Stuck on an issue?

Lightrun Answers was designed to reduce the constant googling that comes with debugging 3rd party libraries. It collects links to all the places you might be looking at while hunting down a tough bug.

And, if you’re still stuck at the end, we’re happy to hop on a call to see how we can help out.

Report High severity vulnerability in react-scripts 3.4.3 dependencies

See original GitHub issue

After auditing my app a high vulnerability is detected in the package object-path dependency of react-scripts. I tried to run an audit fix however I still got the issue 1 vulnerability requires manual review. See the full report for details.. I tried to fix it manually but react-scripts is forcing the use of version 0.11.4 and I need to update it to version 0.11.5 to fix the vulnerability.

React version: npm version: 6.14.8 current version of react-scripts: 3.4.3

Issue Analytics

State:
Created 3 years ago
Reactions:11
Comments:20 (13 by maintainers)

Top GitHub Comments

22reactions

gaearoncommented, Oct 20, 2020

OK, it looks like resolve-url-loader was using an exact dependency (https://github.com/bholloway/resolve-url-loader/commit/4702ae9f1e4c9c0c2142c3f2184d0bbdeebc0de2) so cutting a patch at a lower level wouldn’t have helped anyway in this case. I’ll make a patch of react-scripts later today. I’m also going to unpin the react-scripts dependencies for 3.x so that we can get the latest fixes going forward as long as they’re on the same minors.

8reactions

gaearoncommented, Oct 20, 2020

I bumped just resolve-url-loader alone in react-scripts@3.4.4.