From d3c0fd940b14641c7e346cf653c26c073ce74e23 Mon Sep 17 00:00:00 2001 From: snyk-bot Date: Thu, 30 Apr 2020 19:39:30 -0400 Subject: [PATCH 1/2] fix: .snyk & package.json to reduce vulnerabilities The following vulnerabilities are fixed with a Snyk patch: - https://snyk.io/vuln/SNYK-JS-LODASH-567746 --- .snyk | 152 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 152 insertions(+) create mode 100644 .snyk diff --git a/.snyk b/.snyk new file mode 100644 index 0000000..8270a08 --- /dev/null +++ b/.snyk @@ -0,0 +1,152 @@ +# Snyk (https://snyk.io) policy file, patches or ignores known vulnerabilities. +version: v1.14.1 +ignore: {} +# patches apply the minimum changes required to fix a vulnerability +patch: + SNYK-JS-LODASH-567746: + - lodash: + patched: '2020-04-30T23:39:28.454Z' + - react-native > lodash: + patched: '2020-04-30T23:39:28.454Z' + - react-native > inquirer > lodash: + patched: '2020-04-30T23:39:28.454Z' + - react-native-sentry > @sentry/wizard > lodash: + patched: '2020-04-30T23:39:28.454Z' + - react-native > metro > @babel/core > lodash: + patched: '2020-04-30T23:39:28.454Z' + - react-native > fbjs-scripts > @babel/core > lodash: + patched: '2020-04-30T23:39:28.454Z' + - react-native > metro-babel-register > @babel/register > lodash: + patched: '2020-04-30T23:39:28.454Z' + - react-native > metro > async > lodash: + patched: '2020-04-30T23:39:28.454Z' + - react-native-sentry > @sentry/wizard > inquirer > lodash: + patched: '2020-04-30T23:39:28.454Z' + - react-native > metro > @babel/core > @babel/traverse > lodash: + patched: '2020-04-30T23:39:28.454Z' + - react-native > fbjs-scripts > @babel/core > @babel/traverse > lodash: + patched: '2020-04-30T23:39:28.454Z' + - react-native > metro-babel-register > @babel/plugin-transform-modules-commonjs > @babel/helper-module-transforms > lodash: + patched: '2020-04-30T23:39:28.454Z' + - react-native > fbjs-scripts > babel-preset-fbjs > @babel/plugin-transform-block-scoping > lodash: + patched: '2020-04-30T23:39:28.454Z' + - react-native > metro > babel-preset-fbjs > @babel/plugin-transform-block-scoping > lodash: + patched: '2020-04-30T23:39:28.454Z' + - react-native > metro > metro-react-native-babel-preset > @babel/plugin-transform-block-scoping > lodash: + patched: '2020-04-30T23:39:28.454Z' + - react-native > metro > react-transform-hmr > react-proxy > lodash: + patched: '2020-04-30T23:39:28.454Z' + - react-native > metro > @babel/core > @babel/helpers > @babel/traverse > lodash: + patched: '2020-04-30T23:39:28.454Z' + - react-native > fbjs-scripts > @babel/core > @babel/helpers > @babel/traverse > lodash: + patched: '2020-04-30T23:39:28.454Z' + - react-native > metro-babel-register > @babel/plugin-transform-async-to-generator > @babel/helper-remap-async-to-generator > @babel/traverse > lodash: + patched: '2020-04-30T23:39:28.454Z' + - react-native > metro > metro-react-native-babel-preset > @babel/plugin-transform-unicode-regex > @babel/helper-regex > lodash: + patched: '2020-04-30T23:39:28.454Z' + - react-native > metro > metro-config > metro > @babel/core > lodash: + patched: '2020-04-30T23:39:28.454Z' + - react-native > fbjs-scripts > babel-preset-fbjs > @babel/plugin-transform-modules-commonjs > @babel/helper-module-transforms > lodash: + patched: '2020-04-30T23:39:28.454Z' + - react-native > metro > babel-preset-fbjs > @babel/plugin-transform-modules-commonjs > @babel/helper-module-transforms > lodash: + patched: '2020-04-30T23:39:28.454Z' + - react-native > metro > metro-config > metro > async > lodash: + patched: '2020-04-30T23:39:28.454Z' + - react-native > metro > metro-react-native-babel-preset > react-transform-hmr > react-proxy > lodash: + patched: '2020-04-30T23:39:28.454Z' + - react-native > fbjs-scripts > @babel/core > @babel/helpers > @babel/traverse > @babel/generator > lodash: + patched: '2020-04-30T23:39:28.454Z' + - react-native > metro > @babel/core > @babel/helpers > @babel/traverse > @babel/generator > lodash: + patched: '2020-04-30T23:39:28.454Z' + - react-native > metro-babel-register > @babel/plugin-transform-async-to-generator > @babel/helper-remap-async-to-generator > @babel/helper-wrap-function > @babel/traverse > lodash: + patched: '2020-04-30T23:39:28.454Z' + - react-native > metro > metro-config > metro > @babel/core > @babel/traverse > lodash: + patched: '2020-04-30T23:39:28.454Z' + - react-native > fbjs-scripts > babel-preset-fbjs > @babel/plugin-transform-parameters > @babel/helper-call-delegate > @babel/traverse > lodash: + patched: '2020-04-30T23:39:28.454Z' + - react-native > metro > babel-preset-fbjs > @babel/plugin-transform-parameters > @babel/helper-call-delegate > @babel/traverse > lodash: + patched: '2020-04-30T23:39:28.454Z' + - react-native > metro > metro-react-native-babel-preset > @babel/plugin-transform-parameters > @babel/helper-call-delegate > @babel/traverse > lodash: + patched: '2020-04-30T23:39:28.454Z' + - react-native > metro > metro-react-native-babel-preset > metro-babel7-plugin-react-transform > @babel/helper-module-imports > @babel/types > lodash: + patched: '2020-04-30T23:39:28.454Z' + - react-native > metro > metro-config > metro > babel-preset-fbjs > @babel/plugin-transform-block-scoping > lodash: + patched: '2020-04-30T23:39:28.454Z' + - react-native > metro > metro-config > metro > metro-react-native-babel-preset > @babel/plugin-transform-block-scoping > lodash: + patched: '2020-04-30T23:39:28.454Z' + - react-native > metro > metro-config > metro > react-transform-hmr > react-proxy > lodash: + patched: '2020-04-30T23:39:28.454Z' + - react-native > fbjs-scripts > @babel/core > @babel/helpers > @babel/traverse > @babel/helper-split-export-declaration > @babel/types > lodash: + patched: '2020-04-30T23:39:28.454Z' + - react-native > metro > @babel/core > @babel/helpers > @babel/traverse > @babel/helper-split-export-declaration > @babel/types > lodash: + patched: '2020-04-30T23:39:28.454Z' + - react-native > metro-babel-register > @babel/plugin-transform-async-to-generator > @babel/helper-remap-async-to-generator > @babel/helper-wrap-function > @babel/traverse > @babel/generator > lodash: + patched: '2020-04-30T23:39:28.454Z' + - react-native > metro > metro-config > metro > @babel/core > @babel/helpers > @babel/traverse > lodash: + patched: '2020-04-30T23:39:28.454Z' + - react-native > fbjs-scripts > babel-preset-fbjs > @babel/plugin-proposal-class-properties > @babel/helper-create-class-features-plugin > @babel/helper-replace-supers > @babel/traverse > lodash: + patched: '2020-04-30T23:39:28.454Z' + - react-native > metro > babel-preset-fbjs > @babel/plugin-proposal-class-properties > @babel/helper-create-class-features-plugin > @babel/helper-replace-supers > @babel/traverse > lodash: + patched: '2020-04-30T23:39:28.454Z' + - react-native > metro > metro-react-native-babel-preset > @babel/plugin-transform-exponentiation-operator > @babel/helper-builder-binary-assignment-operator-visitor > @babel/helper-explode-assignable-expression > @babel/traverse > lodash: + patched: '2020-04-30T23:39:28.454Z' + - react-native > metro > metro-config > metro > metro-react-native-babel-preset > @babel/plugin-transform-unicode-regex > @babel/helper-regex > lodash: + patched: '2020-04-30T23:39:28.454Z' + - react-native > metro > metro-config > metro > babel-preset-fbjs > @babel/plugin-transform-modules-commonjs > @babel/helper-module-transforms > lodash: + patched: '2020-04-30T23:39:28.454Z' + - react-native > metro > metro-config > metro > metro-react-native-babel-preset > react-transform-hmr > react-proxy > lodash: + patched: '2020-04-30T23:39:28.454Z' + - react-native > metro > metro-config > metro > @babel/core > @babel/helpers > @babel/traverse > @babel/generator > lodash: + patched: '2020-04-30T23:39:28.454Z' + - react-native > metro-babel-register > @babel/plugin-transform-async-to-generator > @babel/helper-remap-async-to-generator > @babel/helper-wrap-function > @babel/traverse > @babel/helper-split-export-declaration > @babel/types > lodash: + patched: '2020-04-30T23:39:28.454Z' + - react-native > fbjs-scripts > babel-preset-fbjs > @babel/plugin-proposal-class-properties > @babel/helper-create-class-features-plugin > @babel/helper-replace-supers > @babel/traverse > @babel/generator > lodash: + patched: '2020-04-30T23:39:28.454Z' + - react-native > metro > babel-preset-fbjs > @babel/plugin-proposal-class-properties > @babel/helper-create-class-features-plugin > @babel/helper-replace-supers > @babel/traverse > @babel/generator > lodash: + patched: '2020-04-30T23:39:28.454Z' + - react-native > metro > metro-react-native-babel-preset > @babel/plugin-transform-exponentiation-operator > @babel/helper-builder-binary-assignment-operator-visitor > @babel/helper-explode-assignable-expression > @babel/traverse > @babel/generator > lodash: + patched: '2020-04-30T23:39:28.454Z' + - react-native > fbjs-scripts > @babel/core > @babel/helpers > @babel/traverse > @babel/helper-function-name > @babel/helper-get-function-arity > @babel/types > lodash: + patched: '2020-04-30T23:39:28.454Z' + - react-native > metro > @babel/core > @babel/helpers > @babel/traverse > @babel/helper-function-name > @babel/helper-get-function-arity > @babel/types > lodash: + patched: '2020-04-30T23:39:28.454Z' + - react-native > metro > metro-config > metro > babel-preset-fbjs > @babel/plugin-transform-parameters > @babel/helper-call-delegate > @babel/traverse > lodash: + patched: '2020-04-30T23:39:28.454Z' + - react-native > metro > metro-config > metro > metro-react-native-babel-preset > @babel/plugin-transform-parameters > @babel/helper-call-delegate > @babel/traverse > lodash: + patched: '2020-04-30T23:39:28.454Z' + - react-native > metro > metro-config > metro > metro-react-native-babel-preset > metro-babel7-plugin-react-transform > @babel/helper-module-imports > @babel/types > lodash: + patched: '2020-04-30T23:39:28.454Z' + - react-native > metro > metro-config > metro > @babel/core > @babel/helpers > @babel/traverse > @babel/helper-split-export-declaration > @babel/types > lodash: + patched: '2020-04-30T23:39:28.454Z' + - react-native > fbjs-scripts > babel-preset-fbjs > @babel/plugin-proposal-class-properties > @babel/helper-create-class-features-plugin > @babel/helper-replace-supers > @babel/traverse > @babel/helper-split-export-declaration > @babel/types > lodash: + patched: '2020-04-30T23:39:28.454Z' + - react-native > metro > babel-preset-fbjs > @babel/plugin-proposal-class-properties > @babel/helper-create-class-features-plugin > @babel/helper-replace-supers > @babel/traverse > @babel/helper-split-export-declaration > @babel/types > lodash: + patched: '2020-04-30T23:39:28.454Z' + - react-native > metro > metro-react-native-babel-preset > @babel/plugin-transform-exponentiation-operator > @babel/helper-builder-binary-assignment-operator-visitor > @babel/helper-explode-assignable-expression > @babel/traverse > @babel/helper-split-export-declaration > @babel/types > lodash: + patched: '2020-04-30T23:39:28.454Z' + - react-native > metro-babel-register > @babel/plugin-transform-async-to-generator > @babel/helper-remap-async-to-generator > @babel/helper-wrap-function > @babel/traverse > @babel/helper-function-name > @babel/helper-get-function-arity > @babel/types > lodash: + patched: '2020-04-30T23:39:28.454Z' + - react-native > metro > metro-config > metro > babel-preset-fbjs > @babel/plugin-proposal-class-properties > @babel/helper-create-class-features-plugin > @babel/helper-replace-supers > @babel/traverse > lodash: + patched: '2020-04-30T23:39:28.454Z' + - react-native > metro > metro-config > metro > metro-react-native-babel-preset > @babel/plugin-transform-exponentiation-operator > @babel/helper-builder-binary-assignment-operator-visitor > @babel/helper-explode-assignable-expression > @babel/traverse > lodash: + patched: '2020-04-30T23:39:28.454Z' + - react-native > metro > metro-config > metro > babel-preset-fbjs > @babel/plugin-proposal-class-properties > @babel/helper-create-class-features-plugin > @babel/helper-replace-supers > @babel/traverse > @babel/generator > lodash: + patched: '2020-04-30T23:39:28.454Z' + - react-native > metro > metro-config > metro > metro-react-native-babel-preset > @babel/plugin-transform-exponentiation-operator > @babel/helper-builder-binary-assignment-operator-visitor > @babel/helper-explode-assignable-expression > @babel/traverse > @babel/generator > lodash: + patched: '2020-04-30T23:39:28.454Z' + - react-native > metro > metro-config > metro > @babel/core > @babel/helpers > @babel/traverse > @babel/helper-function-name > @babel/helper-get-function-arity > @babel/types > lodash: + patched: '2020-04-30T23:39:28.454Z' + - react-native > fbjs-scripts > babel-preset-fbjs > @babel/plugin-proposal-class-properties > @babel/helper-create-class-features-plugin > @babel/helper-replace-supers > @babel/traverse > @babel/helper-function-name > @babel/helper-get-function-arity > @babel/types > lodash: + patched: '2020-04-30T23:39:28.454Z' + - react-native > metro > babel-preset-fbjs > @babel/plugin-proposal-class-properties > @babel/helper-create-class-features-plugin > @babel/helper-replace-supers > @babel/traverse > @babel/helper-function-name > @babel/helper-get-function-arity > @babel/types > lodash: + patched: '2020-04-30T23:39:28.454Z' + - react-native > metro > metro-react-native-babel-preset > @babel/plugin-transform-exponentiation-operator > @babel/helper-builder-binary-assignment-operator-visitor > @babel/helper-explode-assignable-expression > @babel/traverse > @babel/helper-function-name > @babel/helper-get-function-arity > @babel/types > lodash: + patched: '2020-04-30T23:39:28.454Z' + - react-native > metro > metro-config > metro > babel-preset-fbjs > @babel/plugin-proposal-class-properties > @babel/helper-create-class-features-plugin > @babel/helper-replace-supers > @babel/traverse > @babel/helper-split-export-declaration > @babel/types > lodash: + patched: '2020-04-30T23:39:28.454Z' + - react-native > metro > metro-config > metro > metro-react-native-babel-preset > @babel/plugin-transform-exponentiation-operator > @babel/helper-builder-binary-assignment-operator-visitor > @babel/helper-explode-assignable-expression > @babel/traverse > @babel/helper-split-export-declaration > @babel/types > lodash: + patched: '2020-04-30T23:39:28.454Z' + - react-native > metro > metro-config > metro > babel-preset-fbjs > @babel/plugin-proposal-class-properties > @babel/helper-create-class-features-plugin > @babel/helper-replace-supers > @babel/traverse > @babel/helper-function-name > @babel/helper-get-function-arity > @babel/types > lodash: + patched: '2020-04-30T23:39:28.454Z' + - react-native > metro > metro-config > metro > metro-react-native-babel-preset > @babel/plugin-transform-exponentiation-operator > @babel/helper-builder-binary-assignment-operator-visitor > @babel/helper-explode-assignable-expression > @babel/traverse > @babel/helper-function-name > @babel/helper-get-function-arity > @babel/types > lodash: + patched: '2020-04-30T23:39:28.454Z' From 22b98d56dcd6ec5c844ed43a37fd5fff07e8fa01 Mon Sep 17 00:00:00 2001 From: snyk-bot Date: Thu, 30 Apr 2020 19:39:31 -0400 Subject: [PATCH 2/2] fix: .snyk & package.json to reduce vulnerabilities The following vulnerabilities are fixed with a Snyk patch: - https://snyk.io/vuln/SNYK-JS-LODASH-567746 --- package.json | 54 ++++++++++++++++++++++++++++------------------------ 1 file changed, 29 insertions(+), 25 deletions(-) diff --git a/package.json b/package.json index d546d07..319f77b 100644 --- a/package.json +++ b/package.json @@ -1,27 +1,31 @@ { - "name": "masontoday", - "version": "0.0.1", - "private": true, - "scripts": { - "start": "node node_modules/react-native/local-cli/cli.js start", - "start:ios": "react-native run-ios", - "start:android": "react-native run-android" - }, - "dependencies": { - "lodash": "^4.17.10", - "moment": "^2.22.2", - "react": "16.6.3", - "react-native": "0.57.8", - "react-native-add-calendar-event": "^2.3.0", - "react-native-app-settings": "^2.0.1", - "react-native-gesture-handler": "^1.0.15", - "react-native-sentry": "^0.41.1", - "react-native-splash-screen": "3.0.6", - "react-navigation": "^3.2.1" - }, - "devDependencies": { - "babel-core": "^7.0.0-bridge.0", - "babel-jest": "24.1.0", - "metro-react-native-babel-preset": "0.51.1" - } + "name": "masontoday", + "version": "0.0.1", + "private": true, + "scripts": { + "start": "node node_modules/react-native/local-cli/cli.js start", + "start:ios": "react-native run-ios", + "start:android": "react-native run-android", + "snyk-protect": "snyk protect", + "prepare": "yarn run snyk-protect" + }, + "dependencies": { + "lodash": "^4.17.10", + "moment": "^2.22.2", + "react": "16.6.3", + "react-native": "0.57.8", + "react-native-add-calendar-event": "^2.3.0", + "react-native-app-settings": "^2.0.1", + "react-native-gesture-handler": "^1.0.15", + "react-native-sentry": "^0.41.1", + "react-native-splash-screen": "3.0.6", + "react-navigation": "^3.2.1", + "snyk": "^1.316.1" + }, + "devDependencies": { + "babel-core": "^7.0.0-bridge.0", + "babel-jest": "24.1.0", + "metro-react-native-babel-preset": "0.51.1" + }, + "snyk": true }