[Bug]: Plugin depends on a vulnerable version of semver through the @expo/image-utils package

[davidlormor]

What happened?

This package currently depends on a vulnerable version of the semver package (CVE-2022-25883). It appears this is coming through an "outdated" version of the @expo/image-utils package.

npm audit returns the following output:

# npm audit report

semver  7.0.0 - 7.5.1
Severity: moderate
semver vulnerable to Regular Expression Denial of Service - https://github.com/advisories/GHSA-c2qf-rxjj-qqgw
fix available via `npm audit fix --force`
Will install [email protected], which is a breaking change
node_modules/onesignal-expo-plugin/node_modules/semver
  @expo/image-utils  <=0.0.1-canary-20240109-93608d8 || 0.3.10-alpha.0 - 0.4.2
  Depends on vulnerable versions of semver
  node_modules/onesignal-expo-plugin/node_modules/@expo/image-utils
    onesignal-expo-plugin  >=1.2.0
    Depends on vulnerable versions of @expo/image-utils
    node_modules/onesignal-expo-plugin

3 moderate severity vulnerabilities

Running npm audit fix --force causes the plugin to be downgraded to a significantly older version, which is not ideal.

Steps to reproduce?

1. Create a new Expo app - `npx create-expo-app@latest`
2. Install the onesignal-expo-plugin package - `npx expo install onesignal-expo-plugin`
3. Run `npm audit` to review vulnerability details.

What did you expect to happen?

Installing the Expo plugin should not have any security vulnerabilities.

OneSignal Expo SDK version

2.0.3

Platform

iOS, Android

Relevant log output

# npm audit report

semver  7.0.0 - 7.5.1
Severity: moderate
semver vulnerable to Regular Expression Denial of Service - https://github.com/advisories/GHSA-c2qf-rxjj-qqgw
fix available via `npm audit fix --force`
Will install [email protected], which is a breaking change
node_modules/onesignal-expo-plugin/node_modules/semver
  @expo/image-utils  <=0.0.1-canary-20240109-93608d8 || 0.3.10-alpha.0 - 0.4.2
  Depends on vulnerable versions of semver
  node_modules/onesignal-expo-plugin/node_modules/@expo/image-utils
    onesignal-expo-plugin  >=1.2.0
    Depends on vulnerable versions of @expo/image-utils
    node_modules/onesignal-expo-plugin

3 moderate severity vulnerabilities

To address all issues (including breaking changes), run:
  npm audit fix --force

Code of Conduct

• I agree to follow this project's Code of Conduct

[philiparpin]

Still seeing this, any updates?