[Bug]: Plugin depends on a vulnerable version of semver through the @expo/image-utils package

[davidlormor]

What happened?

This package currently depends on a vulnerable version of the semver package (CVE-2022-25883). It appears this is coming through an "outdated" version of the @expo/image-utils package.

npm audit returns the following output:

# npm audit report

semver  7.0.0 - 7.5.1
Severity: moderate
semver vulnerable to Regular Expression Denial of Service - https://github.com/advisories/GHSA-c2qf-rxjj-qqgw
fix available via `npm audit fix --force`
Will install onesignal-expo-plugin@1.1.2, which is a breaking change
node_modules/onesignal-expo-plugin/node_modules/semver
  @expo/image-utils  <=0.0.1-canary-20240109-93608d8 || 0.3.10-alpha.0 - 0.4.2
  Depends on vulnerable versions of semver
  node_modules/onesignal-expo-plugin/node_modules/@expo/image-utils
    onesignal-expo-plugin  >=1.2.0
    Depends on vulnerable versions of @expo/image-utils
    node_modules/onesignal-expo-plugin

3 moderate severity vulnerabilities

Running npm audit fix --force causes the plugin to be downgraded to a significantly older version, which is not ideal.

Steps to reproduce?

1. Create a new Expo app - `npx create-expo-app@latest`
2. Install the onesignal-expo-plugin package - `npx expo install onesignal-expo-plugin`
3. Run `npm audit` to review vulnerability details.

What did you expect to happen?

Installing the Expo plugin should not have any security vulnerabilities.

OneSignal Expo SDK version

2.0.3

Platform

iOS, Android

Relevant log output

# npm audit report

semver  7.0.0 - 7.5.1
Severity: moderate
semver vulnerable to Regular Expression Denial of Service - https://github.com/advisories/GHSA-c2qf-rxjj-qqgw
fix available via `npm audit fix --force`
Will install onesignal-expo-plugin@1.1.2, which is a breaking change
node_modules/onesignal-expo-plugin/node_modules/semver
  @expo/image-utils  <=0.0.1-canary-20240109-93608d8 || 0.3.10-alpha.0 - 0.4.2
  Depends on vulnerable versions of semver
  node_modules/onesignal-expo-plugin/node_modules/@expo/image-utils
    onesignal-expo-plugin  >=1.2.0
    Depends on vulnerable versions of @expo/image-utils
    node_modules/onesignal-expo-plugin

3 moderate severity vulnerabilities

To address all issues (including breaking changes), run:
  npm audit fix --force

Code of Conduct

• I agree to follow this project's Code of Conduct

[philiparpin]

Still seeing this, any updates?

[kovbe21]

Still unresolved, I see a PR on Draft about this, any updates?

[matthewtesimale]

I haven’t seen a fox for this anywhere. Any progress? @davidlormor?

Has anyone seen this be a breaking change if you left the vulnerability? What are the risks? And why has there not been a fix?

[roldengarm]

This is very concerning that this still has not been fixed! Any updates please @davidlormor ?

[adammatis]

Still an issue.

[dew-dr0p]

Still an issue, when would there be an update?

[jonhy751]

Still seeing this, any updates?

[fadi-george]

Thanks for the report, will look into fixing this asap.

[marco242424]

still an issue

[fadi-george]

I'll try to release a fix tomorrow (Feb 4th).

[fadi-george]

Please try version 2.0.4