Skip to content

[Snyk] Fix for 5 vulnerabilities #771

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
revan-zhang wants to merge 1 commit into
base: onekey
Choose a base branch
from
Open

[Snyk] Fix for 5 vulnerabilities #771

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
8 changes: 4 additions & 4 deletions packages/connect-examples/expo-example/package.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -14,7 +14,7 @@
"@alephium/web3-wallet": "^1.5.2",
"@ckb-lumos/helpers": "^0.23.0",
"@expo/webpack-config": "^19.0.1",
"@nexajs/address": "^23.5.15",
"@nexajs/address": "^24.9.20",
"@nexajs/script": "^23.5.15",
"@noble/ed25519": "^2.1.0",
"@noble/hashes": "^1.3.3",
Expand Down Expand Up @@ -47,14 +47,14 @@
"burnt": "^0.13.0",
"compressorjs": "^1.1.1",
"elliptic": "^6.5.5",
"expo": "^50.0.20",
"expo": "^55.0.0",
Copy link
Copy Markdown
Contributor

@devin-ai-integration devin-ai-integration Bot Apr 23, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🔴 Incomplete Expo SDK upgrade: expo bumped to ^55 while react-native, react, and most expo- packages remain at Expo 50-compatible versions*

This Snyk-automated PR bumps expo from ^50.0.20 to ^55.0.0 to fix transitive vulnerabilities in uuid and xmldom, but it does not update the tightly-coupled companion packages. Expo SDK versions are architecturally bound to specific React Native versions (e.g., SDK 50 → RN 0.73), yet react-native remains hard-pinned at 0.73.7 and react at 18.2.0. Additionally, multiple expo-* satellite packages (expo-clipboard: ~5.0.0, expo-document-picker: ~11.10.1, expo-image-manipulator: ~11.8.0, expo-image-picker: ~14.7.1, expo-localization: ~14.8.4, expo-status-bar: ~1.11.1) are still at their Expo SDK 50-compatible versions. The PR itself demonstrates awareness of the new versioning scheme by updating expo-linking to ~55.0.0 (aligned with SDK 55), which makes the inconsistency with the other unchanged expo-* packages even more apparent. This will cause dependency resolution failures or runtime incompatibilities when building the example app.

Unchanged companion packages still at Expo 50 versions
  • react-native: 0.73.7 (pinned, Expo 50 era)
  • react: 18.2.0 (pinned)
  • expo-clipboard: ~5.0.0
  • expo-document-picker: ~11.10.1
  • expo-image-manipulator: ~11.8.0
  • expo-image-picker: ~14.7.1
  • expo-localization: ~14.8.4
  • expo-status-bar: ~1.11.1
  • @expo/webpack-config: ^19.0.1
  • react-native-reanimated: ~3.6.2
  • react-native-safe-area-context: 4.8.2
  • react-native-screens: ~3.29.0
  • babel-preset-expo (transitive via yarn.lock: ~10.0.2)
Prompt for agents 
The Snyk bot bumped expo from ^50 to ^55 to fix transitive vulnerabilities (uuid, xmldom), but Expo SDK upgrades require upgrading the entire ecosystem in lockstep. The react-native version (0.73.7), react version (18.2.0), and all expo-* satellite packages (expo-clipboard, expo-document-picker, expo-image-manipulator, expo-image-picker, expo-localization, expo-status-bar, etc.) must be updated to their Expo SDK 55-compatible versions. Similarly, react-native-reanimated, react-native-safe-area-context, react-native-screens, and @expo/webpack-config need compatible versions.

The recommended approach is to either:
1. Run npx expo install --fix to automatically resolve all Expo-compatible package versions after updating expo, OR
2. Reject this automated PR and instead perform a proper Expo SDK upgrade using the official upgrade guide (npx expo upgrade), OR
3. Find an alternative way to address the uuid/xmldom vulnerabilities without upgrading the Expo SDK major version (e.g., using resolutions/overrides in package.json to pin the transitive dependencies to patched versions).

Option 3 is likely the least disruptive approach for an example app.
Open in Devin Review

Was this helpful? React with 👍 or 👎 to provide feedback.

"expo-clipboard": "~5.0.0",
"expo-document-picker": "~11.10.1",
"expo-image-manipulator": "~11.8.0",
"expo-image-picker": "~14.7.1",
"expo-linking": "~6.2.2",
"expo-linking": "~55.0.0",
"expo-localization": "~14.8.4",
"expo-splash-screen": "~0.26.5",
"expo-splash-screen": "~0.30.4",
"expo-status-bar": "~1.11.1",
"jotai": "^2.5.2",
"levelup": "^5.1.1",
Expand Down
Loading