Vulnerabilty in webpack-dev-server dependency of react-app-tools
- Dominant language
- JavaScript
- Stars
- 612
- Forks
- 76
- PR merge metrics
- No merged PRs in 30d
Description
Hello can you fix the dependency of the react-app-tools by making it to its new version min. 3.1.6?
=== npm audit security report ===
┌──────────────────────────────────────────────────────────────────────────────┐
│ Manual Review │
│ Some vulnerabilities require your attention to resolve │
│ │
│ Visit https://go.npm.me/audit-guide for additional guidance │
└──────────────────────────────────────────────────────────────────────────────┘
┌───────────────┬──────────────────────────────────────────────────────────────┐
│ High │ Missing Origin Validation │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Package │ webpack-dev-server │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Patched in │ >=3.1.6 │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Dependency of │ react-app-tools [dev] │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Path │ react-app-tools > webpack-dev-server │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ More info │ https://nodesecurity.io/advisories/725 │
└───────────────┴──────────────────────────────────────────────────────────────┘
Contributor guide
No contributing guide indexed for this repository
Research direction
Start by locating the react-app-tools dependency declaration and any lockfile entry for webpack-dev-server. Update the dependency to version 3.1.6 or later, then run the npm audit report to confirm that the reported vulnerability is resolved.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- javascript, react, webpack
- Domain
- security, tooling
- Issue type
- Bug
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 45/100