Upgrade to code-push@2.1.5+ to fix DoS zip attack

[gregwym]

This has been addressed by code-push in microsoft/code-push@c6a6f9f. RN-code-push need to catch up on it 😄.

Steps to Reproduce

1. Install react-native-code-push@5.3.0
2. Run nsp check

Expected Behavior

No vulnerability found.

Actual Behavior

(+) 1 vulnerability found
┌────────────┬────────────────────────────────────────────────────────────────────┐
│            │ Large gzip Denial of Service                                       │
├────────────┼────────────────────────────────────────────────────────────────────┤
│ Name       │ superagent                                                         │
├────────────┼────────────────────────────────────────────────────────────────────┤
│ CVSS       │ 3.7 (Low)                                                          │
├────────────┼────────────────────────────────────────────────────────────────────┤
│ Installed  │ 1.8.5                                                              │
├────────────┼────────────────────────────────────────────────────────────────────┤
│ Vulnerable │ <3.7.0                                                             │
├────────────┼────────────────────────────────────────────────────────────────────┤
│ Patched    │ >=3.7.0                                                            │
├────────────┼────────────────────────────────────────────────────────────────────┤
│ Path       │ test-react-native-code-push@0.1.0 > react-native-code-push@5.3.0 > │
│            │ code-push@2.0.4 > superagent@1.8.5                                 │
├────────────┼────────────────────────────────────────────────────────────────────┤
│ More Info  │ https://nodesecurity.io/advisories/479                             │
└────────────┴────────────────────────────────────────────────────────────────────┘

Environment

• react-native-code-push version: 5.3.0
• react-native version: 0.51.0

[itoys]

Hi @gregwym
Thanks for pointing us!

[itoys]

react-native-code-push@5.3.2 has been released

[gregwym]

Thank you for the timely fix!