Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

chore(deps): update dependency react-scripts to v4 - autoclosed #356

Closed
wants to merge 1 commit into from
Closed

chore(deps): update dependency react-scripts to v4 - autoclosed #356

wants to merge 1 commit into from

Conversation

mend-for-jackfan.us.kg[bot]
Copy link

@mend-for-jackfan.us.kg mend-for-jackfan.us.kg bot commented Nov 30, 2023 •
edited
Loading

This PR contains the following updates:

Package Type Update Change
react-scripts (source) dependencies major 2.1.8 -> 4.0.0

By merging this PR, the below issues will be automatically resolved and closed:

Severity CVSS Score CVE GitHub Issue
Critical 9.8 CVE-2021-3757 #413
Critical 9.8 CVE-2021-42740 #470
Critical 9.8 CVE-2022-37598 #456
Critical 9.8 CVE-2022-37601 #430
Critical 9.8 CVE-2023-45311 #464
High 8.8 CVE-2022-46175 #471
High 8.1 CVE-2020-7660 #398
High 7.5 CVE-2020-28477 #452
High 7.5 CVE-2021-23424 #424
High 7.5 CVE-2022-24771 #438
High 7.5 CVE-2022-24772 #436
High 7.5 CVE-2022-37603 #410
High 7.4 CVE-2024-29180 #380
High 7.3 CVE-2020-28499 #401

By merging this PR, the below issues will be automatically resolved and closed:

Severity CVSS Score CVE GitHub Issue
Critical 9.8 CVE-2023-26136 #462

Release Notes

facebook/create-react-app (react-scripts)

v4.0.0

Compare Source

4.0.0 (2020-10-23)

Create React App 4.0 is a major release with several new features, including support for Fast Refresh!

Thanks to all the maintainers and contributors who worked so hard on this release! 🙌

Highlights

  • Fast Refresh #​8582
  • React 17 support
  • TypeScript 4 support #​9734
  • ESLint 7 #​8978
    • New Jest and React Testing Library rules #​8963
  • Jest 26 #​8955
  • PWA/workbox improvements
    • Switch to the Workbox InjectManifest plugin #​9205
    • Now its own template so it can be released independently
  • Web Vitals support #​9116

Migrating from 3.4.x to 4.0.0

Inside any created project that has not been ejected, run:

npm install --save --save-exact [email protected]

or

yarn add --exact [email protected]

NOTE: You may need to delete your node_modules folder and reinstall your dependencies by running yarn (or npm install) if you encounter errors after upgrading.

If you previously ejected but now want to upgrade, one common solution is to find the commits where you ejected (and any subsequent commits changing the configuration), revert them, upgrade, and later optionally eject again. It’s also possible that the feature you ejected for is now supported out of the box.

Breaking Changes

Like any major release, [email protected] contains a number of breaking changes. We expect that they won't affect every user, but we recommend you look over this section to see if something is relevant to you. If we missed something, please file a new issue.

ESLint

We've upgraded to ESLint 7 and added many new rules including some for Jest and React Testing Library as well as the import/no-anonymous-default-export rule. We've also upgraded eslint-plugin-hooks to version 4.0.0 and removed the EXTEND_ESLINT flag as it is no longer required to customize the ESLint config.

Jest

We've upgraded to Jest 26 and now set resetMocks to true by default in the Jest config.

Service workers

We've switched to the Workbox InjectManifest plugin and moved the PWA templates into their own repository.

Removed typescript flag and NODE_PATH support

We've removed the deprecated typescript flag when creating a new app. Use --template typescript instead. We've also dropped deprecated NODE_PATH flag as this has been replaced by setting the base path in jsconfig.json.

Fix dotenv file loading order

We've changed the loading order of env files to match the dotenv specification. See #​9037 for more details.

Dropped Node 8 support

Node 8 reached End-of-Life at the end of 2019 and is no longer supported.

Detailed Changelog

🚀 New Feature
💥 Breaking Change
  • eslint-config-react-app, react-error-overlay, react-scripts
  • cra-template-typescript, cra-template, eslint-config-react-app, react-error-overlay, react-scripts
  • eslint-config-react-app
  • create-react-app
  • cra-template-typescript, cra-template, react-scripts
  • babel-plugin-named-asset-import, confusing-browser-globals, create-react-app, react-dev-utils, react-error-overlay, react-scripts
  • create-react-app, react-scripts
  • react-scripts
  • babel-plugin-named-asset-import, babel-preset-react-app, create-react-app, react-app-polyfill, react-dev-utils, react-error-overlay, react-scripts
  • eslint-config-react-app, react-scripts
  • cra-template-typescript, cra-template, create-react-app, react-app-polyfill, react-dev-utils, react-scripts
  • babel-plugin-named-asset-import, babel-preset-react-app, confusing-browser-globals, cra-template-typescript, react-dev-utils, react-error-overlay, react-scripts
🐛 Bug Fix
💅 Enhancement
📝 Documentation
🏠 Internal
🔨 Underlying Tools
  • react-scripts
  • react-error-overlay, react-scripts
  • babel-plugin-named-asset-import, babel-preset-react-app, confusing-browser-globals, cra-template-typescript, cra-template, create-react-app, eslint-config-react-app, react-app-polyfill, react-error-overlay, react-scripts
  • eslint-config-react-app, react-dev-utils, react-scripts
  • babel-plugin-named-asset-import, babel-preset-react-app, confusing-browser-globals, cra-template-typescript, cra-template, create-react-app, eslint-config-react-app, react-dev-utils, react-error-overlay, react-scripts
  • eslint-config-react-app, react-error-overlay, react-scripts
  • cra-template-typescript, cra-template
  • react-app-polyfill
  • react-dev-utils
  • babel-plugin-named-asset-import, babel-preset-react-app, confusing-browser-globals, create-react-app, react-dev-utils, react-error-overlay, react-scripts
  • babel-preset-react-app, cra-template-typescript, cra-template, create-react-app, react-dev-utils, react-error-overlay, react-scripts
  • babel-plugin-named-asset-import, confusing-browser-globals, create-react-app, react-dev-utils, react-error-overlay, react-scripts
  • babel-preset-react-app, create-react-app, react-dev-utils, react-error-overlay, react-scripts
  • babel-plugin-named-asset-import, babel-preset-react-app, create-react-app, react-app-polyfill, react-dev-utils, react-error-overlay, react-scripts
  • eslint-config-react-app, react-scripts
  • babel-plugin-named-asset-import, babel-preset-react-app, confusing-browser-globals, cra-template-typescript, react-dev-utils, react-error-overlay, react-scripts
Committers: 63

v3.4.4

Compare Source

3.4.4 (2020-10-20)

v3.4.4 release bumps resolve-url-loader to a version for which npm audit does not report a vulnerability. Note that this vulnerability did not affect Create React App projects, so this change is only necessary to satisfy auditing tools.

Migrating from 3.4.3 to 3.4.4

Inside any created project that has not been ejected, run:

npm install --save --save-exact [email protected]

or

yarn add --exact [email protected]

v3.4.3

Compare Source

3.4.3 (2020-08-12)

v3.4.3 release bumps terser-webpack-plugin to a version for which npm audit does not report a vulnerability. Note that this vulnerability did not affect Create React App projects, so this change is only necessary to satisfy auditing tools.

Migrating from 3.4.2 to 3.4.3

Inside any created project that has not been ejected, run:

npm install --save --save-exact [email protected]

or

yarn add --exact [email protected]

v3.4.2

Compare Source

3.4.2 (2020-08-11)

v3.4.2 release bumps webpack-dev-server to a version for which npm audit does not report a vulnerability. Note that this vulnerability did not affect Create React App projects, so this change is only necessary to satisfy auditing tools.

Migrating from 3.4.1 to 3.4.2

Inside any created project that has not been ejected, run:

npm install --save --save-exact [email protected]

or

yarn add --exact [email protected]

v3.4.1

Compare Source

3.4.1 (2020-03-20)

v3.4.1 is a maintenance release that includes minor bug fixes and documentation updates including upgrading Babel to fix a bug in the 7.8 release line. This release also brings support for TypeScript 3.8.

🐛 Bug Fix
💅 Enhancement
📝 Documentation
🔨 Underlying Tools
Committers: 9
Migrating from 3.4.0 to 3.4.1

Inside any created project that has not been ejected, run:

npm install --save --save-exact [email protected]

or

yarn add --exact [email protected]

v3.4.0

Compare Source

3.4.0 (2020-02-14)

v3.4.0 is a minor release that adds new features, including support for SSL and setting PUBLIC_URL in development. It also includes a fix for Hot Module Reloading with CSS Modules as well as other bug fixes.

🐛 Bug Fix
💅 Enhancement
📝 Documentation
🔨 Underlying Tools
Committers: 18
Migrating from 3.3.1 to 3.4.0

Inside any created project that has not been ejected, run:

npm install --save --save-exact [email protected]

or

yarn add --exact [email protected]

v3.3.1

Compare Source

3.3.1 (2020-01-31)

v3.3.1 is a maintenance release that includes minor bug fixes and documentation updates.

🐛 Bug Fix
💅 Enhancement
📝 Documentation
🏠 Internal
🔨 Underlying Tools
Committers: 29
Migrating from 3.3.0 to 3.3.1

Inside any created project that has not been ejected, run:

npm install --save --save-exact [email protected]

or

yarn add --exact [email protected]

v3.3.0

Compare Source

3.3.0 (2019-12-04)

v3.3.0 is a minor release that adds new features, including custom templates and support for the new optional chaining and nullish coalescing operators.

Custom Templates

You can now create a new app using custom templates.

We've published our existing templates as cra-template and cra-template-typescript, but we expect to see many great templates from the community over the coming weeks.

The below command shows how you can create a new app with cra-template-typescript.

npx create-react-app my-app --template typescript

Note that you can omit the prefix cra-template- when specifying which template you would like. For TypeScript users, we're deprecating --typescript in favour of --template typescript.

If you don't set a template, we'll create your new app with cra-template - which is just a new name for our base template.

Optional Chaining and Nullish Coalescing Operators

We now support the optional chaining and nullish coalescing operators!

// Optional chaining
a?.(); // undefined if `a` is null/undefined
b?.c; // undefined if `b` is null/unde

@mend-for-jackfan.us.kg mend-for-jackfan.us.kg bot added the security fix Security fix generated by WhiteSource label Nov 30, 2023
@mend-for-jackfan.us.kg mend-for-jackfan.us.kg bot changed the title chore(deps): update dependency react-scripts to v4 chore(deps): update dependency react-scripts to v4 - autoclosed May 4, 2024
@mend-for-jackfan.us.kg mend-for-jackfan.us.kg bot deleted the whitesource-remediate/react-scripts-4.x branch May 4, 2024 07:19
@mend-for-jackfan.us.kg mend-for-jackfan.us.kg bot changed the title chore(deps): update dependency react-scripts to v4 - autoclosed chore(deps): update dependency react-scripts to v4 May 4, 2024
@mend-for-jackfan.us.kg mend-for-jackfan.us.kg bot restored the whitesource-remediate/react-scripts-4.x branch May 4, 2024 18:11
@mend-for-jackfan.us.kg mend-for-jackfan.us.kg bot force-pushed the whitesource-remediate/react-scripts-4.x branch from cbcb07c to 77856a8 Compare May 4, 2024 18:11
@mend-for-jackfan.us.kg mend-for-jackfan.us.kg bot changed the title chore(deps): update dependency react-scripts to v4 chore(deps): update dependency react-scripts to v4 - autoclosed Sep 8, 2024
@mend-for-jackfan.us.kg mend-for-jackfan.us.kg bot deleted the whitesource-remediate/react-scripts-4.x branch September 8, 2024 18:04
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers
No reviews
Assignees
No one assigned
Labels
security fix Security fix generated by WhiteSource
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
0 participants