React-Scripts dependencies with CVEs #8529
Description
Is your proposal related to a problem?
Snyk reports vulnerabilities in react-scripts dependency tree:
✗ Medium severity vulnerability found in dot-prop
Description: Prototype Pollution
Info: https://snyk.io/vuln/SNYK-JS-DOTPROP-543489
Introduced through: react-scripts@3.3.1
From: react-scripts@3.3.1 > optimize-css-assets-webpack-plugin@5.0.3 > cssnano@4.1.10 > cssnano-preset-default@4.0.7 > postcss-merge-rules@4.0.3 > postcss-selector-parser@3.1.1 > dot-prop@4.2.0
From: react-scripts@3.3.1 > optimize-css-assets-webpack-plugin@5.0.3 > cssnano@4.1.10 > cssnano-preset-default@4.0.7 > postcss-minify-selectors@4.0.2 > postcss-selector-parser@3.1.1 > dot-prop@4.2.0
From: react-scripts@3.3.1 > optimize-css-assets-webpack-plugin@5.0.3 > cssnano@4.1.10 > cssnano-preset-default@4.0.7 > postcss-merge-longhand@4.0.11 > stylehacks@4.0.3 > postcss-selector-parser@3.1.1 > dot-prop@4.2.0
Fixed in: 5.1.1
✗ Medium severity vulnerability found in @hapi/hoek
Description: Prototype Pollution
Info: https://snyk.io/vuln/SNYK-JS-HAPIHOEK-548452
Introduced through: react-scripts@3.3.1
From: react-scripts@3.3.1 > workbox-webpack-plugin@4.3.1 > workbox-build@4.3.1 > @hapi/joi@15.1.1 > @hapi/hoek@8.5.0
From: react-scripts@3.3.1 > workbox-webpack-plugin@4.3.1 > workbox-build@4.3.1 > @hapi/joi@15.1.1 > @hapi/topo@3.1.6 > @hapi/hoek@8.5.0
Fixed in: 8.5.1, 9.0.3
Please note that although the above references react-scripts@3.3.1, v3.4.0 has not updated these dependencies and therefore has the same problem.
Describe the solution you'd like
Release a new version of react-scripts that updates to the latest versions of workbox-webpack-plugin and optimize-css-assets-webpack-plugin, which should resolve this issue.
Describe alternatives you've considered
None
Additional context
N/A