Skip to content

[Snyk] Fix for 2 vulnerabilities #120

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
saurabharch wants to merge 1 commit into
base: next
Choose a base branch
from
Open

[Snyk] Fix for 2 vulnerabilities #120

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
10 changes: 5 additions & 5 deletions packages/react-scripts/package.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -36,7 +36,7 @@
"css-loader": "0.28.11",
"dotenv": "5.0.1",
"dotenv-expand": "4.2.0",
"eslint": "4.19.1",
"eslint": "9.0.0",

@gemini-code-assist gemini-code-assist Bot Feb 15, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

critical

Upgrading eslint from v4 to v9 is a major breaking change that will break the build process.

  1. The dependency eslint-config-react-app (version 2.1.0) has a peer dependency on eslint: ^4.1.1. This upgrade will cause a peer dependency conflict. eslint-config-react-app and its own dependencies would need to be upgraded as well.
  2. The webpack configurations use eslint-loader, which is deprecated and not compatible with ESLint v9. It needs to be replaced with eslint-webpack-plugin, which requires configuration changes in webpack.config.*.js files.

"eslint-config-react-app": "^2.1.0",
"eslint-loader": "2.0.0",
"eslint-plugin-flowtype": "2.46.3",
Expand All @@ -50,24 +50,24 @@
"html-webpack-plugin": "3.2.0",
"identity-obj-proxy": "3.0.0",
"loader-utils": "^1.1.0",
"jest": "22.4.3",
"jest": "26.0.0",

@gemini-code-assist gemini-code-assist Bot Feb 15, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

critical

Upgrading jest from v22 to v26 without also upgrading babel-jest (currently at 22.4.3) will cause test failures. These packages are typically kept in sync. Additionally, Jest 26 introduces breaking changes, and the Jest configuration in scripts/utils/createJestConfig.js may need to be updated to be fully compatible (e.g. setupTestFrameworkScriptFile is deprecated).

"mini-css-extract-plugin": "^0.4.0",
"object-assign": "4.1.1",
"postcss-flexbugs-fixes": "3.3.1",
"optimize-css-assets-webpack-plugin": "^4.0.1",
"postcss-loader": "2.1.5",
"postcss-loader": "5.0.0",

@gemini-code-assist gemini-code-assist Bot Feb 15, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

critical

Upgrading postcss-loader from v2 to v5 is a breaking change that requires updates to the webpack configuration. The current configuration format in webpack.config.dev.js and webpack.config.prod.js is incompatible with postcss-loader v5. For example, the options need to be nested under a postcssOptions key.

"promise": "8.0.1",
"raf": "3.4.0",
"react-dev-utils": "^5.0.0",
"resolve": "1.6.0",
"sass-loader": "7.0.1",
"style-loader": "0.21.0",
"style-loader": "3.0.0",
"svgr": "1.9.2",
"sw-precache-webpack-plugin": "0.11.5",
"thread-loader": "1.1.5",
"uglifyjs-webpack-plugin": "1.2.5",
"url-loader": "1.0.1",
"webpack": "4.8.3",
"webpack": "5.0.0",

@gemini-code-assist gemini-code-assist Bot Feb 15, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

critical

Upgrading webpack from v4 to v5 is a major migration with many breaking changes. The existing webpack configurations (webpack.config.dev.js, webpack.config.prod.js) will not work with Webpack 5 and will break the entire build and development process.

Key incompatibilities include:

  • uglifyjs-webpack-plugin is used for minification, but Webpack 5 uses terser-webpack-plugin by default. uglifyjs-webpack-plugin is not compatible.
  • webpack-dev-server is at version 3.1.4, but Webpack 5 requires webpack-dev-server v4.
  • Other plugins like optimize-css-assets-webpack-plugin and sw-precache-webpack-plugin may also be incompatible or have been superseded.

"webpack-dev-server": "3.1.4",
"webpack-manifest-plugin": "2.0.3",
"whatwg-fetch": "2.0.4"
Expand Down