Potential DoS: react-native-vector-icons@6.1.0 › yargs@8.0.2 › os-locale@2.1.0 › mem@1.1.0

[devproivansurzhenko]

Hi all,

Just found that: https://snyk.io/test/npm/native-base/2.13.5?tab=issues

(okay, not me; my security reviewer has pushed me :) )

Are there plans to upgrade react-native-vector-icons version at package.json?

[Remigius2011]

current version of react-native-vector-icons is 6.6.0. would it be possible to upgrade the dependency to the most current version or use a more generic version, like ^6.6.0? I was using react-native-vector-icons@6.6.0 before installing native-base, which caused a downgrade of react-native-vector-icons.

[devproivansurzhenko]

@Remigius2011 jfyi, i used npm-force-resolutions as a workaround for now.

https://github.com/rogeriochaves/npm-force-resolutions

[Remigius2011]

sorry, but I'm using yarn. also, just forcing resolution might not work out, because there might be a reason that native-base is not yet upgraded to 6.6.0 or fixing the version in general.

[Remigius2011]

In yarn, dependency resolution can be controlled using a resolutions field in package.json, in this case as follows:

"resolutions": {
  "react-native-vector-icons": "^6.6.0"
}

I don't know whether this works in all cases (only ran it in the Android emulator so far, and with very few native-base content, actually), but at least it has brought a missing icon back. Still, it would be more than nice to have official support for 6.6.0.

[devproivansurzhenko]

@Remigius2011 sure, it is just a 'last attempt' to get things done while official support is not released.

In my case, I forced another version of mem since security team did not approve this dependency (caused by react-native-vector-icons@6.1.0 )

[hanykumar]

Hi @devproivansurzhenko , please update Native-Base v2.13.14 and let us know if the issue still persists. Closing for now.