Files
inji-wallet/android
KiruthikaJeyashankar 6ce73a26e0 refactor(INJI-449): fix OWASP vulnerabilities with dependencies (#1035)
* refactor(INJI-449): remove unused dependencies

Dependencies removed

1. expo-status-bar
2. @expo-google-fonts/poppins
3. react-native-simple-markdown
4. react-native-swipe-gestures

DevDependencies removed

1. @react-native/metro-config (removed as we already have @expo/metro-config dependency used)
2. metro-react-native-babel-preset
3. @types/react-test-renderer
4. react-test-renderer

Signed-off-by: Kiruthika Jeyashankar <81218987+KiruthikaJeyashankar@users.noreply.github.com>

* refactor(INJI-449): update expo related packages and crypto-js

Signed-off-by: Kiruthika Jeyashankar <81218987+KiruthikaJeyashankar@users.noreply.github.com>

* refactor(INJI-449): update transitive dependency of expo-updates package

plist package is a transitive dependency of expo-updates which had vulnerability - Prototype pollution vulnerability via .parse() in Plist before v3.0.4 allows attackers to cause a Denial of Service (DoS) and may lead to remote code execution. Thus this package was updated to fix vulnerability

Signed-off-by: Kiruthika Jeyashankar <81218987+KiruthikaJeyashankar@users.noreply.github.com>

* refactor(INJI-449): update axios dependency of telemetry-sdk to 1.6.0

Since the package axios(1.5.0) has vulnerability - Cross-Site Request Forgery (CSRF), it is updated to 1.6.0

Signed-off-by: Kiruthika Jeyashankar <81218987+KiruthikaJeyashankar@users.noreply.github.com>

* fix(INJI-449): vulnerablity issue with @digitalbazaar/rsa-verification-key-2018

override the node-forge dependency of the package - @digitalbazaar/rsa-verification-key-2018 as it has the high severity with CVE count 13

Signed-off-by: Kiruthika Jeyashankar <81218987+KiruthikaJeyashankar@users.noreply.github.com>

* revert(INJI-449): downgrade crypto-js to 3.3.0 from 4.x.x version

Signed-off-by: Kiruthika Jeyashankar <81218987+KiruthikaJeyashankar@users.noreply.github.com>

* refactor(INJI-449): use expo-splash-screen instead of expo-app-loading

expo-app-loading package is deprecated and it is suggested to replace it with expo-splash-screen

Signed-off-by: Kiruthika Jeyashankar <81218987+KiruthikaJeyashankar@users.noreply.github.com>

* refactor(INJI-449): optimize time taken to hide splash screen

Co-authored-by: Sreenadh S <32409698+sree96@users.noreply.github.com>

Signed-off-by: Kiruthika Jeyashankar <81218987+KiruthikaJeyashankar@users.noreply.github.com>

* refactor(INJI-449): change appEntry to index js

Change appEntry to index.js file since react-native-url-polyfill/auto is imported to avoid URL error. appEntry is required for expo package update

Signed-off-by: Kiruthika Jeyashankar <81218987+KiruthikaJeyashankar@users.noreply.github.com>

* refactor(INJI-559): update podfile.lock

Signed-off-by: Kiruthika Jeyashankar <81218987+KiruthikaJeyashankar@users.noreply.github.com>

* refactor(INJI-449): optimize import

Signed-off-by: Kiruthika Jeyashankar <81218987+KiruthikaJeyashankar@users.noreply.github.com>

---------

Signed-off-by: Kiruthika Jeyashankar <81218987+KiruthikaJeyashankar@users.noreply.github.com>
2023-11-29 15:10:56 +05:30
..