Skip to content

Bump react-native from 0.71.7 to 0.74.1 in /GraphRNSample - #174

Closed
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/GraphRNSample/react-native-0.74.1
Closed

Bump react-native from 0.71.7 to 0.74.1 in /GraphRNSample#174
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/GraphRNSample/react-native-0.74.1

Bump react-native from 0.71.7 to 0.74.1 in /GraphRNSample

8f17ada
Select commit
Loading
Failed to load commit list.
Microsoft GitHub Policy Service / GitOps/AdvancedSecurity failed Oct 27, 2026 in 0s

Dependency Review

Dependency review detected vulnerable

Details

Dependency review summary

We have found 26 vulnerable package(s).

Vulnerability

Vulnerabilities were filtered by minimum severity Moderate.

Dependency File Name Version Vulnerability Severity
shell-quote GraphRNSample/package-lock.json 1.8.1 shell-quote quote() does not escape newlines in object .op values Critical
shell-quote: Quadratic-complexity Denial of Service in `parse()` (CWE-407) High
fast-xml-parser GraphRNSample/package-lock.json 4.3.6 fast-xml-parser has an entity encoding bypass via regex injection in DOCTYPE entity names Critical
fast-xml-parser vulnerable to ReDOS at currency parsing High
fast-xml-parser affected by DoS through entity expansion in DOCTYPE (no expansion limit) High
fast-xml-parser affected by numeric entity expansion bypassing all entity expansion limits (incomplete fix for CVE-2026-26278) High
Entity Expansion Limits Bypassed When Set to Zero Due to JavaScript Falsy Evaluation in fast-xml-parser Moderate
fast-xml-parser XMLBuilder: XML Comment and CDATA Injection via Unescaped Delimiters Moderate
fast-xml-parser has stack overflow in XMLBuilder with preserveOrder Low
cross-spawn GraphRNSample/package-lock.json 7.0.3 Regular Expression Denial of Service (ReDoS) in cross-spawn High
image-size GraphRNSample/package-lock.json 1.1.1 image-size Denial of Service via Infinite Loop during Image Processing High
image-size: ICNS parser allows denial of service through an infinite loop High
joi GraphRNSample/package-lock.json 17.13.1 joi: Quadratic regular-expression backtracking in `Joi.string().isoDate()` High
joi has an uncaught RangeError on deeply nested input through recursive `link()` schemas Moderate
joi messages compilation allows prototype replacement through __proto__ error codes Moderate
joi: object().rename() with a template target can set the validated object's prototype Low
joi: Prototype pollution via a `__proto__` language key in custom messages Low
node-forge GraphRNSample/package-lock.json 1.3.1 node-forge has an Interpretation Conflict vulnerability via its ASN.1 Validator Desynchronization High
node-forge has ASN.1 Unbounded Recursion High
Forge has Denial of Service via Infinite Loop in BigInteger.modInverse() with Zero Input High
Forge has signature forgery in RSA-PKCS due to ASN.1 extra field High
Forge has signature forgery in Ed25519 due to missing S > L check High
Forge has a basicConstraints bypass in its certificate chain verification (RFC 5280 violation) High
node-forge RSA PKCS#1 v1.5 signature verification accepts extra nested DigestAlgorithm elements High
node-forge is vulnerable to ASN.1 OID Integer Truncation Moderate
yaml GraphRNSample/package-lock.json 2.4.2 yaml is vulnerable to Stack Overflow via deeply nested YAML collections Moderate
View more details on Microsoft GitHub Policy Service