callstack / callstack/react-native-paper

Update @babel/traverse dependency to fix security vulnerability in react-native-paper

Open
#4,308 0 comments 0 reactions 0 assignees View on GitHub
bug
Dominant language
TypeScript
Stars
14.5k
Forks
2.2k
Avg merge
5d 23h
Merged PRs (30d)
12

Description

### Description
I am currently developing a React native application that uses the react-native-paper. During a vulnerability scan on my package-lock.json file using Vulert.com, I discovered a security vulnerability in the @babel/traverse library, which is a dependency of react-native-paper. To address this issue and enhance the security of our application, I propose upgrading the @babel/traverse library to version 7.23.2.

### Details
- **Vulert Scan Report:** [Vulert Report](https://vulert.com/vuln-scan/list/349725f8-9f15-454d-8a08-a6cefaefec72)
- **CVE Reference:** [CVE-2023-45133](https://vulert.com/vuln-db/npm--babel-traverse-91830)

Contributor guide

Open the contributing guide

Research direction

Start by checking how @babel/traverse enters react-native-paper's dependency tree and whether version 7.23.2 is compatible. Use the package-lock.json and the linked Vulert report to confirm the vulnerable dependency, then rerun the vulnerability scan after the upgrade. Done means the reported vulnerability is resolved without breaking the package.

Written by the indexing model from the issue text.

Assessment

Tech stack
javascript, react-native
Domain
mobile-dev, security
Issue type
Bug
Difficulty
2/5
Estimated time
1-3 hours
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.