Expo: auth0-js v7 security vulnerability

[knod]

I've gotten a warning from github that a package required by package-lock.json, auth0-js, had a security vulnerability at version 7. I found it required in the xdl package:

"xdl": {
      ...
      "requires": {
        ...
        "auth0-js": "7.6.1",

Github said:

package-lock.json update suggested:
auth0-js ~> 8.12.0

What can I do about this?

[brentvatne]

hi there. this doesn't impact your app, it only impacts servers that use auth0-js, which xdl does not. nonetheless we will update auth0-js. thanks github for spamming everybody with this senseless notification ;)

[towfiqi]

so how do we fix this?

[fxfactorial]

@towfiqi It doesn't affect you as an app developer.