[Snyk] Fix for 25 vulnerabilities

[snyk-bot]

Snyk has created this PR to fix one or more vulnerable packages in the `npm` dependencies of this project.

Changes included in this PR

• Changes to the following files to upgrade the vulnerable dependencies to a fixed version:
  • packages/react-scripts/package.json

Vulnerabilities that will be fixed

With an upgrade:

Severity	Priority Score (*)	Issue	Breaking Change	Exploit Maturity
	696/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 7.5	Regular Expression Denial of Service (ReDoS) SNYK-JS-ANSIHTML-1296849	No	Proof of Concept
	696/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 7.5	Regular Expression Denial of Service (ReDoS) SNYK-JS-ANSIREGEX-1583908	Yes	Proof of Concept
	586/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 5.3	Regular Expression Denial of Service (ReDoS) SNYK-JS-BROWSERSLIST-1090194	Yes	Proof of Concept
	479/1000 Why? Has a fix available, CVSS 5.3	Regular Expression Denial of Service (ReDoS) SNYK-JS-CSSWHAT-1298035	Yes	No Known Exploit
	586/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 5.3	Regular Expression Denial of Service (ReDoS) SNYK-JS-GLOBPARENT-1016905	Yes	Proof of Concept
	696/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 7.5	Prototype Pollution SNYK-JS-IMMER-1019369	Yes	Proof of Concept
	601/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 5.6	Prototype Pollution SNYK-JS-IMMER-1540542	Yes	Proof of Concept
	429/1000 Why? Has a fix available, CVSS 4.3	Reverse Tabnabbing SNYK-JS-ISTANBULREPORTS-2328088	Yes	No Known Exploit
	586/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 5.3	Open Redirect SNYK-JS-NODEFORGE-2330875	Yes	Proof of Concept
	529/1000 Why? Has a fix available, CVSS 6.3	Prototype Pollution SNYK-JS-NODEFORGE-2331908	Yes	No Known Exploit
	494/1000 Why? Has a fix available, CVSS 5.6	Improper Verification of Cryptographic Signature SNYK-JS-NODEFORGE-2430337	Yes	No Known Exploit
	579/1000 Why? Has a fix available, CVSS 7.3	Improper Verification of Cryptographic Signature SNYK-JS-NODEFORGE-2430339	Yes	No Known Exploit
	494/1000 Why? Has a fix available, CVSS 5.6	Improper Verification of Cryptographic Signature SNYK-JS-NODEFORGE-2430341	Yes	No Known Exploit
	696/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 7.5	Regular Expression Denial of Service (ReDoS) SNYK-JS-NTHCHECK-1586032	Yes	Proof of Concept
	686/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 7.3	Prototype Pollution SNYK-JS-OBJECTPATH-1017036	No	Proof of Concept
	494/1000 Why? Has a fix available, CVSS 5.6	Prototype Pollution SNYK-JS-OBJECTPATH-1569453	No	No Known Exploit
	590/1000 Why? Has a fix available, CVSS 7.3	Prototype Pollution SNYK-JS-OBJECTPATH-1585658	No	No Known Exploit
	586/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 5.3	Regular Expression Denial of Service (ReDoS) SNYK-JS-POSTCSS-1090595	No	Proof of Concept
	586/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 5.3	Regular Expression Denial of Service (ReDoS) SNYK-JS-POSTCSS-1255640	No	Proof of Concept
	601/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 5.6	Command Injection SNYK-JS-REACTDEVUTILS-1083268	Yes	Proof of Concept
	706/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 7.7	Arbitrary Code Injection SNYK-JS-SERIALIZEJAVASCRIPT-570062	No	Proof of Concept
	619/1000 Why? Has a fix available, CVSS 8.1	Remote Code Execution (RCE) SNYK-JS-SHELLQUOTE-1766506	Yes	No Known Exploit
	586/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 5.3	Denial of Service (DoS) SNYK-JS-SOCKJS-575261	No	Proof of Concept
	479/1000 Why? Has a fix available, CVSS 5.3	Regular Expression Denial of Service (ReDoS) SNYK-JS-UGLIFYJS-1727251	No	No Known Exploit
	601/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 5.6	Prototype Pollution SNYK-JS-YARGSPARSER-560381	No	Proof of Concept

(*) Note that the real score may have changed since the PR was raised.

Commit messages

Package name: @svgr/webpack

The new version differs by 197 commits.

• af9a6cb v6.0.0
• e9469c3 Merge pull request Improve the output of scripts/init.js facebook/create-react-app#629 from gregberge/rewriting-docs
• eb3282b docs: rewriting
• 6f832f0 Merge pull request WIP: Add a default .npmrc file. facebook/create-react-app#627 from gregberge/support-css-variables
• cbdb47f fix: support CSS variables
• 985444d chore: fix package-lock.json
• a5effba v6.0.0-alpha.4
• 3f071d6 Merge pull request Support for class attribute instead of className in JSX facebook/create-react-app#626 from gregberge/upgrade-deps
• daf6a08 chore(deps): upgrade
• 1c5f163 Merge pull request Link css in index.html, ReferenceError: window not defined facebook/create-react-app#625 from gregberge/icon-size
• 483560d chore: fix package-lock.json
• 3c0b779 feat: allow to specify icon size
• 6ba16a3 Merge pull request Add support for *.jpeg file extension. facebook/create-react-app#624 from gregberge/various-things
• f61c8ba chore: fix ref following refactoring
• 261e1b5 v6.0.0-alpha.3
• fe5c117 Merge pull request Can't parse .jpeg extension module facebook/create-react-app#623 from gregberge/webpack
• 9a4cbce docs(examples): update examples
• 1a8cc98 fix(webpack): fix webpack 5 behaviour with url-loader
• a857bb1 feat: support mask-type property (Proposal: IDE integration API facebook/create-react-app#621)
• 5966714 fix(template): make it possible to use type in template (feat: Add --no-open-browser cli option facebook/create-react-app#619)
• 9ea5da4 refactor(core): use exportName transform (Cannot create in a folder called "react" facebook/create-react-app#616)
• 8a1b0aa docs(readme): Fixing CRA link (Meta tag with image url content facebook/create-react-app#618)
• 00a1d4b chore: fix package-lock.json
• f729efa v6.0.0-alpha.2

See the full diff

Package name: html-webpack-plugin

The new version differs by 202 commits.

• 873d75b chore(release): 5.5.0
• ddeb774 chore: update examples
• 1e42625 feat: Support type=module via scriptLoading option
• 7d3645b Bump pretty-error to 4.0.0 to fix transitive vuln for ansi-regex CVE-2021-3807
• 79be779 [chore] changes actions to run on pull_requests
• b7e5859 [chore] fixes CI to avoid race conditions
• 48131d3 chore(release): 5.4.0
• 16a841a [chore] rebuild examples
• 3bb7c17 Update index.js
• e38ac97 Update index.js
• f08bd02 [chore] updates fixtures
• d62a10f [chore] upgrades html-minifier-terser@5.0.0 -> 6.0.2
• 2f5de7a Remove archived plugin
• 8f8f7c5 chore(release): 5.3.2
• 053c6e6 chore: update snapshot tests for webpack 5.4.0
• 9c7fba0 Fix security vulnerabilities
• b98fbeb Fix security vulnerabilities
• 25cdfc7 Added inject-body-webpack-plugin to readme
• 0e4c1fb Update README to document actual behavior
• 0a6568d chore(release): 5.3.1
• 82d0ee8 fix: remove loader-utils from plugin core
• 6f39192 chore(release): 5.3.0
• d654f5b feat: allow to modify the interpolation options in webpack config
• 41d7a50 feat: drop loader-utils dependency

See the full diff

Package name: jest

The new version differs by 22 commits.

• ff9269b chore: bump most dated deps (Nunca descarga y jamas inicia facebook/create-react-app#8850)
• 7594141 chore: upgrade to eslint@6 (Testing: waitFor is not a function facebook/create-react-app#8855)
• b33ce0d chore: upgrade to micromatch v4 (Fix type for PUBLIC_URL in cra-template-typescript facebook/create-react-app#8852)
• d6ff72a chore: add node 12 to CI (support rootDirs in typescript facebook/create-react-app#8411)
• 7e9b4ea chore: upgrade jsdom (React-dev-utils/webpackHotDevClient breaks when updating facebook/create-react-app#8851)
• 4bb7a2d Use `weak-napi` instead of `weak` in `jest-leak-detector`
• ce47c6c Get rid of Node 6 support (Add emotion support to cra facebook/create-react-app#8455)
• bc5c3c7 jest-snapshot: Remove only the added newlines in multiline snapshots (Project gets stuck after found 0 vulnerabilities in both React as well as React Native facebook/create-react-app#8859)
• d523fa8 bug.md: highlights placeholder should be removed (Why should .env files be checked into source control facebook/create-react-app#8836)
• 08f109c expect: Display expectedDiff more carefully in toBeCloseTo (Fix(env): stringified with descriptive keys facebook/create-react-app#8389)
• b09de2d chore: bump node-notifier for node v6 support
• 557a39f fix(linter): Fix linting failure introduced in webpack bug locally facebook/create-react-app#8847 😓 ([eslint-config-react-app] Recommended way of config integration with ESLint, TypeScript, Prettier and VS Code facebook/create-react-app#8849)
• 012472b fix(docs): Update broken links in docs. (webpack bug locally facebook/create-react-app#8847)
• ee2bea1 chore: sort member in imports (Abosnd02 facebook/create-react-app#8846)
• 9ba4594 add Chinese Jest work with AngularJS tutorial (Moving npmrc facebook/create-react-app#8828)
• 0e5b363 chore: reduce reliance on esModuleInterop (Set margin and padding 0 for error overlay iframe facebook/create-react-app#8842)
• d69f8d3 getTimerCount will not include cancelled immediates (Slow installation facebook/create-react-app#8764)
• b4bd77b Fix grammar: "your jest's config"->"your Jest..." (React code fail in production due to the use of the "of" operator  facebook/create-react-app#8843)
• 54b3dcf Fix grammar: "a known issues"->"a known issue" (Support template sources outside of npmjs.com facebook/create-react-app#8844)
• e76c7da docs: update matchMedia methods (LESS is very good, why not consider supporting it? facebook/create-react-app#8835)
• 23b9860 chore: roll new version of docs
• 3cdbd55 Release 24.9.0

See the full diff

Package name: optimize-css-assets-webpack-plugin

The new version differs by 5 commits.

• 09d29b3 5.0.5
• d0a7da7 feat(deps): update dependencies (initial settings for editorconfig facebook/create-react-app#154)
• 41d1e23 Redirect to css-minimizer-webpack-plugin for webpack 5 or above
• e9b84f1 5.0.4
• b3a3ada Update dependencies (Adds simple HMR for React facebook/create-react-app#133)

See the full diff

Package name: react-dev-utils

The new version differs by 250 commits.

• 221e511 Publish
• 6a3315b Update CONTRIBUTING.md
• 5614c87 Add support for Tailwind (Add support for Tailwind facebook/create-react-app#11717)
• 657739f chore(test): make all tests install with `npm ci` (chore(test): make all tests install with npm ci facebook/create-react-app#11723)
• 20edab4 fix(webpackDevServer): disable overlay for warnings (fix(webpackDevServer): disable overlay for warnings facebook/create-react-app#11413)
• 69321b0 Remove cached lockfile (Remove cached lockfile facebook/create-react-app#11706)
• 3afbbc0 Update all dependencies (Update all dependencies facebook/create-react-app#11624)
• f5467d5 feat(eslint-config-react-app): support ESLint 8.x (feat(eslint-config-react-app): support ESLint 8.x facebook/create-react-app#11375)
• e8319da [WIP] Fix integration test teardown / cleanup and missing yarn installation ([WIP] Fix integration test teardown / cleanup and missing yarn installation facebook/create-react-app#11686)
• c7627ce Update webpack and dev server (Update webpack and dev server facebook/create-react-app#11646)
• f85b064 The default port used by `serve` has changed (The default port used by serve has changed facebook/create-react-app#11619)
• 544befe Update package.json (Update package.json facebook/create-react-app#11597)
• 9d0369b Fix ESLint Babel preset resolution (Fix ESLint Babel preset resolution facebook/create-react-app#11547)
• d7b23c8 test(create-react-app): assert for exit code (test(create-react-app): assert for exit code facebook/create-react-app#10973)
• 1465357 Prepare 5.0.0 alpha release
• 3880ba6 Remove dependency pinning (Remove dependency pinning facebook/create-react-app#11474)
• 8b9fbee Update CODEOWNERS
• cacf590 Bump template dependency version (Bump template dependency version facebook/create-react-app#11415)
• 5cedfe4 Bump browserslist from 4.14.2 to 4.16.5 (Bump browserslist from 4.14.2 to 4.16.5 facebook/create-react-app#11476)
• 50ea5ad allow CORS on webpack-dev-server (allow CORS on webpack-dev-server facebook/create-react-app#11325)
• 63bba07 Upgrade jest and related packages from 26.6.0 to 27.1.0 (Upgrade jest and related packages from 26.6.0 to 27.1.0 facebook/create-react-app#11338)
• 960b21e Bump immer from 8.0.4 to 9.0.6 (Bump immer from 8.0.4 to 9.0.6 facebook/create-react-app#11364)
• 134cd3c Resolve dependency issues in v5 alpha (fix: resolve dependency issues in v5 alpha facebook/create-react-app#11294)
• b45ae3c Update CONTRIBUTING.md

See the full diff

Package name: terser-webpack-plugin

The new version differs by 29 commits.

• 171819e chore(release): 2.3.6
• d3f0c81 fix: preserve `@ license` comments starting with `//`
• 7105dc3 ci: migrate on github actions
• 6ad3f5d chore(release): 2.3.5
• fac58cb fix: do not break code with shebang
• ba1cb8a chore(deps): update (CSS @keyframes Best Practice facebook/create-react-app#219)
• 8ed6b7e docs(readme): update `parallel` option and explain fix for circleci (Add a test runner and template Enzyme test. facebook/create-react-app#216)
• 2da2c1a chore(release): 2.3.4
• 5708574 fix: respect stdout and stderr of workers and do not create warnings (Proposal: 'configurator' field in package.json facebook/create-react-app#215)
• 8d9837d refactor: code and test (Decorator is not supported! facebook/create-react-app#214)
• 330c1f6 fix: use webpack hashFunction rather than hard-code MD4 (Add postcss-use plugin facebook/create-react-app#213)
• 6b45dbe chore(release): 2.3.3
• fe67963 chore(deps): update (Trigger recompilation on node module changes. facebook/create-react-app#212)
• abfd950 fix: reduce memory usage
• de02f7b fix: license files now have .txt suffix by default (Use WebpackMD5Hash and ChunkManifestPlugin? facebook/create-react-app#210)
• 0aa35d4 chore(deps): update (Removing propTypes in production build? facebook/create-react-app#209)
• 87001f2 chore: update husky to the latest version (Add react-app to Alternatives section in README.md facebook/create-react-app#208)
• bac5fcc chore: deps update (How to add something like react-router? facebook/create-react-app#207)
• 98765d5 chore(release): 2.3.2
• 3b28007 fix: show error message from jest-worker (npm run build with prerender facebook/create-react-app#203)
• 0e2da43 chore(release): 2.3.1
• d2acd75 fix: performance (npm start fails after copying a generated project to a new directory  facebook/create-react-app#200)
• 0bc8435 chore(release): 2.3.0
• 3649b3d feat: support webpack@5 cache

See the full diff

Package name: webpack-dev-server

The new version differs by 250 commits.

• 5280ee7 docs: fix typo
• d834582 chore(release): 4.7.3
• 7b8c85b chore(deps): update `selfsigned` (yarn deploy fails to build a mirror-saga dependencies facebook/create-react-app#4170)
• d598325 chore: fix lint
• c1907f1 refactor: remove redundant `if` statements (serve app under homepage facebook/create-react-app#4158)
• e535f25 ci: debug (Failed to compile when npm start project created by create-react-app my-app --scripts-version=react-scripts-ts  facebook/create-react-app#4144)
• 75999bb chore(release): 4.7.2
• 90a96f7 ci: fix (Will chokidar_usepolling=true start up the server faster in my docker container? facebook/create-react-app#4143)
• f6bc644 fix: compatible with `onAfterSetupMiddleware`
• 317e4b9 docs: fix testing instructions (Create React App integrated in an existing application facebook/create-react-app#4133)
• ff4550e test: remove redundant test cases related to 3rd party code (yarn test gets broken when I install antd package in my project. wat?! o_O facebook/create-react-app#4131)
• 0dd1ee6 test: add e2e tests for `setupExitSignals` option (async js chunks that include css imports cause => Uncaught (in promise) TypeError: Cannot read property 'call' of undefined facebook/create-react-app#4130)
• afe4975 chore(release): 4.1.7
• 4e5d8ea fix: droped `url` package (Heroku app returns Not Found when going to specific url Route facebook/create-react-app#4132)
• b0c98f0 chore(release): 4.7.0
• 3138213 chore(deps): update (Testing with a Proxy facebook/create-react-app#4127)
• 8f02c3f feat: added types
• f4fb15f fix: update description of `onAfterSetupMiddleware` and `onBeforeSetupMiddleware` options (wikipedia link change facebook/create-react-app#4126)
• 37b73d5 test: add e2e test for `WEBPACK_SERVE` env variable (Use babel-plugin-react-native-web facebook/create-react-app#4125)
• f5a9d05 chore(deps-dev): bump eslint from 8.4.1 to 8.5.0 (Prod config produces invalid font-family values in minified CSS facebook/create-react-app#4121)
• c9b959f chore(deps): bump ws from 8.3.0 to 8.4.0 (Error when calling npm start. Help please. facebook/create-react-app#4124)
• 42208aa chore(deps-dev): bump lint-staged from 12.1.2 to 12.1.3 (Preserve quotes in font values during minification facebook/create-react-app#4122)
• f440f84 chore(deps): bump express from 4.17.1 to 4.17.2 (add sample scaffolding in CRA facebook/create-react-app#4120)
• c13aa56 feat: added the `setupMiddlewares` option (babel-preset-react-app with babel-preset-env facebook/create-react-app#4068)

See the full diff

Check the changes in this PR to ensure they won't cause issues with your project.

---

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report

🛠 Adjust project settings

📚 Read more about Snyk's upgrade and patch logic

---

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Prototype Pollution
🦉 Open Redirect
🦉 Prototype Pollution
🦉 More lessons are available in Snyk Learn