[Snyk] Security upgrade react-scripts from 1.1.4 to 5.0.0 #53
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
The following vulnerabilities are fixed with an upgrade: - https://snyk.io/vuln/SNYK-JS-TAR-6476909 - https://snyk.io/vuln/SNYK-JS-WEBPACKDEVMIDDLEWARE-6476555
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This PR was automatically created by Snyk using the credentials of a real user.
Snyk has created this PR to fix one or more vulnerable packages in the `npm` dependencies of this project.
Changes included in this PR
Vulnerabilities that will be fixed
With an upgrade:
Why? Confidentiality impact: None, Integrity impact: None, Availability impact: High, Scope: Unchanged, Exploit Maturity: Proof of Concept, User Interaction (UI): Required, Privileges Required (PR): None, Attack Complexity: Low, Attack Vector: Network, EPSS: 0.01055, Social Trends: No, Days since published: 0, Reachable: No, Transitive dependency: Yes, Is Malicious: No, Business Criticality: High, Provider Urgency: Medium, Package Popularity Score: 99, Impact: 5.99, Likelihood: 2.39, Score Version: V5
SNYK-JS-TAR-6476909
Why? Confidentiality impact: High, Integrity impact: None, Availability impact: None, Scope: Changed, Exploit Maturity: Proof of Concept, User Interaction (UI): Required, Privileges Required (PR): None, Attack Complexity: Low, Attack Vector: Network, EPSS: 0.01055, Social Trends: No, Days since published: 0, Reachable: No, Transitive dependency: Yes, Is Malicious: No, Business Criticality: High, Provider Urgency: High, Package Popularity Score: 99, Impact: 6.65, Likelihood: 2.39, Score Version: V5
SNYK-JS-WEBPACKDEVMIDDLEWARE-6476555
(*) Note that the real score may have changed since the PR was raised.
Release notes
Package name: react-scripts
-
5.0.0 - 2021-12-14
- webpack 5 (#11201)
- Jest 27 (#11338)
- ESLint 8 (#11375)
- PostCSS 8 (#11121)
- Fast Refresh improvements and bug fixes (#11105)
- Support for Tailwind (#11717)
- Improved package manager detection (#11322)
- Unpinned all dependencies for better compatibility with other tools (#11474)
- Dropped support for Node 10 and 12
- #11322 Use env var to detect yarn or npm as the package manager (@ lukekarrys)
- #11201 Webpack 5 (@ raix)
- #10761 chore: migrate to @ babel/eslint-parser (@ JLHwung)
- #11188 Deprecate root level template.json keys (@ mrmckeb)
- #11413 fix(webpackDevServer): disable overlay for warnings (@ jawadsh123)
- #10511 Fix ICSS syntax in stylesheets (@ thabemmz)
- #11717 Add support for Tailwind (@ iansu)
- #8227 Add source-map-loader for debugging into original source of node_modules libraries that contain sourcemaps (@ justingrant)
- #10499 Remove ESLint verification when opting-out (@ mrmckeb)
- #11375 feat(eslint-config-react-app): support ESLint 8.x (@ MichaelDeBoey)
- #11322 Use env var to detect yarn or npm as the package manager (@ lukekarrys)
- #11057 Coerce Node versions with metadata (@ mrmckeb)
- #11105 fix: fast refresh stops on needed bail outs (@ pmmmwh)
- #10205 Update ModuleNotFoundPlugin to support Webpack 5 (@ raix)
- #11176 Run npm with --no-audit (@ gaearon)
- Other
- #11619 The default port used by
- #10907 Fix link address (@ e-w-h)
- #10805 Update PWA docs to point at the cra-template-pwa package (@ slieschke)
- #10631 Update IMAGE_INLINE_SIZE_LIMIT docs (@ ianschmitz)
- #10317 eslint-config-react-app typo fix (@ Spacerat)
- #10779 Suggest sass instead of node-sass package (@ andrewywong)
- #10288 Upgrade docs http links to https (@ xom9ikk)
- #10763 Trivial English fixes (@ ujihisa)
- Other
- #11723 chore(test): make all tests install with
- #11686 [WIP] Fix integration test teardown / cleanup and missing yarn installation (@ raix)
- #11252 Remove package-lock.json (@ Methuselah96)
- #11706 Remove cached lockfile (@ lukekarrys)
- #11624 Update all dependencies (@ jd1048576)
- #11597 Update package.json (@ HADMARINE)
- #11292 fix: dependency issue after workbox-webpack-plugin 6.2 release (@ fguitton)
- #11188 Deprecate root level template.json keys (@ mrmckeb)
- #10784 Remove outdated comments on react-refresh (@ luk3kang)
- #11474 Remove dependency pinning (@ mrmckeb)
- #11415 Bump template dependency version (@ shfshanyue)
- #11304 Use npm v7 with workspaces for local development and testing (@ lukekarrys)
- #11201 Webpack 5 (@ raix)
- #11476 Bump browserslist from 4.14.2 to 4.16.5 (@ dependabot[bot])
- #11325 allow CORS on webpack-dev-server (@ hasanayan)
- #11121 Update PostCSS version (@ mrmckeb)
- #10204 Update WebpackManifestPlugin (@ raix)
- #10456 Update PostCSS packages (@ raix)
- #11338 Upgrade jest and related packages from 26.6.0 to 27.1.0 (@ krreet)
- #10761 chore: migrate to @ babel/eslint-parser (@ JLHwung)
- #10797 Unpin babel dependencies (@ mohd-akram)
- #10791 Bump immer version for fixing security issue (@ shamprasadrh)
- Andrew Wong (@ andrewywong)
- Brody McKee (@ mrmckeb)
- Christiaan van Bemmel (@ thabemmz)
- Dan Abramov (@ gaearon)
- Florian Guitton (@ fguitton)
- Hasan Ayan (@ hasanayan)
- Hu谩ng J霉nli脿ng (@ JLHwung)
- Ian Schmitz (@ ianschmitz)
- Ian Sutherland (@ iansu)
- James George (@ jamesgeorge007)
- Jason Williams (@ jasonwilliams)
- Jawad (@ jawadsh123)
- Joseph Atkins-Turkish (@ Spacerat)
- Justin Grant (@ justingrant)
- Konrad St臋pniak (@ th7nder)
- Kristoffer K. (@ merceyz)
- Leo Lamprecht (@ leo)
- Luke Karrys (@ lukekarrys)
- Max Romanyuta (@ xom9ikk)
- Michael Mok (@ pmmmwh)
- Micha毛l De Boey (@ MichaelDeBoey)
- Mohamed Akram (@ mohd-akram)
- Morten N.O. N酶rgaard Henriksen (@ raix)
- Nathan Bierema (@ Methuselah96)
- Reetesh Kumar (@ krreet)
- Shamprasad RH (@ shamprasadrh)
- Simon Lieschke (@ slieschke)
- @ e-w-h
- @ jd1048576
- @ luk3kang
- @ ujihisa
- hadmarine (@ HADMARINE)
- huntr.dev | the place to protect open source (@ huntr-helper)
-
5.0.0-next.60 - 2021-12-14
-
5.0.0-next.58 - 2021-12-08
-
5.0.0-next.47 - 2021-10-04
-
5.0.0-next.37 - 2021-09-01
-
5.0.0-next.31 - 2021-08-04
-
4.0.3 - 2021-02-22
-
4.0.2 - 2021-02-03
-
4.0.1 - 2020-11-23
-
4.0.0 - 2020-10-23
-
4.0.0-next.117 - 2020-10-23
-
4.0.0-next.116 - 2020-10-23
-
4.0.0-next.98 - 2020-09-16
-
4.0.0-next.96 - 2020-09-16
-
4.0.0-next.77 - 2020-08-05
-
4.0.0-next.64 - 2020-07-30
-
3.4.4 - 2020-10-20
-
3.4.3 - 2020-08-12
-
3.4.2 - 2020-08-11
-
3.4.1 - 2020-03-21
-
3.4.0 - 2020-02-14
-
3.3.1 - 2020-01-31
-
3.3.0 - 2019-12-05
-
3.3.0-next.80 - 2019-12-04
-
3.3.0-next.62 - 2019-11-14
-
3.3.0-next.39 - 2019-10-24
-
3.3.0-next.38 - 2019-10-24
-
3.2.0 - 2019-10-03
-
3.1.2 - 2019-09-19
-
3.1.1 - 2019-08-13
-
3.1.0 - 2019-08-09
-
3.0.1 - 2019-05-08
-
3.0.0 - 2019-04-22
-
3.0.0-next.b0cbf2ca - 2019-03-15
-
3.0.0-next.68 - 2019-04-17
-
2.1.8 - 2019-03-07
-
2.1.7 - 2019-03-07
-
2.1.6 - 2019-03-06
-
2.1.5 - 2019-02-11
-
2.1.4 - 2019-02-10
-
2.1.3 - 2019-01-04
-
2.1.3-next.6a95aae9 - 2019-01-04
-
2.1.2 - 2018-12-23
-
2.1.1 - 2018-11-01
-
2.1.0 - 2018-10-30
-
2.0.6-next.c662dfb0 - 2018-10-25
-
2.0.6-next.9b4009d7 - 2018-10-24
-
2.0.5 - 2018-10-14
-
2.0.4 - 2018-10-03
-
2.0.3 - 2018-10-02
-
2.0.2 - 2018-10-01
-
2.0.1 - 2018-09-28
-
2.0.0 - 2018-09-26
-
2.0.0-next.fb6e6f70 - 2018-09-25
-
2.0.0-next.b2fd8db8 - 2018-03-21
-
2.0.0-next.a671462c - 2018-08-24
-
2.0.0-next.9754a231 - 2018-01-18
-
2.0.0-next.66cc7a90 - 2018-04-21
-
2.0.0-next.47d2d941 - 2018-02-07
-
2.0.0-next.3e165448 - 2018-06-18
-
2.0.0-next.2150693d - 2018-09-21
-
2.0.0-next.096703ab - 2018-01-18
-
2.0.0-next.03604a46 - 2018-02-07
-
1.1.5 - 2018-08-22
-
1.1.4 - 2018-04-04
from react-scripts GitHub release notesv5.0.0 (2021-12-14)
Create React App 5.0 is a major release with several new features and the latest version of all major dependencies.
Thanks to all the maintainers and contributors who worked so hard on this release! 馃檶
Highlights
Migrating from 4.0.x to 5.0.0
Inside any created project that has not been ejected, run:
or
NOTE: You may need to delete your
node_modulesfolder and reinstall your dependencies by runningnpm install(oryarn) if you encounter errors after upgrading.If you previously ejected but now want to upgrade, one common solution is to find the commits where you ejected (and any subsequent commits changing the configuration), revert them, upgrade, and later optionally eject again. It鈥檚 also possible that the feature you ejected for is now supported out of the box.
Breaking Changes
Like any major release,
react-scripts@5.0.0contains a number of breaking changes. We expect that they won't affect every user, but we recommend you look over this section to see if something is relevant to you. If we missed something, please file a new issue.Dropped support for Node 10 and 12
Node 10 reached End-of-Life in April 2021 and Node 12 will be End-of-Life in April 2022. Going forward we will only support the latest LTS release of Node.js.
Full Changelog
馃挜 Breaking Change
create-react-appbabel-preset-react-app,cra-template-typescript,cra-template,create-react-app,eslint-config-react-app,react-app-polyfill,react-dev-utils,react-error-overlay,react-scriptseslint-config-react-app,react-error-overlay,react-scriptsreact-scripts馃悰 Bug Fix
react-scripts馃拝 Enhancement
react-scriptseslint-config-react-app,react-error-overlay,react-scriptscreate-react-appreact-dev-utilscreate-react-app,react-scripts馃摑 Documentation
servehas changed (@ leo)eslint-config-react-appreact-dev-utilsbabel-preset-react-app,eslint-config-react-appcra-template馃彔 Internal
npm ci(@ lukekarrys)create-react-appbabel-plugin-named-asset-import,babel-preset-react-app,confusing-browser-globals,create-react-app,react-app-polyfill,react-dev-utils,react-error-overlay,react-scriptsreact-scriptsbabel-plugin-named-asset-import,confusing-browser-globals,create-react-app,eslint-config-react-app,react-dev-utils,react-error-overlay,react-scriptsconfusing-browser-globals,cra-template-typescript,cra-template,create-react-appreact-error-overlay,react-scriptsbabel-preset-react-app,cra-template-typescript,cra-template,create-react-app,eslint-config-react-app,react-app-polyfill,react-dev-utils,react-error-overlay,react-scripts馃敤 Underlying Tools
react-dev-utils,react-scriptsreact-scriptsbabel-plugin-named-asset-import,confusing-browser-globals,create-react-app,react-dev-utils,react-error-overlay,react-scriptseslint-config-react-app,react-error-overlay,react-scriptsbabel-preset-react-app,react-dev-utils,react-error-overlay,react-scriptsreact-dev-utilsCommitters: 34
react-dev-utils@12.0.1
Check the changes in this PR to ensure they won't cause issues with your project.
Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.
For more information:
馃 View latest project report
馃洜 Adjust project settings
馃摎 Read more about Snyk's upgrade and patch logic
Learn how to fix vulnerabilities with free interactive lessons:
馃 Uncontrolled Resource Consumption ('Resource Exhaustion')
馃 Path Traversal