[Snyk] Security upgrade react-scripts from 4.0.3 to 5.0.0#5252
[Snyk] Security upgrade react-scripts from 4.0.3 to 5.0.0#5252
Conversation
…educe vulnerabilities The following vulnerabilities are fixed with an upgrade: - https://snyk.io/vuln/SNYK-JS-TAR-15032660 - https://snyk.io/vuln/SNYK-JS-TAR-15127355
There was a problem hiding this comment.
Pull request overview
Upgrades the Create React App build tooling to remediate Snyk-reported vulnerabilities (tar directory traversal) pulled in via the frontend dependency tree.
Changes:
- Bump
react-scriptsfrom4.0.3to5.0.0in the React frontend.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| "react-dom": "^17.0.2", | ||
| "react-router-dom": "^5.3.0", | ||
| "react-scripts": "4.0.3", | ||
| "react-scripts": "5.0.0", |
There was a problem hiding this comment.
react-scripts 5.x requires Node 14+; this package.json doesn’t declare an engines constraint, so local dev/CI could accidentally run with an unsupported Node version and fail at install/build. Consider adding an "engines" entry (and/or updating your build tooling docs) to enforce the required Node range.
| "react-dom": "^17.0.2", | ||
| "react-router-dom": "^5.3.0", | ||
| "react-scripts": "4.0.3", | ||
| "react-scripts": "5.0.0", |
There was a problem hiding this comment.
This repo doesn’t appear to commit a lockfile (no yarn.lock/package-lock.json). With a security-driven upgrade like this, that means dependency resolution is non-deterministic and the fixed transitive versions aren’t pinned. Consider committing the appropriate lockfile and using a frozen/ci install mode (e.g., yarn --frozen-lockfile or npm ci) to make the remediation reproducible.
Snyk has created this PR to fix 2 vulnerabilities in the npm dependencies of this project.
Snyk changed the following file(s):
spring-boot-modules/spring-boot-react/frontend/package.jsonVulnerabilities that will be fixed with an upgrade:
SNYK-JS-TAR-15032660
SNYK-JS-TAR-15127355
Important
Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.
For more information:
🧐 View latest project report
📜 Customise PR templates
🛠 Adjust project settings
📚 Read about Snyk's upgrade logic
Learn how to fix vulnerabilities with free interactive lessons:
🦉 Directory Traversal