Automattic / Automattic/fresh-data

Upgrade create-react-app in examples

Open
#104 0 comments 0 reactions 0 assignees View on GitHub
bug
Dominant language
JavaScript
Stars
37
Forks
7
PR merge metrics
No merged PRs in 30d

Description

The current version of create-react-app has a security vulnerability. This is only used in the examples, so the exposure is very limited. But still, this should be addressed.

```
SEMVER WARNING: Recommended action is a potentially breaking change
┌───────────────┬──────────────────────────────────────────────────────────────┐
│ High │ Missing Origin Validation │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Package │ webpack-dev-server │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Dependency of │ react-scripts [dev] │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Path │ react-scripts > webpack-dev-server │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ More info │ https://nodesecurity.io/advisories/725 │
└───────────────┴──────────────────────────────────────────────────────────────┘
```

Contributor guide

No contributing guide indexed for this repository

Research direction

Search the examples for package manifests containing create-react-app or react-scripts, then inspect the dependency path to webpack-dev-server. Confirm the available upgrade and its compatibility, run the example checks or dependency audit, and consider the work done when the reported vulnerability is no longer present.

Written by the indexing model from the issue text.

Assessment

Tech stack
javascript, react
Domain
build-system, security
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
38/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.