Skip to content

Fix security issues with rnc cli by bumping version#29072

Closed
alexbrazier wants to merge 1 commit intofacebook:masterfrom
alexbrazier:fix-dependencies-issues
Closed

Fix security issues with rnc cli by bumping version#29072
alexbrazier wants to merge 1 commit intofacebook:masterfrom
alexbrazier:fix-dependencies-issues

Conversation

@alexbrazier
Copy link
Copy Markdown
Contributor

@alexbrazier alexbrazier commented Jun 5, 2020 •
edited
Loading

Summary

Fix security issue with logkitty - used by cli-android package
react-native-community/cli#1158

Changelog

[General] [Security] - Bump package version of cli packages to fix security vulnerability

@alexbrazier alexbrazier requested review from cpojer and hramos as code owners June 5, 2020 16:53
@pull-bot
Copy link
Copy Markdown

pull-bot commented Jun 5, 2020

Warnings
⚠️ 🔒 package.json - Changes were made to package.json. This will require a manual import by a Facebook employee.
Messages
📖

📋 Verify Changelog Format - A changelog entry has the following format: [CATEGORY] [TYPE] - Message.

DetailsCATEGORY may be:
  • General
  • iOS
  • Android
  • JavaScript
  • Internal (for changes that do not need to be called out in the release notes)

TYPE may be:

  • Added, for new features.
  • Changed, for changes in existing functionality.
  • Deprecated, for soon-to-be removed features.
  • Removed, for now removed features.
  • Fixed, for any bug fixes.
  • Security, in case of vulnerabilities.

MESSAGE may answer "what and why" on a feature level. Use this to briefly tell React Native users about notable changes.
📖 📋 Missing Test Plan - Can you add a Test Plan? To do so, add a "## Test Plan" section to your PR description. A Test Plan lets us know how these changes were tested.

Generated by 🚫 dangerJS against 08c472c

@facebook-github-bot facebook-github-bot added the CLA Signed This label is managed by the Facebook bot. Authors need to sign the CLA before a PR can be reviewed. label Jun 5, 2020
cpojer
cpojer approved these changes Jun 5, 2020
View reviewed changes
Copy link
Copy Markdown
Contributor

@cpojer cpojer left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

👍

facebook-github-bot
facebook-github-bot reviewed Jun 5, 2020
View reviewed changes
Copy link
Copy Markdown
Contributor

@facebook-github-bot facebook-github-bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@cpojer has imported this pull request. If you are a Facebook employee, you can view this diff on Phabricator.

@analysis-bot
Copy link
Copy Markdown

analysis-bot commented Jun 5, 2020

Platform Engine Arch Size (bytes) Diff
android hermes arm64-v8a 6,759,129 0
android hermes armeabi-v7a 6,421,816 0
android hermes x86 7,145,377 0
android hermes x86_64 7,035,349 0
android jsc arm64-v8a 8,933,023 0
android jsc armeabi-v7a 8,588,081 0
android jsc x86 8,762,378 0
android jsc x86_64 9,337,999 0

Base commit: 8821d27

@analysis-bot
Copy link
Copy Markdown

analysis-bot commented Jun 5, 2020 •
edited
Loading

Platform Engine Arch Size (bytes) Diff
ios - universal 829,440 0

Base commit: 8821d27

@react-native-bot
Copy link
Copy Markdown
Collaborator

react-native-bot commented Jun 7, 2020

This pull request was successfully merged by @alexbrazier in 001eb7c.

When will my fix make it into a release? | Upcoming Releases

@react-native-bot react-native-bot added the Merged This PR has been merged. label Jun 7, 2020
@Gustash Gustash mentioned this pull request Jun 10, 2020
Closed
20 tasks
alloy pushed a commit to alloy/react-native that referenced this pull request Sep 29, 2020
@alexbrazier @alloy
Fix security issues with rnc cli by bumping version (facebook#29072)
8d8b61a 
Summary:
Fix security issue with logkitty - used by `cli-android` package
react-native-community/cli#1158

<!-- Help reviewers and the release process by writing your own changelog entry. For an example, see:
https://github.com/facebook/react-native/wiki/Changelog
-->

[SECURITY] [FIX] - Bump package version of `cli` packages to fix security vulnerability
Pull Request resolved: facebook#29072

Reviewed By: ejanzer

Differential Revision: D21906716

Pulled By: cpojer

fbshipit-source-id: b5ed9d0bc7a882f5f7a90825402c4c978918d9ed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@hramos hramos Awaiting requested review from hramos

2 more reviewers

@facebook-github-bot facebook-github-bot facebook-github-bot left review comments

@cpojer cpojer cpojer approved these changes

Reviewers whose approvals may not affect merge requirements

Assignees

No one assigned

Labels

CLA Signed This label is managed by the Facebook bot. Authors need to sign the CLA before a PR can be reviewed. Merged This PR has been merged. Type: Security

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

6 participants

@alexbrazier @pull-bot @analysis-bot @react-native-bot @cpojer @facebook-github-bot