Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Report High severity vulnerability in react-scripts 3.4.3 dependencies #9840

Closed
mariannekhanfour1 opened this issue Oct 20, 2020 · 3 comments

Comments

@mariannekhanfour1
Copy link

After auditing my app a high vulnerability is detected in the package object-path dependency of react-scripts.
I tried to run an audit fix however I still got the issue 1 vulnerability requires manual review. See the full report for details..
I tried to fix it manually but react-scripts is forcing the use of version 0.11.4 and I need to update it to version 0.11.5 to fix the vulnerability.

React version:
npm version: 6.14.8
current version of react-scripts: 3.4.3

image

@florianeckerstorfer
Copy link

florianeckerstorfer commented Oct 20, 2020

react-scripts sets the version of resolve-url-loader to v3.1.1, the dependency has been updated in resolve-url-loader@3.1.2 (PR). That is, react-scripts needs to update to bump the version of resolve-url-loader.

@johannespfeiffer
Copy link
Contributor

Created this PR to bump the version: #9841

@gaearon
Copy link
Contributor

gaearon commented Oct 20, 2020

Let's discuss in #9842 of which this is a duplicate.

@gaearon gaearon closed this as completed Oct 20, 2020
@facebook facebook locked as resolved and limited conversation to collaborators Oct 20, 2020
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Projects
None yet
Development

No branches or pull requests

4 participants