[Snyk] Security upgrade react-scripts from 4.0.0 to 5.0.0 - #113
[Snyk] Security upgrade react-scripts from 4.0.0 to 5.0.0#113TiagoSansao wants to merge 1 commit into
Conversation
…lities The following vulnerabilities are fixed with an upgrade: - https://snyk.io/vuln/SNYK-JS-TAR-15127355
|
There was a problem hiding this comment.
Pull request overview
This PR upgrades react-scripts from version 4.0.0 to 5.0.0 to address a medium-severity directory traversal vulnerability (SNYK-JS-TAR-15127355, score 596) in the tar package dependency. This is a major version upgrade that includes significant changes such as the migration from Webpack 4 to Webpack 5.
Changes:
- Upgraded react-scripts dependency from 4.0.0 to 5.0.0 in package.json
- Updated yarn.lock with new dependency tree including Webpack 5 and associated build tools
Reviewed changes
Copilot reviewed 1 out of 2 changed files in this pull request and generated 1 comment.
| File | Description |
|---|---|
| front-end/package.json | Updated react-scripts version from 4.0.0 to 5.0.0 to fix security vulnerability |
| front-end/yarn.lock | Updated dependency lock file with new dependency tree for react-scripts 5.0.0 |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| "react-dom": "^17.0.1", | ||
| "react-router-dom": "^5.2.0", | ||
| "react-scripts": "4.0.0" | ||
| "react-scripts": "5.0.0" |
There was a problem hiding this comment.
The upgrade to react-scripts 5.0.0 requires Node.js version 14 or higher. Consider adding an "engines" field to package.json to enforce this requirement and prevent runtime errors for users with older Node.js versions. For example:
"engines": {
"node": ">=14.0.0"
}
This will help ensure compatibility and provide clear error messages if someone attempts to use an incompatible Node.js version.
Snyk has created this PR to fix 1 vulnerabilities in the yarn dependencies of this project.
Snyk changed the following file(s):
front-end/package.jsonfront-end/yarn.lockNote for zero-installs users
If you are using the Yarn feature zero-installs that was introduced in Yarn V2, note that this PR does not update the
.yarn/cache/directory meaning this code cannot be pulled and immediately developed on as one would expect for a zero-install project - you will need to runyarnto update the contents of the./yarn/cachedirectory.If you are not using zero-install you can ignore this as your flow should likely be unchanged.
Vulnerabilities that will be fixed with an upgrade:
SNYK-JS-TAR-15127355
Important
Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.
For more information:
🧐 View latest project report
📜 Customise PR templates
🛠 Adjust project settings
📚 Read about Snyk's upgrade logic
Learn how to fix vulnerabilities with free interactive lessons:
🦉 Directory Traversal