callstack / callstack/react-native-paper
Update @babel/traverse dependency to fix security vulnerability in react-native-paper
- Dominant language
- TypeScript
- Stars
- 14.5k
- Forks
- 2.2k
- Avg merge
- 5d 23h
- Merged PRs (30d)
- 12
Description
### Description
I am currently developing a React native application that uses the react-native-paper. During a vulnerability scan on my package-lock.json file using Vulert.com, I discovered a security vulnerability in the @babel/traverse library, which is a dependency of react-native-paper. To address this issue and enhance the security of our application, I propose upgrading the @babel/traverse library to version 7.23.2.
### Details
- **Vulert Scan Report:** [Vulert Report](https://vulert.com/vuln-scan/list/349725f8-9f15-454d-8a08-a6cefaefec72)
- **CVE Reference:** [CVE-2023-45133](https://vulert.com/vuln-db/npm--babel-traverse-91830)
Contributor guide
Research direction
Start by checking how @babel/traverse enters react-native-paper's dependency tree and whether version 7.23.2 is compatible. Use the package-lock.json and the linked Vulert report to confirm the vulnerable dependency, then rerun the vulnerability scan after the upgrade. Done means the reported vulnerability is resolved without breaking the package.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- javascript, react-native
- Domain
- mobile-dev, security
- Issue type
- Bug
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100