Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Update dependency react-scripts to v4 #15

Open
wants to merge 1 commit into
base: main
Choose a base branch
from

Conversation

mend-for-github-com[bot]
Copy link

@mend-for-github-com mend-for-github-com bot commented Mar 7, 2024

This PR contains the following updates:

Package Type Update Change
react-scripts (source) devDependencies major ^1.0.11 -> ^4.0.0
react-scripts (source) dependencies major 1.0.11 -> 4.0.0

By merging this PR, the issue #40 will be automatically resolved and closed:

Severity CVSS Score CVE
Critical Critical 9.8 CVE-2018-1000620
Critical Critical 9.8 CVE-2018-1000620
Critical Critical 9.8 CVE-2018-13797
Critical Critical 9.8 CVE-2018-16492
Critical Critical 9.8 CVE-2020-28499
Critical Critical 9.8 CVE-2020-7788
Critical Critical 9.8 CVE-2021-23369
Critical Critical 9.8 CVE-2021-23383
Critical Critical 9.8 CVE-2021-3918
Critical Critical 9.8 CVE-2022-37598
Critical Critical 9.8 CVE-2023-42282
Critical Critical 9.8 CVE-2023-45311
Critical Critical 9.8 CVE-2023-45311
Critical Critical 9.3 CVE-2022-1650
High High 8.8 CVE-2018-3728
High High 8.6 CVE-2021-37701
High High 8.6 CVE-2021-37712
High High 8.6 CVE-2021-37713
High High 8.1 CVE-2021-32803
High High 8.1 CVE-2021-32804
High High 7.7 CVE-2020-13822
High High 7.5 CVE-2018-16469
High High 7.5 CVE-2018-20834
High High 7.5 CVE-2018-3737
High High 7.5 CVE-2021-23424
High High 7.5 CVE-2021-28092
High High 7.5 CVE-2021-29059
High High 7.5 CVE-2021-33623
High High 7.5 CVE-2021-3777
High High 7.5 CVE-2022-29167
High High 7.5 CVE-2022-29167
High High 7.5 WS-2019-0541
High High 7.5 WS-2020-0091
High High 7.5 WS-2020-0450
High High 7.5 WS-2021-0152
High High 7.4 WS-2018-0588
High High 7.4 WS-2018-0588
High High 7.3 CVE-2020-8116
Medium Medium 6.8 CVE-2020-28498
Medium Medium 6.5 CVE-2018-21270
Medium Medium 6.5 CVE-2021-23386
Medium Medium 5.9 WS-2019-0424
Medium Medium 5.9 WS-2019-0427
Medium Medium 5.6 CVE-2020-7598
Medium Medium 5.6 CVE-2020-7598
Medium Medium 5.5 CVE-2019-13173
Medium Medium 5.3 CVE-2017-16028
Medium Medium 5.3 CVE-2021-23362
Medium Medium 5.3 CVE-2021-29060
Medium Medium 5.3 CVE-2022-33987
Medium Medium 5.1 WS-2019-0307
Medium Medium 4.8 WS-2018-0103

By merging this PR, the issue #64 will be automatically resolved and closed:

Severity CVSS Score CVE
Critical Critical 9.8 CVE-2018-3774
Critical Critical 9.8 CVE-2018-6342
Critical Critical 9.8 CVE-2022-0691
Critical Critical 9.1 CVE-2022-0686
High High 8.1 WS-2019-0063
High High 7.8 CVE-2021-43138
High High 7.5 CVE-2017-16099
High High 7.5 CVE-2017-16118
High High 7.5 CVE-2017-16138
High High 7.5 CVE-2018-14732
High High 7.5 CVE-2020-7662
High High 7.5 CVE-2021-23382
High High 7.5 CVE-2021-23382
High High 7.5 CVE-2021-27516
High High 7.5 WS-2019-0032
High High 7.1 WS-2018-0590
Medium Medium 6.5 CVE-2020-26291
Medium Medium 6.1 CVE-2021-3647
Medium Medium 6.1 CVE-2022-0868
Medium Medium 6.1 CVE-2022-1233
Medium Medium 6.1 CVE-2022-1243
Medium Medium 5.6 CVE-2020-15366
Medium Medium 5.6 CVE-2021-24033
Medium Medium 5.3 CVE-2020-8124
Medium Medium 5.3 CVE-2021-27515
Medium Medium 5.3 CVE-2021-3664
Medium Medium 5.3 CVE-2022-0512
Medium Medium 5.3 CVE-2022-0639
Medium Medium 5.3 CVE-2022-24723
Medium Medium 5.3 WS-2018-0347
Medium Medium 5.3 WS-2019-0017
Low Low 3.7 WS-2018-0589

Release Notes

facebook/create-react-app (react-scripts)

v4.0.0

Compare Source

4.0.0 (2020-10-23)

Create React App 4.0 is a major release with several new features, including support for Fast Refresh!

Thanks to all the maintainers and contributors who worked so hard on this release! 🙌

Highlights

  • Fast Refresh #​8582
  • React 17 support
  • TypeScript 4 support #​9734
  • ESLint 7 #​8978
    • New Jest and React Testing Library rules #​8963
  • Jest 26 #​8955
  • PWA/workbox improvements
    • Switch to the Workbox InjectManifest plugin #​9205
    • Now its own template so it can be released independently
  • Web Vitals support #​9116

Migrating from 3.4.x to 4.0.0

Inside any created project that has not been ejected, run:

npm install --save --save-exact react-scripts@4.0.0

or

yarn add --exact react-scripts@4.0.0

NOTE: You may need to delete your node_modules folder and reinstall your dependencies by running yarn (or npm install) if you encounter errors after upgrading.

If you previously ejected but now want to upgrade, one common solution is to find the commits where you ejected (and any subsequent commits changing the configuration), revert them, upgrade, and later optionally eject again. It’s also possible that the feature you ejected for is now supported out of the box.

Breaking Changes

Like any major release, react-scripts@4.0.0 contains a number of breaking changes. We expect that they won't affect every user, but we recommend you look over this section to see if something is relevant to you. If we missed something, please file a new issue.

ESLint

We've upgraded to ESLint 7 and added many new rules including some for Jest and React Testing Library as well as the import/no-anonymous-default-export rule. We've also upgraded eslint-plugin-hooks to version 4.0.0 and removed the EXTEND_ESLINT flag as it is no longer required to customize the ESLint config.

Jest

We've upgraded to Jest 26 and now set resetMocks to true by default in the Jest config.

Service workers

We've switched to the Workbox InjectManifest plugin and moved the PWA templates into their own repository.

Removed typescript flag and NODE_PATH support

We've removed the deprecated typescript flag when creating a new app. Use --template typescript instead. We've also dropped deprecated NODE_PATH flag as this has been replaced by setting the base path in jsconfig.json.

Fix dotenv file loading order

We've changed the loading order of env files to match the dotenv specification. See #​9037 for more details.

Dropped Node 8 support

Node 8 reached End-of-Life at the end of 2019 and is no longer supported.

Detailed Changelog

🚀 New Feature
💥 Breaking Change
  • eslint-config-react-app, react-error-overlay, react-scripts
  • cra-template-typescript, cra-template, eslint-config-react-app, react-error-overlay, react-scripts
  • eslint-config-react-app
  • create-react-app
  • cra-template-typescript, cra-template, react-scripts
  • babel-plugin-named-asset-import, confusing-browser-globals, create-react-app, react-dev-utils, react-error-overlay, react-scripts
  • create-react-app, react-scripts
  • react-scripts
  • babel-plugin-named-asset-import, babel-preset-react-app, create-react-app, react-app-polyfill, react-dev-utils, react-error-overlay, react-scripts
  • eslint-config-react-app, react-scripts
  • cra-template-typescript, cra-template, create-react-app, react-app-polyfill, react-dev-utils, react-scripts
  • babel-plugin-named-asset-import, babel-preset-react-app, confusing-browser-globals, cra-template-typescript, react-dev-utils, react-error-overlay, react-scripts
🐛 Bug Fix
💅 Enhancement
📝 Documentation
🏠 Internal
🔨 Underlying Tools
  • react-scripts
  • react-error-overlay, react-scripts
  • babel-plugin-named-asset-import, babel-preset-react-app, confusing-browser-globals, cra-template-typescript, cra-template, create-react-app, eslint-config-react-app, react-app-polyfill, react-error-overlay, react-scripts
  • eslint-config-react-app, react-dev-utils, react-scripts
  • babel-plugin-named-asset-import, babel-preset-react-app, confusing-browser-globals, cra-template-typescript, cra-template, create-react-app, eslint-config-react-app, react-dev-utils, react-error-overlay, react-scripts
  • eslint-config-react-app, react-error-overlay, react-scripts
  • cra-template-typescript, cra-template
  • react-app-polyfill
  • react-dev-utils
  • babel-plugin-named-asset-import, babel-preset-react-app, confusing-browser-globals, create-react-app, react-dev-utils, react-error-overlay, react-scripts
  • babel-preset-react-app, cra-template-typescript, cra-template, create-react-app, react-dev-utils, react-error-overlay, react-scripts
  • babel-plugin-named-asset-import, confusing-browser-globals, create-react-app, react-dev-utils, react-error-overlay, react-scripts
  • babel-preset-react-app, create-react-app, react-dev-utils, react-error-overlay, react-scripts
  • babel-plugin-named-asset-import, babel-preset-react-app, create-react-app, react-app-polyfill, react-dev-utils, react-error-overlay, react-scripts
  • eslint-config-react-app, react-scripts
  • babel-plugin-named-asset-import, babel-preset-react-app, confusing-browser-globals, cra-template-typescript, react-dev-utils, react-error-overlay, react-scripts
Committers: 63

v3.4.4

Compare Source

3.4.4 (2020-10-20)

v3.4.4 release bumps resolve-url-loader to a version for which npm audit does not report a vulnerability. Note that this vulnerability did not affect Create React App projects, so this change is only necessary to satisfy auditing tools.

Migrating from 3.4.3 to 3.4.4

Inside any created project that has not been ejected, run:

npm install --save --save-exact react-scripts@3.4.4

or

yarn add --exact react-scripts@3.4.4

v3.4.3

Compare Source

3.4.3 (2020-08-12)

v3.4.3 release bumps terser-webpack-plugin to a version for which npm audit does not report a vulnerability. Note that this vulnerability did not affect Create React App projects, so this change is only necessary to satisfy auditing tools.

Migrating from 3.4.2 to 3.4.3

Inside any created project that has not been ejected, run:

npm install --save --save-exact react-scripts@3.4.3

or

yarn add --exact react-scripts@3.4.3

v3.4.2

Compare Source

3.4.2 (2020-08-11)

v3.4.2 release bumps webpack-dev-server to a version for which npm audit does not report a vulnerability. Note that this vulnerability did not affect Create React App projects, so this change is only necessary to satisfy auditing tools.

Migrating from 3.4.1 to 3.4.2

Inside any created project that has not been ejected, run:

npm install --save --save-exact react-scripts@3.4.2

or

yarn add --exact react-scripts@3.4.2

v3.4.1

Compare Source

3.4.1 (2020-03-20)

v3.4.1 is a maintenance release that includes minor bug fixes and documentation updates including upgrading Babel to fix a bug in the 7.8 release line. This release also brings support for TypeScript 3.8.

🐛 Bug Fix
💅 Enhancement
📝 Documentation
🔨 Underlying Tools
Committers: 9
Migrating from 3.4.0 to 3.4.1

Inside any created project that has not been ejected, run:

npm install --save --save-exact react-scripts@3.4.1

or

yarn add --exact react-scripts@3.4.1

v3.4.0

Compare Source

3.4.0 (2020-02-14)

v3.4.0 is a minor release that adds new features, including support for SSL and setting PUBLIC_URL in development. It also includes a fix for Hot Module Reloading with CSS Modules as well as other bug fixes.

🐛 Bug Fix
  • react-scripts
    • #​8378 Downgrade style-loader to v0.23.1 due to CSS modules hot reload not working with v1.0.0 and above (@​chybisov)
  • create-react-app, react-dev-utils, react-error-overlay
  • react-dev-utils

@mend-for-github-com mend-for-github-com bot added the security fix Security fix generated by Mend label Mar 7, 2024
@mend-for-github-com mend-for-github-com bot changed the title Update dependency react-scripts to v4 Update dependency react-scripts to v4 - autoclosed Mar 7, 2024
@mend-for-github-com mend-for-github-com bot deleted the whitesource-remediate/react-scripts-4.x branch March 7, 2024 08:50
@mend-for-github-com mend-for-github-com bot changed the title Update dependency react-scripts to v4 - autoclosed Update dependency react-scripts to v4 Mar 7, 2024
@mend-for-github-com mend-for-github-com bot reopened this Mar 7, 2024
@mend-for-github-com mend-for-github-com bot restored the whitesource-remediate/react-scripts-4.x branch March 7, 2024 09:02
@mend-for-github-com mend-for-github-com bot force-pushed the whitesource-remediate/react-scripts-4.x branch from c963bed to 9f40995 Compare March 7, 2024 09:08
@mend-for-github-com mend-for-github-com bot changed the title Update dependency react-scripts to v4 Update dependency react-scripts to v4 - autoclosed Mar 7, 2024
@mend-for-github-com mend-for-github-com bot deleted the whitesource-remediate/react-scripts-4.x branch March 7, 2024 09:15
@mend-for-github-com mend-for-github-com bot changed the title Update dependency react-scripts to v4 - autoclosed Update dependency react-scripts to v4 Mar 7, 2024
@mend-for-github-com mend-for-github-com bot reopened this Mar 7, 2024
@mend-for-github-com mend-for-github-com bot restored the whitesource-remediate/react-scripts-4.x branch March 7, 2024 09:24
@mend-for-github-com mend-for-github-com bot force-pushed the whitesource-remediate/react-scripts-4.x branch from 9f40995 to 690fe62 Compare March 7, 2024 09:29
@mend-for-github-com mend-for-github-com bot force-pushed the whitesource-remediate/react-scripts-4.x branch from 690fe62 to 6ba1e3b Compare March 7, 2024 09:56
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
security fix Security fix generated by Mend
Projects
None yet
Development

Successfully merging this pull request may close these issues.

None yet

0 participants