Minor security issue
Opened this issue ยท 0 comments
Hi! I have noticed a minor security issue, reported by npm audit
, regarding a dependency of this project. It's related to an older version of lodash@<4.17.5
allowing to pollute the prototype namespace by using the merge methods. The exact security report can be found here, https://nodesecurity.io/advisories/577. I also added the full report below.
I know that this project doesn't use lodash itself, but it does include an older version of react-google-maps
. You can see this in de added dependency chain. This older version of react-google-maps
includes the affected lodash dependency. Luckily, react-google-maps
has fixed this issue in versions starting at 8.0.0
.
I would recommend update this dependency to >=8.0.0
, currently they are at 9.4.5
. There is only 1 breaking change when migrating from 7.3.0
to 8.0.0
, one of which im not exactly sure if it affects this library (https://github.com/tomchentw/react-google-maps/blob/v8.0.0/CHANGELOG.md#breaking-changes).
Let me know if I can do anything to help resolving this, by creating a PR for example. ๐
Cheers,
Cedric
The dependency chain
<our-project>
โโโฌ expo@27.0.2
โโโฌ react-native-web-maps@0.1.0
โโโฌ react-google-maps@7.3.0
โโโ lodash@4.16.2
The full report by npm audit
โโโโโโโโโโโโโโโโโฌโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโ
โ Low โ Prototype Pollution โ
โโโโโโโโโโโโโโโโโผโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโค
โ Package โ lodash โ
โโโโโโโโโโโโโโโโโผโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโค
โ Patched in โ >=4.17.5 โ
โโโโโโโโโโโโโโโโโผโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโค
โ Dependency of โ expo โ
โโโโโโโโโโโโโโโโโผโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโค
โ Path โ expo > react-native-web-maps > react-google-maps > lodash โ
โโโโโโโโโโโโโโโโโผโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโค
โ More info โ https://nodesecurity.io/advisories/577 โ
โโโโโโโโโโโโโโโโโดโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโ