mirror of
https://github.com/react/react-native.git
synced 2026-09-28 13:23:09 +08:00
Nicola Corti
284035b21d
Summary: Pull Request resolved: https://github.com/facebook/react-native/pull/57066 Add yarn resolutions and update lockfiles to fix security vulnerabilities in five transitive dependencies: - `xmldom/xmldom` 0.8.10 → 0.8.13 (CVE-2026-41672, XML injection) - `fast-xml-parser` 4.5.4 → 4.5.6 (CVE-2026-33349, CVE-2026-33036, entity expansion bypass) - `yaml` 2.5.0/2.8.1 → 2.9.0 (CVE-2026-33532, stack overflow via deep nesting) - `fast-uri` 3.0.6 → 3.1.2 (CVE-2026-6322, host confusion; CVE-2026-6321, path traversal) - `addressable` 2.8.5/2.8.7 → 2.9.0 (CVE-2026-35611, ReDoS) All bumps are within semver range of their parent constraints and are patch or minor version updates. - Fixes https://github.com/facebook/react-native/pull/56364 - Fixes https://github.com/facebook/react-native/pull/56365 - Fixes https://github.com/facebook/react-native/pull/56570 - Fixes https://github.com/facebook/react-native/pull/56393 - Fixes https://github.com/facebook/react-native/pull/56231 - Fixes https://github.com/facebook/react-native/pull/56741 Changelog: [General][Security] - Fix security vulnerabilities in `xmldom/xmldom`, `fast-xml-parser`, `yaml`, `fast-uri`, and `addressable` transitive dependencies Reviewed By: andrewdacenko Differential Revision: D107405946 fbshipit-source-id: f7af5573a418c973c57d582217ac8bf7f330ba4c
110 lines
2.5 KiB
Gemfile.lock
110 lines
2.5 KiB
Gemfile.lock
GEM
|
|
remote: https://rubygems.org/
|
|
specs:
|
|
CFPropertyList (3.0.6)
|
|
rexml
|
|
activesupport (7.0.8)
|
|
concurrent-ruby (~> 1.0, >= 1.0.2)
|
|
i18n (>= 1.6, < 2)
|
|
minitest (>= 5.1)
|
|
tzinfo (~> 2.0)
|
|
addressable (2.9.0)
|
|
public_suffix (>= 2.0.2, < 8.0)
|
|
algoliasearch (1.27.5)
|
|
httpclient (~> 2.8, >= 2.8.3)
|
|
json (>= 1.5.1)
|
|
atomos (0.1.3)
|
|
benchmark (0.4.0)
|
|
bigdecimal (3.1.9)
|
|
claide (1.1.0)
|
|
cocoapods (1.14.2)
|
|
addressable (~> 2.8)
|
|
claide (>= 1.0.2, < 2.0)
|
|
cocoapods-core (= 1.14.2)
|
|
cocoapods-deintegrate (>= 1.0.3, < 2.0)
|
|
cocoapods-downloader (>= 2.0)
|
|
cocoapods-plugins (>= 1.0.0, < 2.0)
|
|
cocoapods-search (>= 1.0.0, < 2.0)
|
|
cocoapods-trunk (>= 1.6.0, < 2.0)
|
|
cocoapods-try (>= 1.1.0, < 2.0)
|
|
colored2 (~> 3.1)
|
|
escape (~> 0.0.4)
|
|
fourflusher (>= 2.3.0, < 3.0)
|
|
gh_inspector (~> 1.0)
|
|
molinillo (~> 0.8.0)
|
|
nap (~> 1.0)
|
|
ruby-macho (>= 2.3.0, < 3.0)
|
|
xcodeproj (>= 1.23.0, < 2.0)
|
|
cocoapods-core (1.14.2)
|
|
activesupport (>= 5.0, < 8)
|
|
addressable (~> 2.8)
|
|
algoliasearch (~> 1.0)
|
|
concurrent-ruby (~> 1.1)
|
|
fuzzy_match (~> 2.0.4)
|
|
nap (~> 1.0)
|
|
netrc (~> 0.11)
|
|
public_suffix (~> 4.0)
|
|
typhoeus (~> 1.0)
|
|
cocoapods-deintegrate (1.0.5)
|
|
cocoapods-downloader (2.0)
|
|
cocoapods-plugins (1.0.0)
|
|
nap
|
|
cocoapods-search (1.0.1)
|
|
cocoapods-trunk (1.6.0)
|
|
nap (>= 0.8, < 2.0)
|
|
netrc (~> 0.11)
|
|
cocoapods-try (1.2.0)
|
|
colored2 (3.1.2)
|
|
concurrent-ruby (1.2.2)
|
|
escape (0.0.4)
|
|
ethon (0.16.0)
|
|
ffi (>= 1.15.0)
|
|
ffi (1.16.3)
|
|
fourflusher (2.3.1)
|
|
fuzzy_match (2.0.4)
|
|
gh_inspector (1.1.3)
|
|
httpclient (2.8.3)
|
|
i18n (1.14.1)
|
|
concurrent-ruby (~> 1.0)
|
|
json (2.6.3)
|
|
logger (1.6.5)
|
|
minitest (5.20.0)
|
|
molinillo (0.8.0)
|
|
mutex_m (0.3.0)
|
|
nanaimo (0.3.0)
|
|
nap (1.1.0)
|
|
netrc (0.11.0)
|
|
public_suffix (4.0.7)
|
|
rexml (3.2.6)
|
|
ruby-macho (2.5.1)
|
|
typhoeus (1.4.0)
|
|
ethon (>= 0.9.0)
|
|
tzinfo (2.0.6)
|
|
concurrent-ruby (~> 1.0)
|
|
xcodeproj (1.23.0)
|
|
CFPropertyList (>= 2.3.3, < 4.0)
|
|
atomos (~> 0.1.3)
|
|
claide (>= 1.0.2, < 2.0)
|
|
colored2 (~> 3.1)
|
|
nanaimo (~> 0.3.0)
|
|
rexml (~> 3.2.4)
|
|
|
|
PLATFORMS
|
|
ruby
|
|
|
|
DEPENDENCIES
|
|
activesupport (>= 6.1.7.5, < 7.1.0)
|
|
benchmark
|
|
bigdecimal
|
|
cocoapods (~> 1.13, != 1.15.1, != 1.15.0)
|
|
concurrent-ruby (<= 1.3.4)
|
|
logger
|
|
mutex_m
|
|
xcodeproj (< 1.26.0)
|
|
|
|
RUBY VERSION
|
|
ruby 3.2.0p0
|
|
|
|
BUNDLED WITH
|
|
2.4.12
|