Dependency security vulnerabilities

[Korbut-Yura]

I'm using the last versions of Firebase products for my React-Native project. According to SAST testing, we've found some dependency security vulnerabilities in pods, which are used as sub-dependencies Firebase. Is there any information about fixing these vulnerabilities or updating sub-dependencies?
SAST report added in attachments
vulnerabilities report.pdf

[mikehardy]

We will happily merge PRs to update dependencies, but in general are up to date.
You provide no information on what version of react-native-firebase is in use or the version of firebase-ios-sdk so this is not actionable.

[Korbut-Yura]

I'm using

• "@react-native-firebase/analytics": "10.5.1",
  

• "@react-native-firebase/app": "10.5.0",
  

• "@react-native-firebase/auth": "10.5.1",
  

• "@react-native-firebase/crashlytics": "10.5.1",
  

• "@react-native-firebase/dynamic-links": "10.5.1",
  

• "@react-native-firebase/firestore": "10.5.1",
  

• "@react-native-firebase/functions": "10.5.1",
  

• "@react-native-firebase/remote-config": "10.5.1",
  

• "@react-native-firebase/storage": "10.5.1",
  

Vulnerabilities are sub-dependencies of Firebase/Firestore, Firebase/Analytics pods

[mikehardy]

If they are sub-dependencies of Firebase pods, you should pursue this in the firebase-ios-sdk repo https://github.com/firebase/firebase-ios-sdk
Do make sure you are using the most up to date versions, 10.5.x is out of date, and in fact they just released firebase-ios-sdk v7.7.0 yesterday while our version for latest release is still 7.6.0

react-native-firebase/packages/app/package.json

Line 65 in e173954

"firebase": "~> 7.6.0"