react_native/codegen dependency glob is deprecated.
Nobody has claimed this yet.
- Dominant language
- C++
- Stars
- 127k
- Forks
- 25.3k
- Avg merge
- 1d 23h
- Merged PRs (30d)
- 4
Description
Description
glob ^7 is deprecated and itself requires a deprecated package of inflight that has a security bulletin out on it.
It should be updated to version 9, at the least, if not all the was to current version 11. See:
https://www.npmjs.com/package/glob?activeTab=versions
Facebook security replied that they didn't consider this a security issue, so posting it publicly.
Steps to reproduce
React Native Version
0.79.2
Affected Platforms
Build - Linux, Build - MacOS
Output of npx @react-native-community/cli info
na
Stacktrace or Logs
na
MANDATORY Reproducer
Screenshots and Videos
No response
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start with packages/react-native-codegen/package.json at the linked dependency entry and compare the requested glob versions with the package's supported requirements. Verify the dependency update through the React Native codegen checks or builds for the affected Linux and macOS platforms; done means glob is no longer on the deprecated version and those builds remain functional.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- react-native
- Domain
- build-system, mobile
- Issue type
- Bug
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Activity status
- Quiet
- Clarity
- Clearly specified
- Newbie friendliness
- 68/100