to fix vulnerabilities with free interactive lessons:** 🦉 [Learn about vulnerability in an interactive lesson of Snyk Learn.](https://learn.snyk.io/?loc=fix-pr)

This pull request can be merged automatically.

You are not authorized to merge this pull request.

View command line instructions

Checkout

From your project repository, check out a new branch and test the changes.

git fetch -u origin snyk-fix-9d977c645dda26d224f9c8003e45451f:snyk-fix-9d977c645dda26d224f9c8003e45451f

git switch snyk-fix-9d977c645dda26d224f9c8003e45451f

Merge

Merge the changes and update on Forgejo.

Warning: The "Autodetect manual merge" setting is not enabled for this repository, you will have to mark this pull request as manually merged afterwards.

git switch master

git merge --no-ff snyk-fix-9d977c645dda26d224f9c8003e45451f

git switch snyk-fix-9d977c645dda26d224f9c8003e45451f

git rebase master

git switch master

git merge --ff-only snyk-fix-9d977c645dda26d224f9c8003e45451f

git switch snyk-fix-9d977c645dda26d224f9c8003e45451f

git rebase master

git switch master

git merge --no-ff snyk-fix-9d977c645dda26d224f9c8003e45451f

git switch master

git merge --squash snyk-fix-9d977c645dda26d224f9c8003e45451f