Critical security vulnerability due to crypto-js on v6.7.1

[Elkin Torres]

What react-native version are you using?
0.72.5

What react-native-pdf version are you using?
6.7.1

What platform does your issue occur on? (android/ios/both)
both

Critical security vulnerability reported by dependabot because of crypto-js v3.2.0 used on this library. According to the report, it was patched on v4.2.0.

[Bo Yuan]

Is there some updates about this security issue? it's encountered by us too.
thank you

[Elkin Torres]

I had to force the newer version, in our package.json file, I did a few tests and the upgrade seems safe

[bentleyAl]

@elkinjosetm how did you manage to do this?

[Elkin Torres]

@bentleyAl by forcing pnpm (the package manager that we use) to use it. Yarn and npm provide a way for you to do just that.

# package.json
...
"pnpm": {
  "overrides": {
    "crypto-js": "^4.2.0"
  }
}

[bentleyAl]

@elkinjosetm Worked like a charm! Was not aware of npm overrides. Thank you!

[Abhi M]

If you are using Yarn, add "resolutions" in the package.json

# package.json
...
"resolutions": {
  "crypto-js": "^4.2.0"
},

[wonday]

Have bump to 6.7.2 and included this update.

[Sheriff Oladimeji]

@elkinjosetm Worked like a charm! Was not aware of npm overrides. Thank you!

How were you able to use in it in npm , still getting errors