[Snyk] Security upgrade react-native from 0.69.4 to 0.70.0 #20

naiba4 · 2023-11-27T22:22:26Z

This PR was automatically created by Snyk using the credentials of a real user.

Snyk has created this PR to fix one or more vulnerable packages in the `npm` dependencies of this project.

Changes included in this PR

Changes to the following files to upgrade the vulnerable dependencies to a fixed version:
- packages/react-native-editor/package.json

Vulnerabilities that will be fixed

With an upgrade:

Severity	Priority Score (*)	Issue	Breaking Change	Exploit Maturity
	115/1000 Why? Confidentiality impact: None, Integrity impact: None, Availability impact: High, Scope: Unchanged, Exploit Maturity: No data, User Interaction (UI): None, Privileges Required (PR): None, Attack Complexity: Low, Attack Vector: Network, EPSS: 0.01055, Social Trends: No, Days since published: 652, Reachable: No, Transitive dependency: Yes, Is Malicious: No, Business Criticality: High, Provider Urgency: High, Package Popularity Score: 99, Impact: 5.99, Likelihood: 1.92, Score Version: V5	Prototype Pollution SNYK-JS-UNSETVALUE-2400660	No	No Known Exploit

(*) Note that the real score may have changed since the PR was raised.

Commit messages

Package name: react-native

The new version differs by 250 commits.

7fc33cc [0.70.0] Bump version numbers
e044a71 [0.70.0-rc.4] Bump version numbers
a168c55 [LOCAL] follow up to codegen update
a22ceec Bump react-native-codegen to 0.70.4
05dcebc [LOCAL] follow up to metro bump
97782c2 Upgrade RN CLI to v9.0.0 and Metro to 0.72.1 ([RNMobile][Embed block] Enable embed inline previews WordPress/gutenberg#34447)
7a01444 Fix codegen trying to parse `.d.ts` files (Add default editor styles applied to themes without theme.json and without editor styles WordPress/gutenberg#34439)
b640f06 Update template to gitignore `android/app/.cxx` (Copy Handler: only handle paste event once WordPress/gutenberg#34430)
5367459 Make sure the template project name is `helloworld_appmodules` (API Fetch: Improve isMediaUploadRequest check WordPress/gutenberg#34417)
0b4b777 Hermes version bump for 0.70.0-RC4
1aabd09 [0.70.0-rc.3] Bump version numbers
1518f83 Upgrade react-native-gradle-plugin to 0.70.2 (Global Styles: Add the ability to set a background color for a specific post/page template WordPress/gutenberg#34390)
6d3b8a2 chore(deps): bump CLI to latest v9 alpha (CustomSelectControl: Add describedBy fallback WordPress/gutenberg#34385)
c666fda Silence deprecation warning for react-native dependency. (Full-width in reusable blocks WordPress/gutenberg#34368)
04990df Update the new app template to use CMake instead of Android.mk (FSE: Add basic support for child themes WordPress/gutenberg#34354)
33ddb00 fix: react android kotlin plugin version conflict (Navigation editor: Menu switcher doesn't show after deleting a menu WordPress/gutenberg#34255)
6a87015 Bump Gradle to 7.5.1 (RichText: internal value refactor WordPress/gutenberg#34359)
9424d2c Avoid full copy of large folly::dynamic objects in JSIExecutor#defaultTimeoutInvoker [RFC]
a0ae1fb fix(android): Append `.exe` to hermesc binary path for Windows users (Docs: Remove extraneous params from block_type_metadata hook WordPress/gutenberg#34151)
d077bdf [0.70.0-rc.2] Bump version numbers
120b988 Removing reactnativeutilsjni as it is built from the same sources as reactnativejni (Explore alternative documentation for BottomSheet Header component. WordPress/gutenberg#34339)
6450bc6 Fix accessibilityState overwriting view's disabled state on Android (Components: replace legacy ColorPicker with new version WordPress/gutenberg#34287)
23cc056 Bump Gradle to 7.5.0 (List View: Slow group deletion WordPress/gutenberg#34310)
2176173 Upgrade react-native-gradle-plugin to 0.70.1 (Components: Rename PolymorphicComponent* types to WordPressComponent* WordPress/gutenberg#34330)

See the full diff

Check the changes in this PR to ensure they won't cause issues with your project.

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report

🛠 Adjust project settings

📚 Read more about Snyk's upgrade and patch logic

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Prototype Pollution

The following vulnerabilities are fixed with an upgrade: - https://snyk.io/vuln/SNYK-JS-UNSETVALUE-2400660

vercel · 2023-11-27T22:22:28Z

The latest updates on your projects. Learn more about Vercel for Git ↗︎

Name	Status	Preview	Comments	Updated (UTC)
gutenberg	❌ Failed (Inspect)			Nov 27, 2023 10:26pm
gutenberg-wd9x	❌ Failed (Inspect)			Nov 27, 2023 10:26pm

socket-security · 2023-11-27T22:30:08Z

New dependencies detected. Learn more about Socket for GitHub ↗︎

Packages	Version	New capabilities	Transitives	Size	Publisher
react-native	0.70.0	None	`+48`	124 MB	fb

socket-security · 2023-11-27T22:31:30Z

🚨 Potential security issues detected. Learn more about Socket for GitHub ↗︎

To accept the risk, merge this PR and you will not be notified again.

Issue	Package	Version	Note	Source
Chronological version anomaly	react-native	0.70.0	Previous Chronological: react-native@0.0.0-20220904-2023-12e5842e1 (9/4/2022, 8:40:39 PM) Previous Semver: react-native@0.70.0-rc.4 (8/22/2022, 3:52:15 PM)	@wordpress/react-native-editor@1.88.0 via `package.json` @react-native-clipboard/clipboard@1.9.0, @react-native-community/blur@4.2.0, @react-native-masked-view/masked-view@0.2.6, @react-navigation/native@5.7.0, @react-navigation/stack@5.6.2, react-native-fast-image@8.5.11, react-native-get-random-values@1.4.0, react-native-modal@11.10.0, react-native-safe-area-context@3.2.0, react-native-sass-transformer@1.4.0, react-native-screens@2.9.0, react-native-svg@9.13.6 via `packages/react-native-editor/package.json` `packages/react-native-editor/package.json`
Chronological version anomaly	@react-native-community/cli-plugin-metro	9.3.3	Previous Chronological: @react-native-community/cli-plugin-metro@8.0.7 (6/12/2023, 11:15:01 AM) Previous Semver: @react-native-community/cli-plugin-metro@9.2.1 (10/17/2022, 3:11:53 PM)	@wordpress/react-native-editor@1.88.0 via `package.json` @react-native-clipboard/clipboard@1.9.0, @react-native-community/blur@4.2.0, @react-native-masked-view/masked-view@0.2.6, @react-navigation/native@5.7.0, @react-navigation/stack@5.6.2, react-native@0.70.0, react-native-fast-image@8.5.11, react-native-get-random-values@1.4.0, react-native-modal@11.10.0, react-native-safe-area-context@3.2.0, react-native-sass-transformer@1.4.0, react-native-screens@2.9.0, react-native-svg@9.13.6 via `packages/react-native-editor/package.json`
Chronological version anomaly	metro	0.72.4	Previous Chronological: metro@0.70.4 (6/7/2023, 4:13:03 PM) Previous Semver: metro@0.72.3 (9/14/2022, 4:28:43 PM)	@wordpress/react-native-editor@1.88.0 via `package.json` @react-native-clipboard/clipboard@1.9.0, @react-native-community/blur@4.2.0, @react-native-masked-view/masked-view@0.2.6, @react-navigation/native@5.7.0, @react-navigation/stack@5.6.2, react-native@0.70.0, react-native-fast-image@8.5.11, react-native-get-random-values@1.4.0, react-native-modal@11.10.0, react-native-safe-area-context@3.2.0, react-native-sass-transformer@1.4.0, react-native-screens@2.9.0, react-native-svg@9.13.6 via `packages/react-native-editor/package.json`
Chronological version anomaly	metro-react-native-babel-preset	0.72.4	Previous Chronological: metro-react-native-babel-preset@0.70.4 (6/7/2023, 4:12:47 PM) Previous Semver: metro-react-native-babel-preset@0.72.3 (9/14/2022, 4:28:33 PM)	@wordpress/react-native-editor@1.88.0 via `package.json` @react-native-clipboard/clipboard@1.9.0, @react-native-community/blur@4.2.0, @react-native-masked-view/masked-view@0.2.6, @react-navigation/native@5.7.0, @react-navigation/stack@5.6.2, react-native@0.70.0, react-native-fast-image@8.5.11, react-native-get-random-values@1.4.0, react-native-modal@11.10.0, react-native-safe-area-context@3.2.0, react-native-sass-transformer@1.4.0, react-native-screens@2.9.0, react-native-svg@9.13.6 via `packages/react-native-editor/package.json`
Chronological version anomaly	metro-source-map	0.72.4	Previous Chronological: metro-source-map@0.70.4 (6/7/2023, 4:12:55 PM) Previous Semver: metro-source-map@0.72.3 (9/14/2022, 4:28:38 PM)	@wordpress/react-native-editor@1.88.0 via `package.json` @react-native-clipboard/clipboard@1.9.0, @react-native-community/blur@4.2.0, @react-native-masked-view/masked-view@0.2.6, @react-navigation/native@5.7.0, @react-navigation/stack@5.6.2, react-native@0.70.0, react-native-fast-image@8.5.11, react-native-get-random-values@1.4.0, react-native-modal@11.10.0, react-native-safe-area-context@3.2.0, react-native-sass-transformer@1.4.0, react-native-screens@2.9.0, react-native-svg@9.13.6 via `packages/react-native-editor/package.json`
Chronological version anomaly	react	18.1.0	Previous Chronological: react@0.0.0-experimental-bd4784c8f-20220425 (4/26/2022, 5:33:38 PM) Previous Semver: react@18.1.0-next-fc47cb1b6-20220404 (4/4/2022, 4:12:52 PM)	@wordpress/react-native-editor@1.88.0 via `package.json` @react-native-clipboard/clipboard@1.9.0, @react-native-community/blur@4.2.0, @react-native-masked-view/masked-view@0.2.6, @react-navigation/native@5.7.0, @react-navigation/stack@5.6.2, react-native@0.70.0, react-native-fast-image@8.5.11, react-native-get-random-values@1.4.0, react-native-modal@11.10.0, react-native-safe-area-context@3.2.0, react-native-sass-transformer@1.4.0, react-native-screens@2.9.0, react-native-svg@9.13.6 via `packages/react-native-editor/package.json`
Chronological version anomaly	@react-native-community/cli-platform-ios	9.3.0	Previous Chronological: @react-native-community/cli-platform-ios@10.0.0-alpha.3 (11/4/2022, 10:15:02 AM) Previous Semver: @react-native-community/cli-platform-ios@9.2.1 (10/17/2022, 3:11:52 PM)	@wordpress/react-native-editor@1.88.0 via `package.json` @react-native-clipboard/clipboard@1.9.0, @react-native-community/blur@4.2.0, @react-native-masked-view/masked-view@0.2.6, @react-navigation/native@5.7.0, @react-navigation/stack@5.6.2, react-native@0.70.0, react-native-fast-image@8.5.11, react-native-get-random-values@1.4.0, react-native-modal@11.10.0, react-native-safe-area-context@3.2.0, react-native-sass-transformer@1.4.0, react-native-screens@2.9.0, react-native-svg@9.13.6 via `packages/react-native-editor/package.json`
Chronological version anomaly	metro-minify-uglify	0.72.4	Previous Chronological: metro-minify-uglify@0.70.4 (6/7/2023, 4:12:47 PM) Previous Semver: metro-minify-uglify@0.72.3 (9/14/2022, 4:28:32 PM)	@wordpress/react-native-editor@1.88.0 via `package.json` @react-native-clipboard/clipboard@1.9.0, @react-native-community/blur@4.2.0, @react-native-masked-view/masked-view@0.2.6, @react-navigation/native@5.7.0, @react-navigation/stack@5.6.2, react-native@0.70.0, react-native-fast-image@8.5.11, react-native-get-random-values@1.4.0, react-native-modal@11.10.0, react-native-safe-area-context@3.2.0, react-native-sass-transformer@1.4.0, react-native-screens@2.9.0, react-native-svg@9.13.6 via `packages/react-native-editor/package.json`
Chronological version anomaly	metro-babel-transformer	0.72.4	Previous Chronological: metro-babel-transformer@0.70.4 (6/7/2023, 4:12:57 PM) Previous Semver: metro-babel-transformer@0.72.3 (9/14/2022, 4:28:40 PM)	@wordpress/react-native-editor@1.88.0 via `package.json` @react-native-clipboard/clipboard@1.9.0, @react-native-community/blur@4.2.0, @react-native-masked-view/masked-view@0.2.6, @react-navigation/native@5.7.0, @react-navigation/stack@5.6.2, react-native@0.70.0, react-native-fast-image@8.5.11, react-native-get-random-values@1.4.0, react-native-modal@11.10.0, react-native-safe-area-context@3.2.0, react-native-sass-transformer@1.4.0, react-native-screens@2.9.0, react-native-svg@9.13.6 via `packages/react-native-editor/package.json`
Environment variable access	metro-babel-transformer	0.72.4	Env Vars: BABEL_ENV Location: src/index.js +3 more instances...	@wordpress/react-native-editor@1.88.0 via `package.json` @react-native-clipboard/clipboard@1.9.0, @react-native-community/blur@4.2.0, @react-native-masked-view/masked-view@0.2.6, @react-navigation/native@5.7.0, @react-navigation/stack@5.6.2, react-native@0.70.0, react-native-fast-image@8.5.11, react-native-get-random-values@1.4.0, react-native-modal@11.10.0, react-native-safe-area-context@3.2.0, react-native-sass-transformer@1.4.0, react-native-screens@2.9.0, react-native-svg@9.13.6 via `packages/react-native-editor/package.json`
Chronological version anomaly	metro-runtime	0.72.4	Previous Chronological: metro-runtime@0.70.4 (6/7/2023, 4:12:48 PM) Previous Semver: metro-runtime@0.72.3 (9/14/2022, 4:28:34 PM)	@wordpress/react-native-editor@1.88.0 via `package.json` @react-native-clipboard/clipboard@1.9.0, @react-native-community/blur@4.2.0, @react-native-masked-view/masked-view@0.2.6, @react-navigation/native@5.7.0, @react-navigation/stack@5.6.2, react-native@0.70.0, react-native-fast-image@8.5.11, react-native-get-random-values@1.4.0, react-native-modal@11.10.0, react-native-safe-area-context@3.2.0, react-native-sass-transformer@1.4.0, react-native-screens@2.9.0, react-native-svg@9.13.6 via `packages/react-native-editor/package.json`
Chronological version anomaly	metro-config	0.72.4	Previous Chronological: metro-config@0.70.4 (6/7/2023, 4:13:06 PM) Previous Semver: metro-config@0.72.3 (9/14/2022, 4:28:45 PM)	@wordpress/react-native-editor@1.88.0 via `package.json` @react-native-clipboard/clipboard@1.9.0, @react-native-community/blur@4.2.0, @react-native-masked-view/masked-view@0.2.6, @react-navigation/native@5.7.0, @react-navigation/stack@5.6.2, react-native@0.70.0, react-native-fast-image@8.5.11, react-native-get-random-values@1.4.0, react-native-modal@11.10.0, react-native-safe-area-context@3.2.0, react-native-sass-transformer@1.4.0, react-native-screens@2.9.0, react-native-svg@9.13.6 via `packages/react-native-editor/package.json`
Chronological version anomaly	scheduler	0.22.0	Previous Chronological: scheduler@0.0.0-experimental-bd4784c8f-20220425 (4/26/2022, 5:34:16 PM) Previous Semver: scheduler@0.22.0-next-fc47cb1b6-20220404 (4/4/2022, 4:13:28 PM)	@wordpress/react-native-editor@1.88.0 via `package.json` @react-native-clipboard/clipboard@1.9.0, @react-native-community/blur@4.2.0, @react-native-masked-view/masked-view@0.2.6, @react-navigation/native@5.7.0, @react-navigation/stack@5.6.2, react-native@0.70.0, react-native-fast-image@8.5.11, react-native-get-random-values@1.4.0, react-native-modal@11.10.0, react-native-safe-area-context@3.2.0, react-native-sass-transformer@1.4.0, react-native-screens@2.9.0, react-native-svg@9.13.6 via `packages/react-native-editor/package.json`
Chronological version anomaly	metro-cache-key	0.72.4	Previous Chronological: metro-cache-key@0.70.4 (6/7/2023, 4:12:51 PM) Previous Semver: metro-cache-key@0.72.3 (9/14/2022, 4:28:35 PM)	@wordpress/react-native-editor@1.88.0 via `package.json` @react-native-clipboard/clipboard@1.9.0, @react-native-community/blur@4.2.0, @react-native-masked-view/masked-view@0.2.6, @react-navigation/native@5.7.0, @react-navigation/stack@5.6.2, react-native@0.70.0, react-native-fast-image@8.5.11, react-native-get-random-values@1.4.0, react-native-modal@11.10.0, react-native-safe-area-context@3.2.0, react-native-sass-transformer@1.4.0, react-native-screens@2.9.0, react-native-svg@9.13.6 via `packages/react-native-editor/package.json`
Chronological version anomaly	@react-native-community/cli	9.3.5	Previous Chronological: @react-native-community/cli@10.2.6 (11/6/2023, 4:15:19 PM) Previous Semver: @react-native-community/cli@9.3.4 (7/17/2023, 12:42:01 PM)	@wordpress/react-native-editor@1.88.0 via `package.json` @react-native-clipboard/clipboard@1.9.0, @react-native-community/blur@4.2.0, @react-native-masked-view/masked-view@0.2.6, @react-navigation/native@5.7.0, @react-navigation/stack@5.6.2, react-native@0.70.0, react-native-fast-image@8.5.11, react-native-get-random-values@1.4.0, react-native-modal@11.10.0, react-native-safe-area-context@3.2.0, react-native-sass-transformer@1.4.0, react-native-screens@2.9.0, react-native-svg@9.13.6 via `packages/react-native-editor/package.json`
Chronological version anomaly	react-native-codegen	0.70.7	Previous Chronological: react-native-codegen@0.71.6 (9/25/2023, 7:46:40 AM) Previous Semver: react-native-codegen@0.70.6 (10/19/2022, 3:52:51 PM)	@wordpress/react-native-editor@1.88.0 via `package.json` @react-native-clipboard/clipboard@1.9.0, @react-native-community/blur@4.2.0, @react-native-masked-view/masked-view@0.2.6, @react-navigation/native@5.7.0, @react-navigation/stack@5.6.2, react-native@0.70.0, react-native-fast-image@8.5.11, react-native-get-random-values@1.4.0, react-native-modal@11.10.0, react-native-safe-area-context@3.2.0, react-native-sass-transformer@1.4.0, react-native-screens@2.9.0, react-native-svg@9.13.6 via `packages/react-native-editor/package.json`
Chronological version anomaly	metro-cache	0.72.4	Previous Chronological: metro-cache@0.70.4 (6/7/2023, 4:12:53 PM) Previous Semver: metro-cache@0.72.3 (9/14/2022, 4:28:37 PM)	@wordpress/react-native-editor@1.88.0 via `package.json` @react-native-clipboard/clipboard@1.9.0, @react-native-community/blur@4.2.0, @react-native-masked-view/masked-view@0.2.6, @react-navigation/native@5.7.0, @react-navigation/stack@5.6.2, react-native@0.70.0, react-native-fast-image@8.5.11, react-native-get-random-values@1.4.0, react-native-modal@11.10.0, react-native-safe-area-context@3.2.0, react-native-sass-transformer@1.4.0, react-native-screens@2.9.0, react-native-svg@9.13.6 via `packages/react-native-editor/package.json`
Chronological version anomaly	metro-core	0.72.4	Previous Chronological: metro-core@0.70.4 (6/7/2023, 4:12:51 PM) Previous Semver: metro-core@0.72.3 (9/14/2022, 4:28:35 PM)	@wordpress/react-native-editor@1.88.0 via `package.json` @react-native-clipboard/clipboard@1.9.0, @react-native-community/blur@4.2.0, @react-native-masked-view/masked-view@0.2.6, @react-navigation/native@5.7.0, @react-navigation/stack@5.6.2, react-native@0.70.0, react-native-fast-image@8.5.11, react-native-get-random-values@1.4.0, react-native-modal@11.10.0, react-native-safe-area-context@3.2.0, react-native-sass-transformer@1.4.0, react-native-screens@2.9.0, react-native-svg@9.13.6 via `packages/react-native-editor/package.json`
Chronological version anomaly	metro-file-map	0.72.4	Previous Chronological: metro-file-map@0.76.5 (5/25/2023, 1:53:37 PM) Previous Semver: metro-file-map@0.72.3 (9/14/2022, 4:28:31 PM)	@wordpress/react-native-editor@1.88.0 via `package.json` @react-native-clipboard/clipboard@1.9.0, @react-native-community/blur@4.2.0, @react-native-masked-view/masked-view@0.2.6, @react-navigation/native@5.7.0, @react-navigation/stack@5.6.2, react-native@0.70.0, react-native-fast-image@8.5.11, react-native-get-random-values@1.4.0, react-native-modal@11.10.0, react-native-safe-area-context@3.2.0, react-native-sass-transformer@1.4.0, react-native-screens@2.9.0, react-native-svg@9.13.6 via `packages/react-native-editor/package.json`
Dynamic require	metro-file-map	0.72.4	Location: src/lib/rootRelativeCacheKeys.js +2 more instances...	@wordpress/react-native-editor@1.88.0 via `package.json` @react-native-clipboard/clipboard@1.9.0, @react-native-community/blur@4.2.0, @react-native-masked-view/masked-view@0.2.6, @react-navigation/native@5.7.0, @react-navigation/stack@5.6.2, react-native@0.70.0, react-native-fast-image@8.5.11, react-native-get-random-values@1.4.0, react-native-modal@11.10.0, react-native-safe-area-context@3.2.0, react-native-sass-transformer@1.4.0, react-native-screens@2.9.0, react-native-svg@9.13.6 via `packages/react-native-editor/package.json`
No v1	metro-file-map	0.72.4	Location: Package overview	@wordpress/react-native-editor@1.88.0 via `package.json` @react-native-clipboard/clipboard@1.9.0, @react-native-community/blur@4.2.0, @react-native-masked-view/masked-view@0.2.6, @react-navigation/native@5.7.0, @react-navigation/stack@5.6.2, react-native@0.70.0, react-native-fast-image@8.5.11, react-native-get-random-values@1.4.0, react-native-modal@11.10.0, react-native-safe-area-context@3.2.0, react-native-sass-transformer@1.4.0, react-native-screens@2.9.0, react-native-svg@9.13.6 via `packages/react-native-editor/package.json`
Shell access	metro-file-map	0.72.4	Module: child_process Location: src/crawlers/node.js +1 more instances...	@wordpress/react-native-editor@1.88.0 via `package.json` @react-native-clipboard/clipboard@1.9.0, @react-native-community/blur@4.2.0,

fix: packages/react-native-editor/package.json to reduce vulnerabilities

02e4f50

The following vulnerabilities are fixed with an upgrade: - https://snyk.io/vuln/SNYK-JS-UNSETVALUE-2400660

vercel bot had a problem deploying to Preview – gutenberg-wd9x November 27, 2023 22:24 Failure

vercel bot had a problem deploying to Preview – gutenberg November 27, 2023 22:26 Failure

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[Snyk] Security upgrade react-native from 0.69.4 to 0.70.0 #20

[Snyk] Security upgrade react-native from 0.69.4 to 0.70.0 #20

naiba4 commented Nov 27, 2023

vercel bot commented Nov 27, 2023 •

edited

Loading

socket-security bot commented Nov 27, 2023

socket-security bot commented Nov 27, 2023

[Snyk] Security upgrade react-native from 0.69.4 to 0.70.0 #20

Are you sure you want to change the base?

[Snyk] Security upgrade react-native from 0.69.4 to 0.70.0 #20

Conversation

naiba4 commented Nov 27, 2023

Snyk has created this PR to fix one or more vulnerable packages in the `npm` dependencies of this project.

Changes included in this PR

Vulnerabilities that will be fixed

With an upgrade:

vercel bot commented Nov 27, 2023 • edited Loading

socket-security bot commented Nov 27, 2023

socket-security bot commented Nov 27, 2023

vercel bot commented Nov 27, 2023 •

edited

Loading