CVE-2024-21538: dependency child-process-promise relies on a version of cross-spawn that is not secure

[mikejurka]

What happened?

I got this notification from Github's dependabot:
CVE-2024-21538
detox@20.25.5 requires cross-spawn@^4.0.2 via child-process-promise@2.2.1

= 7.0.0, < 7.0.5
7.0.5
Versions of the package cross-spawn before 7.0.5 are vulnerable to Regular Expression Denial of Service (ReDoS) due to improper input sanitization. An attacker can increase the CPU usage and crash the program by crafting a very large and well crafted string.

What was the expected behaviour?

I expect that the version of cross-spawn depended on is 7.05 or newer

Was it tested on latest Detox?

• I have tested this issue on the latest Detox release and it still reproduces.

Help us reproduce this issue!

No response

In what environment did this happen?

Detox version:
React Native version:
Has Fabric (React Native's new rendering system) enabled: (yes/no)
Node version:
Test-runner (select one): jest / other

Detox logs

Detox logs

paste logs here!

Device logs

Device logs

paste logs here!

More data, please!

No response