Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[Snyk] Security upgrade react-scripts from 1.1.4 to 4.0.0 #54

Open
wants to merge 1 commit into
base: master
Choose a base branch
from
Open

[Snyk] Security upgrade react-scripts from 1.1.4 to 4.0.0 #54

wants to merge 1 commit into from

Conversation

Omrisnyk
Copy link
Owner

This PR was automatically created by Snyk using the credentials of a real user.


Snyk has created this PR to fix one or more vulnerable packages in the `npm` dependencies of this project.

Changes included in this PR

  • Changes to the following files to upgrade the vulnerable dependencies to a fixed version:
    • package.json
⚠️ Warning 
Failed to update the package-lock.json, please update manually before merging.

Vulnerabilities that will be fixed

With an upgrade:
Severity Priority Score (*) Issue Breaking Change Exploit Maturity Reachability
high severity 170/1000
Why? Confidentiality impact: None, Integrity impact: None, Availability impact: High, Scope: Unchanged, Exploit Maturity: Proof of Concept, User Interaction (UI): None, Privileges Required (PR): None, Attack Complexity: Low, Attack Vector: Network, EPSS: 0.01055, Social Trends: No, Days since published: 0, Reachable: No, Transitive dependency: Yes, Is Malicious: No, Business Criticality: High, Provider Urgency: High, Package Popularity Score: 99, Impact: 5.99, Likelihood: 2.83, Score Version: V5		 Prototype Pollution
SNYK-JS-LODASH-6139239		 Yes Proof of Concept No Path Found

(*) Note that the real score may have changed since the PR was raised.

Release notes
Package name: react-scripts
  • 4.0.0 - 2020-10-23

    4.0.0 (2020-10-23)

    Create React App 4.0 is a major release with several new features, including support for Fast Refresh!

    Thanks to all the maintainers and contributors who worked so hard on this release! 🙌

    Highlights

    • Fast Refresh #8582
    • React 17 support
      • New JSX transform #9645
    • TypeScript 4 support #9734
    • ESLint 7 #8978
      • New Jest and React Testing Library rules #8963
    • Jest 26 #8955
    • PWA/workbox improvements
      • Switch to the Workbox InjectManifest plugin #9205
      • Now its own template so it can be released independently
    • Web Vitals support #9116

    Migrating from 3.4.x to 4.0.0

    Inside any created project that has not been ejected, run:

    npm install --save --save-exact react-scripts@4.0.0

    or

    yarn add --exact react-scripts@4.0.0

    NOTE: You may need to delete your node_modules folder and reinstall your dependencies by running yarn (or npm install) if you encounter errors after upgrading.

    If you previously ejected but now want to upgrade, one common solution is to find the commits where you ejected (and any subsequent commits changing the configuration), revert them, upgrade, and later optionally eject again. It’s also possible that the feature you ejected for is now supported out of the box.

    Breaking Changes

    Like any major release, react-scripts@4.0.0 contains a number of breaking changes. We expect that they won't affect every user, but we recommend you look over this section to see if something is relevant to you. If we missed something, please file a new issue.

    ESLint

    We've upgraded to ESLint 7 and added many new rules including some for Jest and React Testing Library as well as the import/no-anonymous-default-export rule. We've also upgraded eslint-plugin-hooks to version 4.0.0 and removed the EXTEND_ESLINT flag as it is no longer required to customize the ESLint config.

    Jest

    We've upgraded to Jest 26 and now set resetMocks to true by default in the Jest config.

    Service workers

    We've switched to the Workbox InjectManifest plugin and moved the PWA templates into their own repository.

    Removed typescript flag and NODE_PATH support

    We've removed the deprecated typescript flag when creating a new app. Use --template typescript instead. We've also dropped deprecated NODE_PATH flag as this has been replaced by setting the base path in jsconfig.json.

    Fix dotenv file loading order

    We've changed the loading order of env files to match the dotenv specification. See #9037 for more details.

    Dropped Node 8 support

    Node 8 reached End-of-Life at the end of 2019 and is no longer supported.

    Detailed Changelog

    🚀 New Feature

    • eslint-config-react-app, react-error-overlay, react-scripts
    • react-scripts
    • create-react-app
    • cra-template-typescript, cra-template, react-scripts
    • react-dev-utils, react-scripts

    💥 Breaking Change

    • eslint-config-react-app, react-error-overlay, react-scripts
    • cra-template-typescript, cra-template, eslint-config-react-app, react-error-overlay, react-scripts
    • eslint-config-react-app
    • create-react-app
    • cra-template-typescript, cra-template, react-scripts
    • babel-plugin-named-asset-import, confusing-browser-globals, create-react-app, react-dev-utils, react-error-overlay, react-scripts
    • create-react-app, react-scripts
      • #8934 feat: remove typescript flag and NODE_PATH support (@ mrmckeb)
    • react-scripts
    • babel-plugin-named-asset-import, babel-preset-react-app, create-react-app, react-app-polyfill, react-dev-utils, react-error-overlay, react-scripts
    • eslint-config-react-app, react-scripts
    • cra-template-typescript, cra-template, create-react-app, react-app-polyfill, react-dev-utils, react-scripts
    • babel-plugin-named-asset-import, babel-preset-react-app, confusing-browser-globals, cra-template-typescript, react-dev-utils, react-error-overlay, react-scripts

    🐛 Bug Fix

    • react-scripts
    • babel-preset-react-app, eslint-config-react-app, react-scripts
    • eslint-config-react-app, react-scripts
    • create-react-app
    • babel-preset-react-app
    • react-dev-utils
    • react-dev-utils, react-scripts
    • cra-template-typescript, cra-template, react-scripts

    💅 Enhancement

    • react-scripts
    • babel-preset-react-app, eslint-config-react-app, react-scripts
    • cra-template
    • babel-preset-react-app, react-scripts
    • react-dev-utils, react-scripts
      • #9350 Add Fast Refresh warning when using React < 16.10 (@ iansu)
    • react-dev-utils, react-error-overlay, react-scripts
    • cra-template-typescript, cra-template
    • create-react-app

    📝 Documentation

    🏠 Internal

    🔨 Underlying Tools

    • react-scripts
    • react-error-overlay, react-scripts
    • babel-plugin-named-asset-import, babel-preset-react-app, confusing-browser-globals, cra-template-typescript, cra-template, create-react-app, eslint-config-react-app, react-app-polyfill, react-error-overlay, react-scripts
    • eslint-config-react-app, react-dev-utils, react-scripts
      • #9751 Replace deprecated eslint-loader by eslint-webpack-plugin (@ tooppaaa)
    • babel-plugin-named-asset-import, babel-preset-react-app, confusing-browser-globals, cra-template-typescript, cra-template, create-react-app, eslint-config-react-app, react-dev-utils, react-error-overlay, react-scripts
    • eslint-config-react-app, react-error-overlay, react-scripts
    • cra-template-typescript, cra-template
    • react-app-polyfill
    • react-dev-utils
    • babel-plugin-named-asset-import, babel-preset-react-app, confusing-browser-globals, create-react-app, react-dev-utils, react-error-overlay, react-scripts
    • babel-preset-react-app, cra-template-typescript, cra-template, create-react-app, react-dev-utils, react-error-overlay, react-scripts
    • babel-plugin-named-asset-import, confusing-browser-globals, create-react-app, react-dev-utils, react-error-overlay, react-scripts
    • babel-preset-react-app, create-react-app, react-dev-utils, react-error-overlay, react-scripts
    • babel-plugin-named-asset-import, babel-preset-react-app, create-react-app, react-app-polyfill, react-dev-utils, react-error-overlay, react-scripts
    • eslint-config-react-app, react-scripts
    • babel-plugin-named-asset-import, babel-preset-react-app, confusing-browser-globals, cra-template-typescript, react-dev-utils, react-error-overlay, react-scripts

    Committers: 63

  • 4.0.0-next.117 - 2020-10-23
  • 4.0.0-next.116 - 2020-10-23
  • 4.0.0-next.98 - 2020-09-16
  • 4.0.0-next.96 - 2020-09-16
  • 4.0.0-next.77 - 2020-08-05
  • 4.0.0-next.64 - 2020-07-30
  • 3.4.4 - 2020-10-20
  • 3.4.3 - 2020-08-12
  • 3.4.2 - 2020-08-11
  • 3.4.1 - 2020-03-21
  • 3.4.0 - 2020-02-14
  • 3.3.1 - 2020-01-31
  • 3.3.0 - 2019-12-05
  • 3.3.0-next.80 - 2019-12-04
  • 3.3.0-next.62 - 2019-11-14
  • 3.3.0-next.39 - 2019-10-24
  • 3.3.0-next.38 - 2019-10-24
  • 3.2.0 - 2019-10-03
  • 3.1.2 - 2019-09-19
  • 3.1.1 - 2019-08-13
  • 3.1.0 - 2019-08-09
  • 3.0.1 - 2019-05-08
  • 3.0.0 - 2019-04-22
  • 3.0.0-next.b0cbf2ca - 2019-03-15
  • 3.0.0-next.68 - 2019-04-17
  • 2.1.8 - 2019-03-07
  • 2.1.7 - 2019-03-07
  • 2.1.6 - 2019-03-06
  • 2.1.5 - 2019-02-11
  • 2.1.4 - 2019-02-10
  • 2.1.3 - 2019-01-04
  • 2.1.3-next.6a95aae9 - 2019-01-04
  • 2.1.2 - 2018-12-23
  • 2.1.1 - 2018-11-01
  • 2.1.0 - 2018-10-30
  • 2.0.6-next.c662dfb0 - 2018-10-25
  • 2.0.6-next.9b4009d7 - 2018-10-24
  • 2.0.5 - 2018-10-14
  • 2.0.4 - 2018-10-03
  • 2.0.3 - 2018-10-02
  • 2.0.2 - 2018-10-01
  • 2.0.1 - 2018-09-28
  • 2.0.0 - 2018-09-26

    react-app-polyfill@2.0.0

  • 2.0.0-next.fb6e6f70 - 2018-09-25
  • 2.0.0-next.b2fd8db8 - 2018-03-21
  • 2.0.0-next.a671462c - 2018-08-24
  • 2.0.0-next.9754a231 - 2018-01-18
  • 2.0.0-next.66cc7a90 - 2018-04-21
  • 2.0.0-next.47d2d941 - 2018-02-07
  • 2.0.0-next.3e165448 - 2018-06-18
  • 2.0.0-next.2150693d - 2018-09-21
  • 2.0.0-next.096703ab - 2018-01-18
  • 2.0.0-next.03604a46 - 2018-02-07
  • 1.1.5 - 2018-08-22
  • 1.1.4 - 2018-04-04
from react-scripts GitHub release notes

Check the changes in this PR to ensure they won't cause issues with your project.

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report

🛠 Adjust project settings

📚 Read more about Snyk's upgrade and patch logic

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Prototype Pollution

@snyk-bot
fix: package.json to reduce vulnerabilities
0dc600a 
The following vulnerabilities are fixed with an upgrade:
- https://snyk.io/vuln/SNYK-JS-LODASH-6139239
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers
No reviews
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
2 participants
@Omrisnyk @snyk-bot