Skip to content

chore(deps): update dependency react-scripts to v5#13

Open
dev-mend-for-github-com[bot] wants to merge 1 commit intomasterfrom
whitesource-remediate/react-scripts-5.x
Open

chore(deps): update dependency react-scripts to v5#13
dev-mend-for-github-com[bot] wants to merge 1 commit intomasterfrom
whitesource-remediate/react-scripts-5.x

Conversation

@dev-mend-for-github-com
Copy link

@dev-mend-for-github-com dev-mend-for-github-com bot commented Mar 2, 2025 •
edited
Loading

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package Type Update Change
react-scripts (source) dependencies major 1.0.10 → 5.0.0

By merging this PR, the issue #10 will be automatically resolved and closed:

Severity CVSS Score Vulnerability
Critical Critical 9.8 CVE-2018-13797
Critical Critical 9.8 CVE-2018-16492
Critical Critical 9.8 CVE-2019-19919
Critical Critical 9.8 CVE-2020-7720
Critical Critical 9.8 CVE-2021-3918
Critical Critical 9.8 CVE-2021-42740
Critical Critical 9.8 CVE-2021-44906
Critical Critical 9.8 CVE-2021-44906
Critical Critical 9.8 CVE-2022-37601
Critical Critical 9.8 CVE-2022-37601
Critical Critical 9.8 CVE-2023-42282
Critical Critical 9.1 CVE-2022-0686
Critical Critical 9.1 CVE-2022-0686
High High 8.8 CVE-2018-3728
High High 8.8 CVE-2022-0512
High High 8.8 CVE-2022-0512
High High 8.2 CVE-2021-32804
High High 8.2 CVE-2021-37713
High High 8.1 CVE-2022-1650
High High 7.7 CVE-2020-13822
High High 7.5 CVE-2017-16099
High High 7.5 CVE-2018-16469
High High 7.5 CVE-2018-20834
High High 7.5 CVE-2019-13173
High High 7.5 CVE-2019-20922
High High 7.5 CVE-2020-7662
High High 7.5 CVE-2021-23424
High High 7.5 CVE-2021-33623
High High 7.5 CVE-2021-3777
High High 7.5 CVE-2021-3803
High High 7.5 CVE-2021-3807
High High 7.5 CVE-2022-24771
High High 7.5 CVE-2022-24772
High High 7.5 CVE-2022-3517
High High 7.5 CVE-2022-3517
High High 7.5 CVE-2022-37603
High High 7.5 CVE-2024-4068
High High 7.4 CVE-2022-29167
High High 7.3 CVE-2020-28499
High High 7.3 CVE-2020-7774
High High 7.3 CVE-2020-7788
High High 7.3 CVE-2020-8116
High High 7.2 CVE-2021-23337
High High 7.1 CVE-2022-0144
High High 7.1 CVE-2022-46175
Medium Medium 6.8 CVE-2020-28498
Medium Medium 6.5 CVE-2018-21270
Medium Medium 6.5 CVE-2022-0639
Medium Medium 6.5 CVE-2022-0639
Medium Medium 6.5 CVE-2022-0691
Medium Medium 6.5 CVE-2022-0691
Medium Medium 6.1 CVE-2022-0122
Medium Medium 6.1 CVE-2022-1243
Medium Medium 5.6 CVE-2020-15366
Medium Medium 5.6 CVE-2020-15366
Medium Medium 5.6 CVE-2020-7598
Medium Medium 5.6 CVE-2020-7598
Medium Medium 5.6 CVE-2020-7789
Medium Medium 5.6 CVE-2021-23807
Medium Medium 5.3 CVE-2017-16028
Medium Medium 5.3 CVE-2017-16137
Medium Medium 5.3 CVE-2018-1107
Medium Medium 5.3 CVE-2020-7608
Medium Medium 5.3 CVE-2020-7608
Medium Medium 5.3 CVE-2020-7693
Medium Medium 5.3 CVE-2020-8124
Medium Medium 5.3 CVE-2020-8124
Medium Medium 5.3 CVE-2021-23343
Medium Medium 5.3 CVE-2021-23362
Medium Medium 5.3 CVE-2021-23382
Medium Medium 5.3 CVE-2021-23382
Medium Medium 5.3 CVE-2021-27515
Medium Medium 5.3 CVE-2021-27515
Medium Medium 5.3 CVE-2021-29060
Medium Medium 5.3 CVE-2021-3664
Medium Medium 5.3 CVE-2021-3664
Medium Medium 5.3 CVE-2022-24773
Medium Medium 5.3 CVE-2022-25883
Medium Medium 5.3 CVE-2022-25883
Medium Medium 5.3 CVE-2022-33987
Medium Medium 5.3 CVE-2024-4067
Medium Medium 5.3 CVE-2024-42460
Medium Medium 5.3 CVE-2024-42461
Low Low 3.7 CVE-2026-2391
Low Low 3.5 CVE-2017-20165
Low Low 3.1 CVE-2025-5889
Low Low 3.1 CVE-2025-5889
Low Low 2.5 CVE-2025-54798

Release Notes

facebook/create-react-app (react-scripts)

v5.0.0

Compare Source

Inside any created project that has not been ejected, run:

npm install --save --save-exact react-scripts@5.0.1

or

yarn add --exact react-scripts@5.0.1
🐛 Bug Fix
💅 Enhancement
📝 Documentation
🏠 Internal
Committers: 11

5.0.0 (2021-12-14)

Create React App 5.0 is a major release with several new features and the latest version of all major dependencies.

Thanks to all the maintainers and contributors who worked so hard on this release! 🙌

v4.0.3

Compare Source

4.0.3 (2021-02-22)

v4.0.3 is a maintenance release that includes minor bug fixes and dependency updates.

🐛 Bug Fix
🏠 Internal
Committers: 4

Migrating from 4.0.2 to 4.0.3

Inside any created project that has not been ejected, run:

npm install --save --save-exact react-scripts@4.0.3

or

yarn add --exact react-scripts@4.0.3

v4.0.2

Compare Source

4.0.2 (2021-02-03)

v4.0.2 is a maintenance release that includes minor bug fixes and documentation updates.

🚀 New Feature
🐛 Bug Fix
💅 Enhancement
📝 Documentation
🏠 Internal
🔨 Underlying Tools
Committers: 15

v4.0.1

Compare Source

v4.0.1 is a maintenance release that includes minor bug fixes and documentation updates.

🐛 Bug Fix
💅 Enhancement
📝 Documentation
🏠 Internal
Committers: 9

Migrating from 4.0.0 to 4.0.1

Inside any created project that has not been ejected, run:

npm install --save --save-exact react-scripts@4.0.1

or

yarn add --exact react-scripts@4.0.1

v4.0.0

Compare Source

4.0.0 (2020-10-23)

Create React App 4.0 is a major release with several new features, including support for Fast Refresh!

Thanks to all the maintainers and contributors who worked so hard on this release! 🙌

Highlights

  • Fast Refresh #​8582
  • React 17 support
  • TypeScript 4 support #​9734
  • ESLint 7 #​8978
    • New Jest and React Testing Library rules #​8963
  • Jest 26 #​8955
  • PWA/workbox improvements
    • Switch to the Workbox InjectManifest plugin #​9205
    • Now its own template so it can be released independently
  • Web Vitals support #​9116

Migrating from 3.4.x to 4.0.0

Inside any created project that has not been ejected, run:

npm install --save --save-exact react-scripts@4.0.0

or

yarn add --exact react-scripts@4.0.0

NOTE: You may need to delete your node_modules folder and reinstall your dependencies by running yarn (or npm install) if you encounter errors after upgrading.

If you previously ejected but now want to upgrade, one common solution is to find the commits where you ejected (and any subsequent commits changing the configuration), revert them, upgrade, and later optionally eject again. It’s also possible that the feature you ejected for is now supported out of the box.

Breaking Changes

Like any major release, react-scripts@4.0.0 contains a number of breaking changes. We expect that they won't affect every user, but we recommend you look over this section to see if something is relevant to you. If we missed something, please file a new issue.

ESLint

We've upgraded to ESLint 7 and added many new rules including some for Jest and React Testing Library as well as the import/no-anonymous-default-export rule. We've also upgraded eslint-plugin-hooks to version 4.0.0 and removed the EXTEND_ESLINT flag as it is no longer required to customize the ESLint config.

Jest

We've upgraded to Jest 26 and now set resetMocks to true by default in the Jest config.

Service workers

We've switched to the Workbox InjectManifest plugin and moved the PWA templates into their own repository.

Removed typescript flag and NODE_PATH support

We've removed the deprecated typescript flag when creating a new app. Use --template typescript instead. We've also dropped deprecated NODE_PATH flag as this has been replaced by setting the base path in jsconfig.json.

Fix dotenv file loading order

We've changed the loading order of env files to match the dotenv specification. See #​9037 for more details.

Dropped Node 8 support

Node 8 reached End-of-Life at the end of 2019 and is no longer supported.

Detailed Changelog

🚀 New Feature
💥 Breaking Change
  • eslint-config-react-app, react-error-overlay, react-scripts
  • cra-template-typescript, cra-template, eslint-config-react-app, react-error-overlay, react-scripts
  • eslint-config-react-app
  • create-react-app
  • cra-template-typescript, cra-template, react-scripts
  • babel-plugin-named-asset-import, confusing-browser-globals, create-react-app, react-dev-utils, react-error-overlay, react-scripts
  • create-react-app, react-scripts
  • react-scripts
  • babel-plugin-named-asset-import, babel-preset-react-app, create-react-app, react-app-polyfill, react-dev-utils, react-error-overlay, react-scripts
  • eslint-config-react-app, react-scripts
  • cra-template-typescript, cra-template, create-react-app, react-app-polyfill, react-dev-utils, react-scripts
  • babel-plugin-named-asset-import, babel-preset-react-app, confusing-browser-globals, cra-template-typescript, react-dev-utils, react-error-overlay, react-scripts
🐛 Bug Fix
💅 Enhancement
📝 Documentation
🏠 Internal
🔨 Underlying Tools

@dev-mend-for-github-com
Copy link
Author

dev-mend-for-github-com bot commented Mar 2, 2025 •
edited
Loading

⚠️ Artifact update problem

Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

  • any of the package files in this branch needs updating, or
  • the branch becomes conflicted, or
  • you click the rebase/retry checkbox if found above, or
  • you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: package-lock.json
(node:3061) [DEP0169] DeprecationWarning: `url.parse()` behavior is not standardized and prone to errors that have security implications. Use the WHATWG URL API instead. CVEs are not issued for `url.parse()` vulnerabilities.
(Use `node --trace-deprecation ...` to show where the warning was created)
(node:3061) [DEP0060] DeprecationWarning: The `util._extend` API is deprecated. Please use Object.assign() instead.
npm WARN deprecated eslint@8.57.1: This version is no longer supported. Please see https://eslint.org/version-support for other options.
npm WARN deprecated abab@2.0.6: Use your platform's native atob() and btoa() methods instead
npm WARN deprecated rimraf@3.0.2: Rimraf versions prior to v4 are no longer supported
npm WARN deprecated @babel/plugin-proposal-nullish-coalescing-operator@7.18.6: This proposal has been merged to the ECMAScript standard and thus this plugin is no longer maintained. Please use @babel/plugin-transform-nullish-coalescing-operator instead.
npm WARN deprecated @babel/plugin-proposal-class-properties@7.18.6: This proposal has been merged to the ECMAScript standard and thus this plugin is no longer maintained. Please use @babel/plugin-transform-class-properties instead.
npm WARN deprecated @babel/plugin-proposal-numeric-separator@7.18.6: This proposal has been merged to the ECMAScript standard and thus this plugin is no longer maintained. Please use @babel/plugin-transform-numeric-separator instead.
npm WARN deprecated @babel/plugin-proposal-private-property-in-object@7.21.11: This proposal has been merged to the ECMAScript standard and thus this plugin is no longer maintained. Please use @babel/plugin-transform-private-property-in-object instead.
npm WARN deprecated @babel/plugin-proposal-optional-chaining@7.21.0: This proposal has been merged to the ECMAScript standard and thus this plugin is no longer maintained. Please use @babel/plugin-transform-optional-chaining instead.
npm WARN deprecated @babel/plugin-proposal-private-methods@7.18.6: This proposal has been merged to the ECMAScript standard and thus this plugin is no longer maintained. Please use @babel/plugin-transform-private-methods instead.
npm WARN deprecated @humanwhocodes/config-array@0.13.0: Use @eslint/config-array instead
npm WARN deprecated glob@7.2.3: Old versions of glob are not supported, and contain widely publicized security vulnerabilities, which have been fixed in the current version. Please update. Support for old versions may be purchased (at exorbitant rates) by contacting i@izs.me
npm WARN deprecated source-map@0.8.0-beta.0: The work that was done in this beta branch won't be included in future versions
npm WARN deprecated rollup-plugin-terser@7.0.2: This package has been deprecated and is no longer maintained. Please use @rollup/plugin-terser
npm WARN deprecated workbox-google-analytics@6.6.0: It is not compatible with newer versions of GA starting with v4, as long as you are using GAv3 it should be ok, but the package is not longer being maintained
npm WARN deprecated workbox-cacheable-response@6.6.0: workbox-background-sync@6.6.0
npm WARN deprecated @humanwhocodes/object-schema@2.0.3: Use @eslint/object-schema instead
npm WARN deprecated svgo@1.3.2: This SVGO version is no longer supported. Upgrade to v2.x.x.
npm WARN deprecated stable@0.1.8: Modern JS already guarantees Array#sort() is a stable sort, so this library is deprecated. See the compatibility table on MDN: https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/Array/sort#browser_compatibility
npm WARN deprecated sourcemap-codec@1.4.8: Please use @jridgewell/sourcemap-codec instead
npm WARN deprecated domexception@2.0.1: Use your platform's native DOMException instead
npm WARN deprecated w3c-hr-time@1.0.2: Use your platform's native performance.now() and performance.timeOrigin.
npm WARN deprecated whatwg-encoding@1.0.5: Use @exodus/bytes instead for a more spec-conformant and faster implementation
npm WARN optional SKIPPING OPTIONAL DEPENDENCY: fsevents@^2.3.2 (node_modules/react-scripts/node_modules/fsevents):
npm WARN notsup SKIPPING OPTIONAL DEPENDENCY: Unsupported platform for fsevents@2.3.3: wanted {"os":"darwin","arch":"any"} (current: {"os":"linux","arch":"x64"})
npm WARN optional SKIPPING OPTIONAL DEPENDENCY: fsevents@^2.3.2 (node_modules/jest-haste-map/node_modules/fsevents):
npm WARN notsup SKIPPING OPTIONAL DEPENDENCY: Unsupported platform for fsevents@2.3.3: wanted {"os":"darwin","arch":"any"} (current: {"os":"linux","arch":"x64"})
npm WARN optional SKIPPING OPTIONAL DEPENDENCY: fsevents@~2.3.2 (node_modules/fork-ts-checker-webpack-plugin/node_modules/chokidar/node_modules/fsevents):
npm WARN notsup SKIPPING OPTIONAL DEPENDENCY: Unsupported platform for fsevents@2.3.3: wanted {"os":"darwin","arch":"any"} (current: {"os":"linux","arch":"x64"})
npm WARN optional SKIPPING OPTIONAL DEPENDENCY: fsevents@~2.3.2 (node_modules/tailwindcss/node_modules/chokidar/node_modules/fsevents):
npm WARN notsup SKIPPING OPTIONAL DEPENDENCY: Unsupported platform for fsevents@2.3.3: wanted {"os":"darwin","arch":"any"} (current: {"os":"linux","arch":"x64"})
npm WARN optional SKIPPING OPTIONAL DEPENDENCY: fsevents@~2.3.2 (node_modules/webpack-dev-server/node_modules/chokidar/node_modules/fsevents):
npm WARN notsup SKIPPING OPTIONAL DEPENDENCY: Unsupported platform for fsevents@2.3.3: wanted {"os":"darwin","arch":"any"} (current: {"os":"linux","arch":"x64"})
npm WARN optional SKIPPING OPTIONAL DEPENDENCY: fsevents@~2.3.2 (node_modules/rollup/node_modules/fsevents):
npm WARN notsup SKIPPING OPTIONAL DEPENDENCY: Unsupported platform for fsevents@2.3.3: wanted {"os":"darwin","arch":"any"} (current: {"os":"linux","arch":"x64"})

npm ERR! Error while executing:
npm ERR! /usr/bin/git ls-remote -h -t ssh://git@github.com/r-park/minx.git
npm ERR! 
npm ERR! Host key verification failed.
npm ERR! fatal: Could not read from remote repository.
npm ERR! 
npm ERR! Please make sure you have the correct access rights
npm ERR! and the repository exists.
npm ERR! 
npm ERR! exited with error code: 128

npm ERR! A complete log of this run can be found in:
npm ERR!     /tmp/renovate/cache/others/npm/_logs/2026-03-03T19_49_31_258Z-debug.log

@dev-mend-for-github-com dev-mend-for-github-com bot added the security fix Security fix generated by Mend label Mar 2, 2025
@dev-mend-for-github-com dev-mend-for-github-com bot force-pushed the whitesource-remediate/react-scripts-5.x branch from 56c55a0 to 959e71c Compare January 22, 2026 14:45
@dev-mend-for-github-com dev-mend-for-github-com bot force-pushed the whitesource-remediate/react-scripts-5.x branch from 959e71c to 2731249 Compare March 3, 2026 19:49
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

security fix Security fix generated by Mend

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants