nested packaged (with lower package version) of react native (by expo) are vulnerable to security.

[VishalArora7774]

We are using expo generated project with expo version 33 pointing to react-native version 0.58.9

There are 3 packages inquirer, ws and mem (with low package version) which are dependencies of react-native directly or indirectly, are vulnerable to security. We tried to upgrade these packages but they are still causing same issue (vulnerable to security.). We have tried this with expo latest version 35. Even We tried to use react-native latest version i.e. 0.61.2 directly without expo but the package's version is still the same. For now, to bypass, this We have tried yarn resolutions but this issue is still present. Can anyone please tell us how we can overcome this issue without resolutions

The more info about available issues with these packages are

https://www.sourceclear.com/vulnerability-database/security/sca/vulnerability/sid-5397/summary
https://www.sourceclear.com/vulnerability-database/security/sca/vulnerability/sid-7405/summary
https://www.sourceclear.com/vulnerability-database/security/sca/vulnerability/sid-20567/summary

Expo Version: 33
React Native version: 0.59.8

Steps To Reproduce

1. Open yarn.lock file
2. search for inquirer, mem and ws. You will find multiple packages of ws, yargs (having mem package) and inquirer. if you try to upgrade then with yarn upgrade package-name It won't upgrade these packages instead a same package with higher verison

Describe what you expected to happen:

We were expecting that nested packages will update if I try to run yarn upgrade command or yarn.

Snack, code example, screenshot, or link to a repository:
For now, I have added resolutions in package.json file
"resolutions": { "yargs": ">= 13.2.2", "inquirer": ">= 6.4.1", "ws": ">= 5.2.0" }

[stale]

Hey there, it looks like there has been no activity on this issue recently. Has the issue been fixed, or does it still require the community's attention? This issue may be closed if no further activity occurs. You may also label this issue as a "Discussion" or add it to the "Backlog" and I will leave it open. Thank you for your contributions.

[stale]

Closing this issue after a prolonged period of inactivity. If this issue is still present in the latest release, please feel free to create a new issue with up-to-date information.