Vulnerability: Denial of Service ('ws' and 'mem') and Memory Leak ('inquirer')

We use Sourceclear (sourceclear.com) to scan our app code and the following vulnerabilities were reported:

1. Denial of Service (DoS) for ws(v1.1.5)

   Transitive Dependency:

   This issue was fixed in version 3.3.1 of ws. That version is currently considered safe, we suggest that you upgrade to the fixed version.

   Dependency Graph: react-native 0.60.3 > @react-native-community/cli 2.9.0 > ws 1.1.5

2. Denial of Service (DoS) for mem(v1.1.0)

   Transitive Dependency:

   This issue was fixed in version 4.0.0 of mem. That version is currently considered safe, we suggest that you upgrade to the fixed version.

   Dependency Graph: react-native 0.60.3 > @react-native-community/cli 2.9.0 > metro 0.54.1 > metro-inspector-proxy 0.54.1 > yargs 9.0.1 > os-locale 2.1.0 > mem 1.1.0

3. Memory Leak for inquirer(v3.3.0)

   Transitive Dependency:

   We do not have a confirmed fix for this issue yet. However, newer versions of the library have been released. We suggest that you upgrade to 6.5.0, which is considered safe.

   Dependency Graph: react-native 0.60.3 > @react-native-community/cli 2.9.0 > inquirer 3.3.0

React Native version: 0.60.3

Note: library versions of ws, mem and inquirer that come with the latest RN release (v0.61.5) are also not at the recommended versions

Steps To Reproduce

1. Need to install and activate licensed account of SourceClear
2. scan repo code using cli or other supported mediums (for example: srcclr scan --url https://github.com/srcclr/example-ruby)

Hoping this is the ideal place to be reporting these (Please redirect if I’m wrong) And if I am at the right place, please do acknowledge and confirm timelines if this seems actionable

Thank You

[Ananthakr]

@gabrielmoncea ws issue is still showing on RN 0.63.2

[gabimoncha]

@ivgraai does it show on RN 0.63.2 ?