[Snyk] Security upgrade react-scripts from 1.1.4 to 5.0.0 #48

Omrisnyk · 2023-11-27T21:24:16Z

This PR was automatically created by Snyk using the credentials of a real user.

Snyk has created this PR to fix one or more vulnerable packages in the `npm` dependencies of this project.

Changes included in this PR

Changes to the following files to upgrade the vulnerable dependencies to a fixed version:
- package.json
- package-lock.json

Vulnerabilities that will be fixed

With an upgrade:

Priority Score (*)	Issue	Breaking Change	Exploit Maturity
165/1000 Why? Confidentiality impact: High, Integrity impact: High, Availability impact: High, Scope: Unchanged, Exploit Maturity: No data, User Interaction (UI): None, Privileges Required (PR): None, Attack Complexity: High, Attack Vector: Network, EPSS: 0.00303, Social Trends: No, Days since published: 1229, Reachable: No, Transitive dependency: Yes, Is Malicious: No, Business Criticality: High, Provider Urgency: High, Package Popularity Score: 99, Impact: 9.79, Likelihood: 1.68, Score Version: V5	Prototype Pollution SNYK-JS-AJV-584908	Yes	No Known Exploit
159/1000 Why? Confidentiality impact: None, Integrity impact: None, Availability impact: High, Scope: Unchanged, Exploit Maturity: Proof of Concept, User Interaction (UI): None, Privileges Required (PR): None, Attack Complexity: Low, Attack Vector: Network, EPSS: 0.00126, Social Trends: No, Days since published: 831, Reachable: No, Transitive dependency: Yes, Is Malicious: No, Business Criticality: High, Provider Urgency: High, Package Popularity Score: 99, Impact: 5.99, Likelihood: 2.64, Score Version: V5	Regular Expression Denial of Service (ReDoS) SNYK-JS-ANSIHTML-1296849	Yes	Proof of Concept
159/1000 Why? Confidentiality impact: None, Integrity impact: None, Availability impact: High, Scope: Unchanged, Exploit Maturity: Proof of Concept, User Interaction (UI): None, Privileges Required (PR): None, Attack Complexity: Low, Attack Vector: Network, EPSS: 0.00299, Social Trends: No, Days since published: 806, Reachable: No, Transitive dependency: Yes, Is Malicious: No, Business Criticality: High, Provider Urgency: High, Package Popularity Score: 99, Impact: 5.99, Likelihood: 2.65, Score Version: V5	Regular Expression Denial of Service (ReDoS) SNYK-JS-ANSIREGEX-1583908	Yes	Proof of Concept
160/1000 Why? Confidentiality impact: High, Integrity impact: High, Availability impact: High, Scope: Changed, Exploit Maturity: No data, User Interaction (UI): None, Privileges Required (PR): None, Attack Complexity: Low, Attack Vector: Local, EPSS: 0.0006, Social Trends: No, Days since published: 45, Reachable: No, Transitive dependency: Yes, Is Malicious: No, Business Criticality: High, Provider Urgency: Critical, Package Popularity Score: 99, Impact: 10.1, Likelihood: 1.58, Score Version: V5	Incomplete List of Disallowed Inputs SNYK-JS-BABELTRAVERSE-5962463	Yes	No Known Exploit
63/1000 Why? Confidentiality impact: None, Integrity impact: None, Availability impact: Low, Scope: Unchanged, Exploit Maturity: Proof of Concept, User Interaction (UI): None, Privileges Required (PR): None, Attack Complexity: Low, Attack Vector: Network, EPSS: 0.00166, Social Trends: No, Days since published: 943, Reachable: No, Transitive dependency: Yes, Is Malicious: No, Business Criticality: High, Provider Urgency: Medium, Package Popularity Score: 99, Impact: 2.35, Likelihood: 2.64, Score Version: V5	Regular Expression Denial of Service (ReDoS) SNYK-JS-BROWSERSLIST-1090194	Yes	Proof of Concept
63/1000 Why? Confidentiality impact: None, Integrity impact: None, Availability impact: Low, Scope: Unchanged, Exploit Maturity: Proof of Concept, User Interaction (UI): None, Privileges Required (PR): None, Attack Complexity: Low, Attack Vector: Network, EPSS: 0.00166, Social Trends: No, Days since published: 990, Reachable: No, Transitive dependency: Yes, Is Malicious: No, Business Criticality: High, Provider Urgency: Medium, Package Popularity Score: 99, Impact: 2.35, Likelihood: 2.64, Score Version: V5	Regular Expression Denial of Service (ReDoS) SNYK-JS-COLORSTRING-1082939	Yes	Proof of Concept
169/1000 Why? Confidentiality impact: None, Integrity impact: None, Availability impact: High, Scope: Unchanged, Exploit Maturity: Proof of Concept, User Interaction (UI): None, Privileges Required (PR): None, Attack Complexity: Low, Attack Vector: Network, EPSS: 0.00109, Social Trends: No, Days since published: 364, Reachable: No, Transitive dependency: Yes, Is Malicious: No, Business Criticality: High, Provider Urgency: High, Package Popularity Score: 99, Impact: 5.99, Likelihood: 2.81, Score Version: V5	Denial of Service (DoS) SNYK-JS-DECODEURICOMPONENT-3149970	Yes	Proof of Concept
63/1000 Why? Confidentiality impact: None, Integrity impact: None, Availability impact: Low, Scope: Unchanged, Exploit Maturity: Proof of Concept, User Interaction (UI): None, Privileges Required (PR): None, Attack Complexity: Low, Attack Vector: Network, EPSS: 0.0107, Social Trends: No, Days since published: 1049, Reachable: No, Transitive dependency: Yes, Is Malicious: No, Business Criticality: High, Provider Urgency: Medium, Package Popularity Score: 99, Impact: 2.35, Likelihood: 2.67, Score Version: V5	Regular Expression Denial of Service (ReDoS) SNYK-JS-GLOBPARENT-1016905	Yes	Proof of Concept
61/1000 Why? Confidentiality impact: Low, Integrity impact: Low, Availability impact: None, Scope: Unchanged, Exploit Maturity: No data, User Interaction (UI): Required, Privileges Required (PR): None, Attack Complexity: Low, Attack Vector: Network, EPSS: 0.00063, Social Trends: No, Days since published: 526, Reachable: No, Transitive dependency: Yes, Is Malicious: No, Business Criticality: High, Provider Urgency: Medium, Package Popularity Score: 99, Impact: 4.19, Likelihood: 1.45, Score Version: V5	Open Redirect SNYK-JS-GOT-2932019	Yes	No Known Exploit
63/1000 Why? Confidentiality impact: None, Integrity impact: None, Availability impact: Low, Scope: Unchanged, Exploit Maturity: Proof of Concept, User Interaction (UI): None, Privileges Required (PR): None, Attack Complexity: Low, Attack Vector: Network, EPSS: 0.00049, Social Trends: No, Days since published: 390, Reachable: No, Transitive dependency: Yes, Is Malicious: No, Business Criticality: High, Provider Urgency: Medium, Package Popularity Score: 99, Impact: 2.35, Likelihood: 2.64, Score Version: V5	Regular Expression Denial of Service (ReDoS) SNYK-JS-HTMLMINIFIER-3091181	Yes	Proof of Concept
35/1000 Why? Confidentiality impact: Low, Integrity impact: None, Availability impact: None, Scope: Unchanged, Exploit Maturity: No data, User Interaction (UI): Required, Privileges Required (PR): None, Attack Complexity: Low, Attack Vector: Network, EPSS: 0.01055, Social Trends: No, Days since published: 697, Reachable: No, Transitive dependency: Yes, Is Malicious: No, Business Criticality: High, Provider Urgency: Medium, Package Popularity Score: 99, Impact: 2.35, Likelihood: 1.47, Score Version: V5	Reverse Tabnabbing SNYK-JS-ISTANBULREPORTS-2328088	Yes	No Known Exploit
190/1000 Why? Confidentiality impact: Low, Integrity impact: Low, Availability impact: High, Scope: Unchanged, Exploit Maturity: Proof of Concept, User Interaction (UI): None, Privileges Required (PR): Low, Attack Complexity: High, Attack Vector: Network, EPSS: 0.00214, Social Trends: No, Days since published: 337, Reachable: No, Transitive dependency: Yes, Is Malicious: No, Business Criticality: High, Provider Urgency: Medium, Package Popularity Score: 99, Impact: 7.84, Likelihood: 2.42, Score Version: V5	Prototype Pollution SNYK-JS-JSON5-3182856	Yes	Proof of Concept
57/1000 Why? Confidentiality impact: Low, Integrity impact: None, Availability impact: None, Scope: Unchanged, Exploit Maturity: Proof of Concept, User Interaction (UI): None, Privileges Required (PR): None, Attack Complexity: High, Attack Vector: Network, EPSS: 0.00091, Social Trends: No, Days since published: 1408, Reachable: No, Transitive dependency: Yes, Is Malicious: No, Business Criticality: High, Provider Urgency: Low, Package Popularity Score: 99, Impact: 2.35, Likelihood: 2.42, Score Version: V5	Validation Bypass SNYK-JS-KINDOF-537849	Yes	Proof of Concept
239/1000 Why? Confidentiality impact: High, Integrity impact: High, Availability impact: High, Scope: Unchanged, Exploit Maturity: Proof of Concept, User Interaction (UI): None, Privileges Required (PR): High, Attack Complexity: Low, Attack Vector: Network, EPSS: 0.00606, Social Trends: No, Days since published: 1015, Reachable: No, Transitive dependency: Yes, Is Malicious: No, Business Criticality: High, Provider Urgency: High, Package Popularity Score: 99, Impact: 9.79, Likelihood: 2.43, Score Version: V5	Command Injection SNYK-JS-LODASHTEMPLATE-1088054	Yes	Proof of Concept
115/1000 Why? Confidentiality impact: None, Integrity impact: None, Availability impact: High, Scope: Unchanged, Exploit Maturity: No data, User Interaction (UI): None, Privileges Required (PR): None, Attack Complexity: Low, Attack Vector: Network, EPSS: 0.01055, Social Trends: No, Days since published: 1106, Reachable: No, Transitive dependency: Yes, Is Malicious: No, Business Criticality: High, Provider Urgency: High, Package Popularity Score: 99, Impact: 5.99, Likelihood: 1.92, Score Version: V5	Prototype Pollution SNYK-JS-MERGE-1040469	Yes	No Known Exploit
149/1000 Why? Confidentiality impact: Low, Integrity impact: Low, Availability impact: Low, Scope: Unchanged, Exploit Maturity: Proof of Concept, User Interaction (UI): None, Privileges Required (PR): None, Attack Complexity: Low, Attack Vector: Network, EPSS: 0.00248, Social Trends: No, Days since published: 1007, Reachable: No, Transitive dependency: Yes, Is Malicious: No, Business Criticality: High, Provider Urgency: High, Package Popularity Score: 99, Impact: 5.62, Likelihood: 2.65, Score Version: V5	Prototype Pollution SNYK-JS-MERGE-1042987	Yes	Proof of Concept
150/1000 Why? Confidentiality impact: Low, Integrity impact: Low, Availability impact: Low, Scope: Unchanged, Exploit Maturity: Proof of Concept, User Interaction (UI): None, Privileges Required (PR): None, Attack Complexity: Low, Attack Vector: Network, EPSS: 0.00522, Social Trends: No, Days since published: 1621, Reachable: No, Transitive dependency: Yes, Is Malicious: No, Business Criticality: High, Provider Urgency: High, Package Popularity Score: 99, Impact: 5.62, Likelihood: 2.65, Score Version: V5	Prototype Pollution SNYK-JS-MIXINDEEP-450212	Yes	Proof of Concept
63/1000 Why? Confidentiality impact: None, Integrity impact: Low, Availability impact: None, Scope: Unchanged, Exploit Maturity: Proof of Concept, User Interaction (UI): None, Privileges Required (PR): None, Attack Complexity: Low, Attack Vector: Network, EPSS: 0.00066, Social Trends: No, Days since published: 690, Reachable: No, Transitive dependency: Yes, Is Malicious: No, Business Criticality: High, Provider Urgency: Medium, Package Popularity Score: 99, Impact: 2.35, Likelihood: 2.64, Score Version: V5	Open Redirect SNYK-JS-NODEFORGE-2330875	Yes	Proof of Concept
99/1000 Why? Confidentiality impact: Low, Integrity impact: Low, Availability impact: Low, Scope: Unchanged, Exploit Maturity: No data, User Interaction (UI): None, Privileges Required (PR): Low, Attack Complexity: Low, Attack Vector: Network, EPSS: 0.01055, Social Trends: No, Days since published: 687, Reachable: No, Transitive dependency: Yes, Is Malicious: No, Business Criticality: High, Provider Urgency: Medium, Package Popularity Score: 99, Impact: 5.62, Likelihood: 1.75, Score Version: V5	Prototype Pollution SNYK-JS-NODEFORGE-2331908	Yes	No Known Exploit
94/1000 Why? Confidentiality impact: Low, Integrity impact: Low, Availability impact: Low, Scope: Unchanged, Exploit Maturity: No data, User Interaction (UI): None, Privileges Required (PR): None, Attack Complexity: High, Attack Vector: Network, EPSS: 0.00071, Social Trends: No, Days since published: 617, Reachable: No, Transitive dependency: Yes, Is Malicious: No, Business Criticality: High, Provider Urgency: Medium, Package Popularity Score: 99, Impact: 5.62, Likelihood: 1.67, Score Version: V5	Improper Verification of Cryptographic Signature SNYK-JS-NODEFORGE-2430337	Yes	No Known Exploit
107/1000 Why? Confidentiality impact: Low, Integrity impact: Low, Availability impact: Low, Scope: Unchanged, Exploit Maturity: No data, User Interaction (UI): None, Privileges Required (PR): None, Attack Complexity: Low, Attack Vector: Network, EPSS: 0.00072, Social Trends: No, Days since published: 617, Reachable: No, Transitive dependency: Yes, Is Malicious: No, Business Criticality: High, Provider Urgency: High, Package Popularity Score: 99, Impact: 5.62, Likelihood: 1.89, Score Version: V5	Improper Verification of Cryptographic Signature SNYK-JS-NODEFORGE-2430339	Yes	No Known Exploit
94/1000 Why? Confidentiality impact: Low, Integrity impact: Low, Availability impact: Low, Scope: Unchanged, Exploit Maturity: No data, User Interaction (UI): None, Privileges Required (PR): None, Attack Complexity: High, Attack Vector: Network, EPSS: 0.00062, Social Trends: No, Days since published: 617, Reachable: No, Transitive dependency: Yes, Is Malicious: No, Business Criticality: High, Provider Urgency: Medium, Package Popularity Score: 99, Impact: 5.62, Likelihood: 1.67, Score Version: V5	Improper Verification of Cryptographic Signature SNYK-JS-NODEFORGE-2430341	Yes	No Known Exploit
63/1000 Why? Confidentiality impact: None, Integrity impact: None, Availability impact: Low, Scope: Unchanged, Exploit Maturity: Proof of Concept, User Interaction (UI): None, Privileges Required (PR): None, Attack Complexity: Low, Attack Vector: Network, EPSS: 0.00153, Social Trends: No, Days since published: 945, Reachable: No, Transitive dependency: Yes, Is Malicious: No, Business Criticality: High, Provider Urgency: Medium, Package Popularity Score: 99, Impact: 2.35, Likelihood: 2.64, Score Version: V5	Regular Expression Denial of Service (ReDoS) SNYK-JS-POSTCSS-1255640	Yes	Proof of Concept
49/1000 Why? Confidentiality impact: None, Integrity impact: Low, Availability impact: None, Scope: Unchanged, Exploit Maturity: No data, User Interaction (UI): None, Privileges Required (PR): None, Attack Complexity: Low, Attack Vector: Network, EPSS: 0.00045, Social Trends: No, Days since published: 57, Reachable: No, Transitive dependency: Yes, Is Malicious: No, Business Criticality: High, Provider Urgency: Medium, Package Popularity Score: 99, Impact: 2.35, Likelihood: 2.06, Score Version: V5	Improper Input Validation SNYK-JS-POSTCSS-5926692	Yes	No Known Exploit
118/1000 Why? Confidentiality impact: Low, Integrity impact: Low, Availability impact: None, Scope: Unchanged, Exploit Maturity: Proof of Concept, User Interaction (UI): None, Privileges Required (PR): None, Attack Complexity: Low, Attack Vector: Network, EPSS: 0.00063, Social Trends: No, Days since published: 255, Reachable: No, Transitive dependency: Yes, Is Malicious: No, Business Criticality: High, Provider Urgency: Medium, Package Popularity Score: 99, Impact: 4.19, Likelihood: 2.81, Score Version: V5	Server-side Request Forgery (SSRF) SNYK-JS-REQUEST-3361831	Yes	Proof of Concept
158/1000 Why? Confidentiality impact: Low, Integrity impact: Low, Availability impact: Low, Scope: Unchanged, Exploit Maturity: Proof of Concept, User Interaction (UI): None, Privileges Required (PR): None, Attack Complexity: Low, Attack Vector: Network, EPSS: 0.06698, Social Trends: No, Days since published: 806, Reachable: No, Transitive dependency: Yes, Is Malicious: No, Business Criticality: High, Provider Urgency: High, Package Popularity Score: 99, Impact: 5.62, Likelihood: 2.81, Score Version: V5	Prototype Pollution SNYK-JS-SETVALUE-1540541	Yes	Proof of Concept
150/1000 Why? Confidentiality impact: Low, Integrity impact: Low, Availability impact: Low, Scope: Unchanged, Exploit Maturity: Proof of Concept, User Interaction (UI): None, Privileges Required (PR): None, Attack Complexity: Low, Attack Vector: Network, EPSS: 0.00447, Social Trends: No, Days since published: 1621, Reachable: No, Transitive dependency: Yes, Is Malicious: No, Business Criticality: High, Provider Urgency: High, Package Popularity Score: 99, Impact: 5.62, Likelihood: 2.65, Score Version: V5	Prototype Pollution SNYK-JS-SETVALUE-450213	Yes	Proof of Concept
118/1000 Why? Confidentiality impact: Low, Integrity impact: Low, Availability impact: None, Scope: Unchanged, Exploit Maturity: Proof of Concept, User Interaction (UI): None, Privileges Required (PR): None, Attack Complexity: Low, Attack Vector: Network, EPSS: 0.00173, Social Trends: No, Days since published: 150, Reachable: No, Transitive dependency: Yes, Is Malicious: No, Business Criticality: High, Provider Urgency: Medium, Package Popularity Score: 99, Impact: 4.19, Likelihood: 2.81, Score Version: V5	Prototype Pollution SNYK-JS-TOUGHCOOKIE-5672873	Yes	Proof of Concept
114/1000 Why? Confidentiality impact: None, Integrity impact: None, Availability impact: High, Scope: Unchanged, Exploit Maturity: No data, User Interaction (UI): None, Privileges Required (PR): None, Attack Complexity: Low, Attack Vector: Network, EPSS: 0.00116, Social Trends: No, Days since published: 911, Reachable: No, Transitive dependency: Yes, Is Malicious: No, Business Criticality: High, Provider Urgency: High, Package Popularity Score: 99, Impact: 5.99, Likelihood: 1.89, Score Version: V5	Denial of Service (DoS) SNYK-JS-TRIMNEWLINES-1298042	Yes	No Known Exploit
46/1000 Why? Confidentiality impact: None, Integrity impact: None, Availability impact: Low, Scope: Unchanged, Exploit Maturity: No data, User Interaction (UI): None, Privileges Required (PR): None, Attack Complexity: Low, Attack Vector: Network, EPSS: 0.01055, Social Trends: No, Days since published: 748, Reachable: No, Transitive dependency: Yes, Is Malicious: No, Business Criticality: High, Provider Urgency: Medium, Package Popularity Score: 99, Impact: 2.35, Likelihood: 1.92, Score Version: V5	Regular Expression Denial of Service (ReDoS) SNYK-JS-UGLIFYJS-1727251	Yes	No Known Exploit
115/1000 Why? Confidentiality impact: None, Integrity impact: None, Availability impact: High, Scope: Unchanged, Exploit Maturity: No data, User Interaction (UI): None, Privileges Required (PR): None, Attack Complexity: Low, Attack Vector: Network, EPSS: 0.01055, Social Trends: No, Days since published: 652, Reachable: No, Transitive dependency: Yes, Is Malicious: No, Business Criticality: High, Provider Urgency: High, Package Popularity Score: 99, Impact: 5.99, Likelihood: 1.92, Score Version: V5	Prototype Pollution SNYK-JS-UNSETVALUE-2400660	Yes	No Known Exploit
137/1000 Why? Confidentiality impact: Low, Integrity impact: Low, Availability impact: Low, Scope: Unchanged, Exploit Maturity: Proof of Concept, User Interaction (UI): None, Privileges Required (PR): None, Attack Complexity: High, Attack Vector: Network, EPSS: 0.00044, Social Trends: No, Days since published: 1351, Reachable: No, Transitive dependency: Yes, Is Malicious: No, Business Criticality: High, Provider Urgency: Medium, Package Popularity Score: 99, Impact: 5.62, Likelihood: 2.42, Score Version: V5	Prototype Pollution SNYK-JS-YARGSPARSER-560381	Yes	Proof of Concept
57/1000 Why? Confidentiality impact: None, Integrity impact: None, Availability impact: Low, Scope: Unchanged, Exploit Maturity: Proof of Concept, User Interaction (UI): None, Privileges Required (PR): None, Attack Complexity: High, Attack Vector: Network, EPSS: 0.00088, Social Trends: No, Days since published: 2107, Reachable: No, Transitive dependency: Yes, Is Malicious: No, Business Criticality: High, Provider Urgency: Low, Package Popularity Score: 99, Impact: 2.35, Likelihood: 2.42, Score Version: V5	Regular Expression Denial of Service (ReDoS) npm:braces:20180219	Yes	Proof of Concept
46/1000 Why? Confidentiality impact: None, Integrity impact: None, Availability impact: Low, Scope: Unchanged, Exploit Maturity: No data, User Interaction (UI): None, Privileges Required (PR): None, Attack Complexity: Low, Attack Vector: Network, EPSS: 0.01055, Social Trends: No, Days since published: 2178, Reachable: No, Transitive dependency: Yes, Is Malicious: No, Business Criticality: High, Provider Urgency: Medium, Package Popularity Score: 98, Impact: 2.35, Likelihood: 1.92, Score Version: V5	Regular Expression Denial of Service (ReDoS) npm:content-type-parser:20170905	Yes	No Known Exploit
73/1000 Why? Confidentiality impact: High, Integrity impact: None, Availability impact: None, Scope: Unchanged, Exploit Maturity: No data, User Interaction (UI): None, Privileges Required (PR): None, Attack Complexity: High, Attack Vector: Local, EPSS: 0.01055, Social Trends: No, Days since published: 1916, Reachable: No, Transitive dependency: Yes, Is Malicious: No, Business Criticality: High, Provider Urgency: Medium, Package Popularity Score: 99, Impact: 5.99, Likelihood: 1.21, Score Version: V5	Denial of Service (DoS) npm:mem:20180117	Yes	No Known Exploit

(*) Note that the real score may have changed since the PR was raised.

Release notes

Package name: react-scripts

5.0.0 - 2021-12-14
v5.0.0 (2021-12-14)

Create React App 5.0 is a major release with several new features and the latest version of all major dependencies.

Thanks to all the maintainers and contributors who worked so hard on this release! 🙌

Highlights
- webpack 5 (#11201)
- Jest 27 (#11338)
- ESLint 8 (#11375)
- PostCSS 8 (#11121)
- Fast Refresh improvements and bug fixes (#11105)
- Support for Tailwind (#11717)
- Improved package manager detection (#11322)
- Unpinned all dependencies for better compatibility with other tools (#11474)
- Dropped support for Node 10 and 12
Migrating from 4.0.x to 5.0.0

Inside any created project that has not been ejected, run:
```
npm install --save --save-exact react-scripts@5.0.0
```
or
```
yarn add --exact react-scripts@5.0.0
```
NOTE: You may need to delete your node_modules folder and reinstall your dependencies by running npm install (or yarn) if you encounter errors after upgrading.

If you previously ejected but now want to upgrade, one common solution is to find the commits where you ejected (and any subsequent commits changing the configuration), revert them, upgrade, and later optionally eject again. It’s also possible that the feature you ejected for is now supported out of the box.

Breaking Changes

Like any major release, react-scripts@5.0.0 contains a number of breaking changes. We expect that they won't affect every user, but we recommend you look over this section to see if something is relevant to you. If we missed something, please file a new issue.

Dropped support for Node 10 and 12

Node 10 reached End-of-Life in April 2021 and Node 12 will be End-of-Life in April 2022. Going forward we will only support the latest LTS release of Node.js.

Full Changelog

💥 Breaking Change
- create-react-app
  - #11322 Use env var to detect yarn or npm as the package manager (@ lukekarrys)
- babel-preset-react-app, cra-template-typescript, cra-template, create-react-app, eslint-config-react-app, react-app-polyfill, react-dev-utils, react-error-overlay, react-scripts
  - #11201 Webpack 5 (@ raix)
- eslint-config-react-app, react-error-overlay, react-scripts
  - #10761 chore: migrate to @ babel/eslint-parser (@ JLHwung)
- react-scripts
  - #11188 Deprecate root level template.json keys (@ mrmckeb)
🐛 Bug Fix
- react-scripts
  - #11413 fix(webpackDevServer): disable overlay for warnings (@ jawadsh123)
  - #10511 Fix ICSS syntax in stylesheets (@ thabemmz)
💅 Enhancement
- react-scripts
  - #11717 Add support for Tailwind (@ iansu)
  - #8227 Add source-map-loader for debugging into original source of node_modules libraries that contain sourcemaps (@ justingrant)
  - #10499 Remove ESLint verification when opting-out (@ mrmckeb)
- eslint-config-react-app, react-error-overlay, react-scripts
  - #11375 feat(eslint-config-react-app): support ESLint 8.x (@ MichaelDeBoey)
- create-react-app
  - #11322 Use env var to detect yarn or npm as the package manager (@ lukekarrys)
  - #11057 Coerce Node versions with metadata (@ mrmckeb)
- react-dev-utils
  - #11105 fix: fast refresh stops on needed bail outs (@ pmmmwh)
  - #10205 Update ModuleNotFoundPlugin to support Webpack 5 (@ raix)
- create-react-app, react-scripts
  - #11176 Run npm with --no-audit (@ gaearon)
📝 Documentation
- Other
  - #11619 The default port used by serve has changed (@ leo)
  - #10907 Fix link address (@ e-w-h)
  - #10805 Update PWA docs to point at the cra-template-pwa package (@ slieschke)
  - #10631 Update IMAGE_INLINE_SIZE_LIMIT docs (@ ianschmitz)
- eslint-config-react-app
  - #10317 eslint-config-react-app typo fix (@ Spacerat)
- react-dev-utils
  - #10779 Suggest sass instead of node-sass package (@ andrewywong)
- babel-preset-react-app, eslint-config-react-app
  - #10288 Upgrade docs http links to https (@ xom9ikk)
- cra-template
  - #10763 Trivial English fixes (@ ujihisa)
🏠 Internal
- Other
  - #11723 chore(test): make all tests install with npm ci (@ lukekarrys)
  - #11686 [WIP] Fix integration test teardown / cleanup and missing yarn installation (@ raix)
  - #11252 Remove package-lock.json (@ Methuselah96)
- create-react-app
  - #11706 Remove cached lockfile (@ lukekarrys)
- babel-plugin-named-asset-import, babel-preset-react-app, confusing-browser-globals, create-react-app, react-app-polyfill, react-dev-utils, react-error-overlay, react-scripts
  - #11624 Update all dependencies (@ jd1048576)
- react-scripts
  - #11597 Update package.json (@ HADMARINE)
  - #11292 fix: dependency issue after workbox-webpack-plugin 6.2 release (@ fguitton)
  - #11188 Deprecate root level template.json keys (@ mrmckeb)
  - #10784 Remove outdated comments on react-refresh (@ luk3kang)
- babel-plugin-named-asset-import, confusing-browser-globals, create-react-app, eslint-config-react-app, react-dev-utils, react-error-overlay, react-scripts
  - #11474 Remove dependency pinning (@ mrmckeb)
- confusing-browser-globals, cra-template-typescript, cra-template, create-react-app
  - #11415 Bump template dependency version (@ shfshanyue)
- react-error-overlay, react-scripts
  - #11304 Use npm v7 with workspaces for local development and testing (@ lukekarrys)
- babel-preset-react-app, cra-template-typescript, cra-template, create-react-app, eslint-config-react-app, react-app-polyfill, react-dev-utils, react-error-overlay, react-scripts
  - #11201 Webpack 5 (@ raix)
🔨 Underlying Tools
- react-dev-utils, react-scripts
  - #11476 Bump browserslist from 4.14.2 to 4.16.5 (@ dependabot[bot])
- react-scripts
  - #11325 allow CORS on webpack-dev-server (@ hasanayan)
  - #11121 Update PostCSS version (@ mrmckeb)
  - #10204 Update WebpackManifestPlugin (@ raix)
  - #10456 Update PostCSS packages (@ raix)
- babel-plugin-named-asset-import, confusing-browser-globals, create-react-app, react-dev-utils, react-error-overlay, react-scripts
  - #11338 Upgrade jest and related packages from 26.6.0 to 27.1.0 (@ krreet)
- eslint-config-react-app, react-error-overlay, react-scripts
  - #10761 chore: migrate to @ babel/eslint-parser (@ JLHwung)
- babel-preset-react-app, react-dev-utils, react-error-overlay, react-scripts
  - #10797 Unpin babel dependencies (@ mohd-akram)
- react-dev-utils
  - #10791 Bump immer version for fixing security issue (@ shamprasadrh)
Committers: 34
- Andrew Wong (@ andrewywong)
- Brody McKee (@ mrmckeb)
- Christiaan van Bemmel (@ thabemmz)
- Dan Abramov (@ gaearon)
- Florian Guitton (@ fguitton)
- Hasan Ayan (@ hasanayan)
- Huáng Jùnliàng (@ JLHwung)
- Ian Schmitz (@ ianschmitz)
- Ian Sutherland (@ iansu)
- James George (@ jamesgeorge007)
- Jason Williams (@ jasonwilliams)
- Jawad (@ jawadsh123)
- Joseph Atkins-Turkish (@ Spacerat)
- Justin Grant (@ justingrant)
- Konrad Stępniak (@ th7nder)
- Kristoffer K. (@ merceyz)
- Leo Lamprecht (@ leo)
- Luke Karrys (@ lukekarrys)
- Max Romanyuta (@ xom9ikk)
- Michael Mok (@ pmmmwh)
- Michaël De Boey (@ MichaelDeBoey)
- Mohamed Akram (@ mohd-akram)
- Morten N.O. Nørgaard Henriksen (@ raix)
- Nathan Bierema (@ Methuselah96)
- Reetesh Kumar (@ krreet)
- Shamprasad RH (@ shamprasadrh)
- Simon Lieschke (@ slieschke)
- @ e-w-h
- @ jd1048576
- @ luk3kang
- @ ujihisa
- hadmarine (@ HADMARINE)
- huntr.dev | the place to protect open source (@ huntr-helper)
5.0.0-next.60 - 2021-12-14
5.0.0-next.58 - 2021-12-08
5.0.0-next.47 - 2021-10-04
5.0.0-next.37 - 2021-09-01
5.0.0-next.31 - 2021-08-04
4.0.3 - 2021-02-22
4.0.2 - 2021-02-03
4.0.1 - 2020-11-23
4.0.0 - 2020-10-23
4.0.0-next.117 - 2020-10-23
4.0.0-next.116 - 2020-10-23
4.0.0-next.98 - 2020-09-16
4.0.0-next.96 - 2020-09-16
4.0.0-next.77 - 2020-08-05
4.0.0-next.64 - 2020-07-30
3.4.4 - 2020-10-20
3.4.3 - 2020-08-12
3.4.2 - 2020-08-11
3.4.1 - 2020-03-21
3.4.0 - 2020-02-14
3.3.1 - 2020-01-31
3.3.0 - 2019-12-05
3.3.0-next.80 - 2019-12-04
3.3.0-next.62 - 2019-11-14
3.3.0-next.39 - 2019-10-24
3.3.0-next.38 - 2019-10-24
3.2.0 - 2019-10-03
3.1.2 - 2019-09-19
3.1.1 - 2019-08-13
3.1.0 - 2019-08-09
3.0.1 - 2019-05-08
3.0.0 - 2019-04-22
3.0.0-next.b0cbf2ca - 2019-03-15
3.0.0-next.68 - 2019-04-17
2.1.8 - 2019-03-07
2.1.7 - 2019-03-07
2.1.6 - 2019-03-06
2.1.5 - 2019-02-11
2.1.4 - 2019-02-10
2.1.3 - 2019-01-04
2.1.3-next.6a95aae9 - 2019-01-04
2.1.2 - 2018-12-23
2.1.1 - 2018-11-01
2.1.0 - 2018-10-30
2.0.6-next.c662dfb0 - 2018-10-25
2.0.6-next.9b4009d7 - 2018-10-24
2.0.5 - 2018-10-14
2.0.4 - 2018-10-03
2.0.3 - 2018-10-02
2.0.2 - 2018-10-01
2.0.1 - 2018-09-28
react-dev-utils@12.0.1
2.0.0 - 2018-09-26
2.0.0-next.fb6e6f70 - 2018-09-25
2.0.0-next.b2fd8db8 - 2018-03-21
2.0.0-next.a671462c - 2018-08-24
2.0.0-next.9754a231 - 2018-01-18
2.0.0-next.66cc7a90 - 2018-04-21
2.0.0-next.47d2d941 - 2018-02-07
2.0.0-next.3e165448 - 2018-06-18
2.0.0-next.2150693d - 2018-09-21
2.0.0-next.096703ab - 2018-01-18
2.0.0-next.03604a46 - 2018-02-07
1.1.5 - 2018-08-22
1.1.4 - 2018-04-04

from react-scripts GitHub release notes

Check the changes in this PR to ensure they won't cause issues with your project.

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report

🛠 Adjust project settings

📚 Read more about Snyk's upgrade and patch logic

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Prototype Pollution
🦉 Regular Expression Denial of Service (ReDoS)
🦉 Open Redirect
🦉 More lessons are available in Snyk Learn

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[Snyk] Security upgrade react-scripts from 1.1.4 to 5.0.0 #48

[Snyk] Security upgrade react-scripts from 1.1.4 to 5.0.0 #48

Omrisnyk commented Nov 27, 2023

v5.0.0 (2021-12-14)

Highlights

Migrating from 4.0.x to 5.0.0

Breaking Changes

Dropped support for Node 10 and 12

Full Changelog

💥 Breaking Change

🐛 Bug Fix

💅 Enhancement

📝 Documentation

🏠 Internal

🔨 Underlying Tools

Committers: 34

[Snyk] Security upgrade react-scripts from 1.1.4 to 5.0.0 #48

Are you sure you want to change the base?

[Snyk] Security upgrade react-scripts from 1.1.4 to 5.0.0 #48

Conversation

Omrisnyk commented Nov 27, 2023

Snyk has created this PR to fix one or more vulnerable packages in the `npm` dependencies of this project.

Changes included in this PR

Vulnerabilities that will be fixed

With an upgrade:

v5.0.0 (2021-12-14)

Highlights

Migrating from 4.0.x to 5.0.0

Breaking Changes

Dropped support for Node 10 and 12

Full Changelog

💥 Breaking Change

🐛 Bug Fix

💅 Enhancement

📝 Documentation

🏠 Internal

🔨 Underlying Tools

Committers: 34