From 822a44c188efe75d881eb4fbbb77f1169f959123 Mon Sep 17 00:00:00 2001 From: Mark Murray Date: Tue, 1 Sep 2026 16:17:49 +0100 Subject: [PATCH] chore(react-native): replace vulnerable URI decoder --- platforms/react-native/package.json | 1 + platforms/react-native/pnpm-lock.yaml | 48 ++++++++++++--------------- 2 files changed, 22 insertions(+), 27 deletions(-) diff --git a/platforms/react-native/package.json b/platforms/react-native/package.json index 8aa419cfd..667a5aa43 100644 --- a/platforms/react-native/package.json +++ b/platforms/react-native/package.json @@ -29,6 +29,7 @@ "brace-expansion@5": "5.0.7", "fast-uri@3": "3.1.5", "nanoid@3": "3.3.18", + "@react-navigation/core>query-string": "9.5.0", "ws@6": "6.2.4", "ws@7": "7.5.11", "@babel/core": ">=7.29.6", diff --git a/platforms/react-native/pnpm-lock.yaml b/platforms/react-native/pnpm-lock.yaml index aabd8cd5c..e980416c4 100644 --- a/platforms/react-native/pnpm-lock.yaml +++ b/platforms/react-native/pnpm-lock.yaml @@ -18,6 +18,7 @@ overrides: brace-expansion@5: 5.0.7 fast-uri@3: 3.1.5 nanoid@3: 3.3.18 + '@react-navigation/core>query-string': 9.5.0 ws@6: 6.2.4 ws@7: 7.5.11 '@babel/core': '>=7.29.6' @@ -2340,9 +2341,9 @@ packages: resolution: {integrity: sha512-z2S+W9X73hAUUki+N+9Za2lBlun89zigOyGrsax+KUQ6wKW4ZoWpEYBkGhQjwAjjDCkWxhY0VKEhk8wzY7F5cA==, tarball: https://registry.npmjs.org/decamelize/-/decamelize-1.2.0.tgz} engines: {node: '>=0.10.0'} - decode-uri-component@0.2.2: - resolution: {integrity: sha512-FqUYQ+8o158GyGTrMFJms9qh3CqTKvAqgqsTnkLI8sKu0028orqBhxNMFkFen0zGyg6epACD32pjVk58ngIErQ==} - engines: {node: '>=0.10'} + decode-uri-component@0.5.0: + resolution: {integrity: sha512-1BiQVoK8C9gUbQU6NzAtO/tkz2qOFpEObMWpcFvhx4fYnj4Oc5yzaJN/LD36ihkVUdXyh5ZekzX+yM+ty/SrPg==, tarball: https://registry.npmjs.org/decode-uri-component/-/decode-uri-component-0.5.0.tgz} + engines: {node: '>=14.16'} dedent@0.7.0: resolution: {integrity: sha512-Q6fKUPqnAHAyhiUgFU7BUzLiv0kd8saH9al7tnu5Q/okj6dnupxyTgFIBjVzJATdfIAm9NAsvXNzjaKa+bxVyA==} @@ -2704,9 +2705,9 @@ packages: resolution: {integrity: sha512-YsGpe3WHLK8ZYi4tWDg2Jy3ebRz2rXowDxnld4bkQB00cc/1Zw9AWnC0i9ztDJitivtQvaI9KaLyKrc+hBW0yg==, tarball: https://registry.npmjs.org/fill-range/-/fill-range-7.1.1.tgz} engines: {node: '>=8'} - filter-obj@1.1.0: - resolution: {integrity: sha512-8rXg1ZnX7xzy2NGDVkBVaAy+lSlPNwad13BtgSlLuxfIslyt5Vg64U7tFcCt4WS1R0hvtnQybT/IyCkGZ3DpXQ==} - engines: {node: '>=0.10.0'} + filter-obj@5.1.0: + resolution: {integrity: sha512-qWeTREPoT7I0bifpPUXtxkZJ1XJzxWtfoWWkdVGqa+eCr3SHW/Ocp89o8vLvbUuQnadybJpjOKu4V+RwO6sGng==, tarball: https://registry.npmjs.org/filter-obj/-/filter-obj-5.1.0.tgz} + engines: {node: '>=14.16'} finalhandler@1.1.2: resolution: {integrity: sha512-aAWcW57uxVNrQZqFXjITpW3sIUQmHGG3qSb9mUah9MgMC4NeWhNOlNjXEYq3HjRAvL6arUviZGGJsBg6z0zsWA==, tarball: https://registry.npmjs.org/finalhandler/-/finalhandler-1.1.2.tgz} @@ -3969,9 +3970,9 @@ packages: resolution: {integrity: sha512-Rzq0KEyX/w/tEybncDgdkZrJgVUsUMk3xjh3t5bv3S1HTAtg+uOYt72+ZfwiQwKdysThkTBdL/rTi6HDmX9Ddw==, tarball: https://registry.npmjs.org/qs/-/qs-6.15.2.tgz} engines: {node: '>=0.6'} - query-string@7.1.3: - resolution: {integrity: sha512-hh2WYhq4fi8+b+/2Kg9CEge4fDPvHS534aOOvOZeQ3+Vf2mCFsaFBYj0i+iXcAq6I9Vzp5fjMFBlONvayDC1qg==} - engines: {node: '>=6'} + query-string@9.5.0: + resolution: {integrity: sha512-YlJmwNyi0RGYjlxYcuDncMsxFU7YyutbuI7gTm8ySxIGBlwx5yiBCOD5ig9ZNoHkawk/1Dey0N5mEfcUybMVAA==, tarball: https://registry.npmjs.org/query-string/-/query-string-9.5.0.tgz} + engines: {node: '>=18'} queue-microtask@1.2.3: resolution: {integrity: sha512-NuaNSa6flKT5JaSYQzJok04JzTL1CA6aGhv5rfLW3PgqA+M2ChpZQnAC8h8i4ZFkBS8X5RqkDBHA7r4hej3K9A==, tarball: https://registry.npmjs.org/queue-microtask/-/queue-microtask-1.2.3.tgz} @@ -4373,9 +4374,9 @@ packages: resolution: {integrity: sha512-UjgapumWlbMhkBgzT7Ykc5YXUT46F0iKu8SGXq0bcwP5dz/h0Plj6enJqjz1Zbq2l5WaqYnrVbwWOWMyF3F47g==} engines: {node: '>=0.10.0'} - split-on-first@1.1.0: - resolution: {integrity: sha512-43ZssAJaMusuKWL8sKUBQXHWOpq8d6CfN/u1p4gUzfJkM05C8rxTmYrkIPTXapZpORA6LkkzcUulJ8FqA7Uudw==} - engines: {node: '>=6'} + split-on-first@3.0.0: + resolution: {integrity: sha512-qxQJTx2ryR0Dw0ITYyekNQWpz6f8dGd7vffGNflQQ3Iqj9NJ6qiZ7ELpZsJ/QBhIVAiDfXdag3+Gp8RvWa62AA==, tarball: https://registry.npmjs.org/split-on-first/-/split-on-first-3.0.0.tgz} + engines: {node: '>=12'} sprintf-js@1.0.3: resolution: {integrity: sha512-D9cPgkvLlV3t3IzL0D0YLvGA9Ahk4PcvVwUbN0dSGr1aP0Nrt4AEnTUbuGvquEC0mA64Gqt1fzirlRs5ibXx8g==} @@ -4399,10 +4400,6 @@ packages: resolution: {integrity: sha512-RwNA9Z/7PrK06rYLIzFMlaF+l73iwpzsqRIFgbMLbTcLD6cOao82TaWefPXQvB2fOC4AjuYSEndS7N/mTCbkdQ==, tarball: https://registry.npmjs.org/statuses/-/statuses-2.0.1.tgz} engines: {node: '>= 0.8'} - strict-uri-encode@2.0.0: - resolution: {integrity: sha512-QwiXZgpRcKkhTj2Scnn++4PKtWsH0kpzZ62L2R6c/LUVYv7hVnZqcg2+sMuT6R7Jusu1vviK/MFsu6kNJfWlEQ==} - engines: {node: '>=4'} - string-argv@0.3.2: resolution: {integrity: sha512-aqD2Q0144Z+/RqG52NeHEkZauTAUWJO8c6yTftGJKO3Tja5tUgIfmIl6kExvhtxSDP7fXB6DvzkfMpCd/F3G+Q==} engines: {node: '>=0.6.19'} @@ -6551,7 +6548,7 @@ snapshots: escape-string-regexp: 4.0.0 fast-deep-equal: 3.1.3 nanoid: 3.3.18 - query-string: 7.1.3 + query-string: 9.5.0 react: 19.1.0 react-is: 19.1.1 use-latest-callback: 0.2.6(react@19.1.0) @@ -7575,7 +7572,7 @@ snapshots: decamelize@1.2.0: {} - decode-uri-component@0.2.2: {} + decode-uri-component@0.5.0: {} dedent@0.7.0: {} @@ -8016,7 +8013,7 @@ snapshots: dependencies: to-regex-range: 5.0.1 - filter-obj@1.1.0: {} + filter-obj@5.1.0: {} finalhandler@1.1.2: dependencies: @@ -9578,12 +9575,11 @@ snapshots: dependencies: side-channel: 1.1.0 - query-string@7.1.3: + query-string@9.5.0: dependencies: - decode-uri-component: 0.2.2 - filter-obj: 1.1.0 - split-on-first: 1.1.0 - strict-uri-encode: 2.0.0 + decode-uri-component: 0.5.0 + filter-obj: 5.1.0 + split-on-first: 3.0.0 queue-microtask@1.2.3: {} @@ -10054,7 +10050,7 @@ snapshots: source-map@0.6.1: {} - split-on-first@1.1.0: {} + split-on-first@3.0.0: {} sprintf-js@1.0.3: {} @@ -10072,8 +10068,6 @@ snapshots: statuses@2.0.1: {} - strict-uri-encode@2.0.0: {} - string-argv@0.3.2: {} string-length@4.0.2: