Rethink decision to make react-scripts a dependency instead of a devDependency

Is your proposal related to a problem?

The decision to make react-scripts a dependency causes a lot of issues regarding perceived security vulnerabilities. Even though the issues themselves are technically harmless, these issues often break CI/CD flows and/or end up being reported here as actual issues.

Describe the solution you’d like

The decision to make react-scripts a dependency was in my opinion ill-conceived. There are issues with having react-scrips a devDependency as stated in the original pull request:

• The distinction does not make sense. Nonetheless, tools like npm audit are dependent on this distinction.
• Apparently some people build on the production server? They shouldn’t.
• An actual run-time dependency in the form of a polyfill is included. This could be a separate (and optional?) dependency.
• Eject crashes in some situations (issue #2655)
• Possibly other issues…

In my opinion, a shortcut was taken to work around some problems that should have been fixed separately.

Describe alternatives you’ve considered

It’s possible to move react-scripts to devDependencies by hand, or to eject your React application. Both solve the problem (afaict) but a lot of people are not willing to do this or are unaware of the possibility.

Another possibility would be for the developers to update dependencies whenever a vulnerability pops up as fast as possible, and/or to help developers of dependent package to fix their dependencies. Maybe get Facebook to throw some money behind a React Vulnerability Strike Team ™ or something.

Additional context

One way or another a solution is needed. Every time some vulnerability pops up I see a lot of frustration in the comments. Even though someone always politely explains the actual security implications, there are always a few people saying (and probably more people thinking) that you don’t actually care that much about security. Rationally I know this not to be true, but I get frustrated as well sometimes (I’m only human after all).

[stahlmanDesign]

All of these issues are duplicates or are related: https://github.com/facebook/create-react-app/issues/11136 https://github.com/facebook/create-react-app/issues/11131 https://github.com/facebook/create-react-app/issues/11118 https://github.com/facebook/create-react-app/issues/11116 https://github.com/facebook/create-react-app/issues/11109 https://github.com/facebook/create-react-app/issues/11092 https://github.com/facebook/create-react-app/issues/11081 https://github.com/facebook/create-react-app/issues/11077 https://github.com/facebook/create-react-app/issues/11067 https://github.com/facebook/create-react-app/issues/11054

and could be solved by #11102

[mrwensveen]

@rvramesh You’re correct. The vulnerabilities will only be ignored when you run npm audit --production, which is usually the case when audit is integrated in your CI/CD setup. Without the option the output will show the vulnerability but with a [dev] tag.