Automattic / Automattic/fresh-data
Upgrade create-react-app in examples
- Dominant language
- JavaScript
- Stars
- 37
- Forks
- 7
- PR merge metrics
- No merged PRs in 30d
Description
The current version of create-react-app has a security vulnerability. This is only used in the examples, so the exposure is very limited. But still, this should be addressed.
```
SEMVER WARNING: Recommended action is a potentially breaking change
┌───────────────┬──────────────────────────────────────────────────────────────┐
│ High │ Missing Origin Validation │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Package │ webpack-dev-server │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Dependency of │ react-scripts [dev] │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Path │ react-scripts > webpack-dev-server │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ More info │ https://nodesecurity.io/advisories/725 │
└───────────────┴──────────────────────────────────────────────────────────────┘
```
Contributor guide
No contributing guide indexed for this repository
Research direction
Search the examples for package manifests containing create-react-app or react-scripts, then inspect the dependency path to webpack-dev-server. Confirm the available upgrade and its compatibility, run the example checks or dependency audit, and consider the work done when the reported vulnerability is no longer present.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- javascript, react
- Domain
- build-system, security
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 38/100