Upgrade metro to v0.58.0 (fix inherited mem vulnerability)

[sethahrenbach]

Current dependency path contains os-locale v2.1.0, which contains mem v1.1.0

Dependency path:
│ Path @react-native-community/cli > metro > yargs > os-locale > mem

Results in:

https://npmjs.com/advisories/1084

Overview

Versions of mem prior to 4.0.0 are vulnerable to Denial of Service (DoS). The package fails to remove old values from the cache even after a value passes its maxAge property. This may allow attackers to exhaust the system's memory if they are able to abuse the application logging.

Solution:

metro v0.58.0 upgrades yargs from ^9.0.0 to ^14.2.0:

Diff metro v0.57.0 | metro v0.58.0

yargs 14.2.0 removes os-locale from package.json:

Diff yargs v9.0.1 | yargs v14.2.0:

[itsgauravjain22]

Please resolve this. Following is output of npm audit:

                       === npm audit security report ===


                                 Manual Review
             Some vulnerabilities require your attention to resolve

          Visit https://go.npm.me/audit-guide for additional guidance


  Low             Denial of Service

  Package         mem

  Patched in      >=4.0.0

  Dependency of   react-native

  Path            react-native > @react-native-community/cli > metro >
                  metro-inspector-proxy > yargs > os-locale > mem

  More info       https://npmjs.com/advisories/1084


  Low             Denial of Service

  Package         mem

  Patched in      >=4.0.0

  Dependency of   react-native

  Path            react-native > @react-native-community/cli > metro-config >
                  metro > metro-inspector-proxy > yargs > os-locale > mem

  More info       https://npmjs.com/advisories/1084


  Low             Denial of Service

  Package         mem

  Patched in      >=4.0.0

  Dependency of   react-native

  Path            react-native > @react-native-community/cli > metro > yargs >
                  os-locale > mem

  More info       https://npmjs.com/advisories/1084


  Low             Denial of Service

  Package         mem

  Patched in      >=4.0.0

  Dependency of   react-native

  Path            react-native > @react-native-community/cli > metro-config >
                  metro > yargs > os-locale > mem

  More info       https://npmjs.com/advisories/1084

found 4 low severity vulnerabilities in 954944 scanned packages
  4 vulnerabilities require manual review. See the full report for details.