Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Remove react-scripts (SCP-5143) #1799

Merged
merged 7 commits into from
Jun 20, 2023
Merged

Remove react-scripts (SCP-5143) #1799

merged 7 commits into from
Jun 20, 2023

Conversation

ehanna4
Copy link
Contributor

@ehanna4 ehanna4 commented Jun 12, 2023

We were alerted by App-sec that the dependency "NTH-check" had a vulnerability that required updating. Further investigation by the team determined NTH-check is occurring in react-scripts and it appears that react-scripts is no longer being maintained. Therefore we opted to remove react-scripts from our code.

Since the team already did a huge chunk of work moving to Vite the lift was not too large to remove react-scripts now.

The changes in this PR were tested locally and on staging. Tests all passed locally, builds built on staging and locally, and running through the release engineering tests on staging all worked as expected.

In removing react-scripts yarn required adding three dependencies around an existing dependency postcss

Testing locally you can pull this branch and run bundle install and yarn install and boot up vite
bin/vite dev
and boot up a local server
./rails_local_setup.rb && source config/secrets/.source_env.bash && bin/rails s
and confirm you can see localhost

@ehanna4 ehanna4 changed the title Remove react-scripts Remove react-scripts (SCP-5143) Jun 12, 2023
Copy link
Member

@eweitz eweitz left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Nice! Related upstream CRA issue: facebook/create-react-app#13186.

Do things work if the new 3 packages are moved from dependencies to devDependencies? If so, that'd enable faster build times, and (theoretically, due to less JS being downloaded and parsed) slightly faster page load times.

@ehanna4
Copy link
Contributor Author

ehanna4 commented Jun 12, 2023

@eweitz good idea, locally it appears moving the 3 new dependencies to devDependencies does work. I'll make that change and will double check staging once merged

@bistline
Copy link
Contributor

Looks like all the yarn tests are failing with the same import issue:

Cannot find module 'babel-plugin-dynamic-import-node'

@ehanna4 ehanna4 requested review from bistline and eweitz June 20, 2023 14:34
@ehanna4 ehanna4 merged commit 3541a8f into development Jun 20, 2023
@github-actions github-actions bot deleted the eh-2-remove-rescripts branch June 20, 2023 18:02
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants