┌───────────────┬──────────────────────────────────────────────────────────────┐
│ Low │ Prototype Pollution │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Package │ lodash │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Patched in │ >=4.17.5 │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Dependency of │ react-native-cached-image │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Path │ react-native-cached-image > lodash │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ More info │ https://npmjs.com/advisories/577 │
└───────────────┴──────────────────────────────────────────────────────────────┘
found 11 vulnerabilities (2 low, 8 moderate, 1 high) in 26316 scanned packages
11 vulnerabilities require manual review. See the full report for details.
This shows up when I try to npm install
, and all of them required manual review. I've tried to visit this to check for more info and apparently it's because my lodash
is of version 4.17.4
. So I've then run npm install --save lodash@4.17.5
and checked my package.json
to make sure it's reflecting correctly.
However, it seems the vulnerabilities is still there. Wondering if I fix it the wrong way?
As per requested, the body of package.json
"dependencies": {
"lodash": "^4.17.5",
}
package.json
what do you have forlodash
in dependencies? Post the actual string in the question body please.react-native-cached-image
that lib has that issue since it probably has dependency on that older version of lodash no? Can you see in that lib what does it say in itspackage.json
?4.17.4
just checked in their github @ github.com/kfiroo/react-native-cached-image/blob/master/…