[hietalajulius]

Summary

Addresses #7134 (comment)

TL;DR: remix-run/server-runtime (which is a downstream dependency of the example react native app), depends on cookie (version ^0.6.0) which has a vulnerability prior to 0.7.0, this PR adds a resolution to >=0.7.0. Also switches to using yarn instead of npm.

Test plan

before resolution

$ yarn audit
yarn audit v1.22.22
┌───────────────┬──────────────────────────────────────────────────────────────┐
│ low           │ cookie accepts cookie name, path, and domain with out of     │
│               │ bounds characters                                            │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Package       │ cookie                                                       │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Patched in    │ >=0.7.0                                                      │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Dependency of │ expo-router                                                  │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Path          │ expo-router > @expo/server > @remix-run/node >               │
│               │ @remix-run/server-runtime > cookie                           │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ More info     │ https://www.npmjs.com/advisories/1099846                     │
└───────────────┴──────────────────────────────────────────────────────────────┘
1 vulnerabilities found - Packages audited: 1067
Severity: 1 Low
✨  Done in 0.47s.

after resolution

$ yarn audit
yarn audit v1.22.22
0 vulnerabilities found - Packages audited: 1067
✨  Done in 0.43s.

[pytorch-bot]

🔗 Helpful Links

🧪 See artifacts and rendered test results at hud.pytorch.org/pr/pytorch/executorch/7218

• 📄 Preview Python docs built from this PR

Note: Links to docs will display an error until the docs builds have been completed.

✅ No Failures

As of commit 70b211e with merge base 63238ab ():
💚 Looks good so far! There are no failures yet. 💚

This comment was automatically generated by Dr. CI and updates every 15 minutes.

[hietalajulius]

@pytorchbot label "topic: not user facing"

[facebook-github-bot]

@shoumikhin has imported this pull request. If you are a Meta employee, you can view this diff on Phabricator.

[kirklandsign]

Hi @hietalajulius could you please update all packages to latest? Specifically, undici in deps to 6.21.1