search

GantMan / react-native-siren

The React Native port of the popular Siren / Harpy Pod and hopefully Gradle
156 stars 26 forks source link

Vulnerability in axios #11

Closed nirajniroula closed 3 years ago

nirajniroula commented 3 years ago

A vulnerability CVE-2020-28168 detected in package axios<0.21.1 is referenced by react-native-siren via apisauce@0.3.0. Seems like apisauce has got rid of the vulnerability since apisauce@2.0.0.

Could we please use the latest version of apisauce?

GantMan commented 3 years ago

Sounds good. Can you send a PR with the change and I'll merge.

Would you like to be added as a contributor?

nirajniroula commented 3 years ago

Please do check it. And yes, although I am not into ios development (which I believe this package focuses on) but being a contributor, I think, is not a bad idea.

GantMan commented 3 years ago

I merged the PR and added you as a collaborator for this repo.

When you've tested the fix by verifying master branch is set, you can deploy a new version!

What is your NPM js username? I'll give you access now.

nirajniroula commented 3 years ago

Looks good to me. warning react-native-siren > apisauce > axios@0.12.0: Critical security vulnerability fixed in v0.21.1. For more information, see https://github.com/axios/axios/pull/3410
This warning is no more in the master branch. But since I don't have a mac system, I couldn't test the package's usage completely. What do you say, should we confirm, if it is working as intended or not, before deploying the new version? Personally, I don't think simply updating the apisauce version is going to affect other part of the code but better if we confirm. Will be waiting for your call. NPM username: niniroula

GantMan commented 3 years ago

I've added you as an NPM author. Sounds good, go ahead and release!

nirajniroula commented 3 years ago

🎉 Released!!!