infinitered / infinitered/reactotron
Bump `query-string` to at least 7.1.3
- Dominant language
- TypeScript
- Stars
- 15.6k
- Forks
- 972
- PR merge metrics
- No merged PRs in 30d
Description
There is a Denial of Service (DoS) vulnerability in `decode-uri-component` which is a dependency of `query-string`. It is fixed in `query-string@7.1.3`.
The package `reactotron-react-native` has a dependency of `query-string@6.14.1`.
We should upgrade `query-string` to mitigate this vulnerability.
See: https://github.com/react-navigation/react-navigation/pull/11069
And: https://security.snyk.io/vuln/SNYK-JS-DECODEURICOMPONENT-3149970
Note that there is a possible breaking change in query-string 7: https://github.com/sindresorhus/query-string/releases/tag/v7.0.0
Contributor guide
Research direction
Start by locating the dependency declaration for reactotron-react-native and review the query-string 7.0.0 release notes linked in the issue for breaking changes. Upgrade query-string to at least 7.1.3, then verify that the package still builds and its existing behavior is preserved.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- react-native, typescript
- Domain
- mobile, security
- Issue type
- Bug
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 45/100