[Snyk-dev] Fix for 8 vulnerabilities

[lili2311]

This PR was automatically created by Snyk using the credentials of a real user.

Snyk has created this PR to fix one or more vulnerable packages in the `npm` dependencies of this project.

Changes included in this PR

• Changes to the following files to upgrade the vulnerable dependencies to a fixed version:
  • packages/react-scripts/package.json

Vulnerabilities that will be fixed

With an upgrade:

Severity	Priority Score (*)	Issue	Breaking Change	Exploit Maturity
	696/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 7.5	Regular Expression Denial of Service (ReDoS) SNYK-JS-ANSIREGEX-1583908	Yes	Proof of Concept
	586/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 5.3	Regular Expression Denial of Service (ReDoS) SNYK-JS-GLOBPARENT-1016905	Yes	Proof of Concept
	586/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 5.3	Regular Expression Denial of Service (ReDoS) SNYK-JS-HTMLMINIFIER-3091181	Yes	Proof of Concept
	681/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 7.2	Command Injection SNYK-JS-LODASHTEMPLATE-1088054	Yes	Proof of Concept
	479/1000 Why? Has a fix available, CVSS 5.3	Improper Input Validation SNYK-JS-POSTCSS-5926692	Yes	No Known Exploit
	646/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 6.5	Server-side Request Forgery (SSRF) SNYK-JS-REQUEST-3361831	Yes	Proof of Concept
	646/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 6.5	Prototype Pollution SNYK-JS-TOUGHCOOKIE-5672873	Yes	Proof of Concept
	589/1000 Why? Has a fix available, CVSS 7.5	Prototype Pollution SNYK-JS-UNSETVALUE-2400660	Yes	No Known Exploit

(*) Note that the real score may have changed since the PR was raised.

Commit messages

Package name: babel-jest

The new version differs by 250 commits.

• be16e47 v27.0.0
• 63102ec chore: update changelog for release
• 564694a docs(blog): Jest 27 blog post (Vulnerability issue of css-what and normalize-url  facebook/create-react-app#11131)
• b68d91b feat(pretty-print): add option `printBasicPrototype` (unrecognized error facebook/create-react-app#11441)
• 2226742 chore: minor simplify format results error (CRA is not downloading the latest version of webpack facebook/create-react-app#11432)
• 78eb25d chore: remove needless assign (Flow Enums support  facebook/create-react-app#11433)
• 696c455 chore: update lockfile after publish
• e2eb9ae v27.0.0-next.11
• 3b253f8 Wait for closed resources to actually close before detecting open handles (I keep having to rm node_modules/.cache/.eslintcache facebook/create-react-app#11429)
• 27bee72 fix: run GC before collecting open handles (Create React App 5 Alpha facebook/create-react-app#11278)
• 50451df feat: use fallback if prettier not found (Delete package.json facebook/create-react-app#11400)
• 150dbd8 chore: update lockfile after publish
• 6f44529 v27.0.0-next.10
• cbcec7d Upgrade fsevents in jest-haste-map (npx creat-react-app project creates lots of error in cmd  facebook/create-react-app#11428)
• 9633a26 feat: support reporters written in ESM (Allow configuring jest's cacheDirectory facebook/create-react-app#11427)
• 59f42d8 fix: do not cache modules that throw during evaluation (Support for changing the cache location facebook/create-react-app#11263)
• 57e32e9 Detect open handles with done callbacks (Delete .gitignore facebook/create-react-app#11382)
• a397607 Document and test dontThrow for custom inline snapshot matchers (Create React App (CommonJS, ESNext) + Path Alias + Module (Import/Export) + NodeJS + TSConfig.json facebook/create-react-app#10995)
• 4fa3a0b feat: custom haste (import-plugin-helpers facebook/create-react-app#11107)
• 2047a36 chore: bump deps (Error Overlay appears on TS compilation errors when TSC_COMPILE_ON_ERROR=true  facebook/create-react-app#11419)
• a4358d6 chore: run prettier on changelog
• bdd6282 Move all default values into `jest-config` (Showing blank page when the site is idle facebook/create-react-app#9924)
• db643a1 Link to Jest config (#11106)
• b16082c Fix locale issue Use "paths" in tsconfig.json and jsconfig.json facebook/create-react-app#10014 (Bug: when i run react locally the on network ip address is not correct  facebook/create-react-app#11412)

See the full diff

Package name: html-webpack-plugin

The new version differs by 50 commits.

• eb73905 chore(release): 4.0.0
• 42a6d4a Add typing for getHooks
• a1a37cf Release html-webpack-plugin 4.0.0-beta.14
• 97f9fb9 fix: load script files before style files files in defer script loading mode
• e97ce17 Release html-webpack-plugin 4.0.0-beta.13
• e448b5d Release html-webpack-plugin 4.0.0-beta.12
• de315eb feat: Add defer script loading
• 7df269f feat: Provide a verbose error message if html minification failed
• 1d66e53 feat: merge templateParameters with default template parameters
• dfb98e7 Fix typo in template option docts
• 096a760 Fix broken links in examples
• a195c34 docs: Update template-option documentation
• 40b410e docs: Update example for template parameters
• bf017f3 chore: Release 4.0.0-beta.11
• 2549557 test: Don't use minification for speed measurement
• de22fc2 test: Adjust measurment for node 6 on travis
• 24bf1b5 fix: Update references to html-minifier
• f4eafdc chore: Release 4.0.0-beta.10
• a2ad30a refactor: Use getAssetPath instead of calling the hook directly
• 2595a79 chore: Release 4.0.0-beta.9
• c66766c feat: Add support for minifying inline ES6 inside html templates
• 655cbcd Fix README typo
• 6de319b update lodash dependency for prototype polution vulnerability
• 35a1541 Properly encode file names emitted as part of URLs.

See the full diff

Package name: jest

The new version differs by 250 commits.

• be16e47 v27.0.0
• 63102ec chore: update changelog for release
• 564694a docs(blog): Jest 27 blog post (Vulnerability issue of css-what and normalize-url  facebook/create-react-app#11131)
• b68d91b feat(pretty-print): add option `printBasicPrototype` (unrecognized error facebook/create-react-app#11441)
• 2226742 chore: minor simplify format results error (CRA is not downloading the latest version of webpack facebook/create-react-app#11432)
• 78eb25d chore: remove needless assign (Flow Enums support  facebook/create-react-app#11433)
• 696c455 chore: update lockfile after publish
• e2eb9ae v27.0.0-next.11
• 3b253f8 Wait for closed resources to actually close before detecting open handles (I keep having to rm node_modules/.cache/.eslintcache facebook/create-react-app#11429)
• 27bee72 fix: run GC before collecting open handles (Create React App 5 Alpha facebook/create-react-app#11278)
• 50451df feat: use fallback if prettier not found (Delete package.json facebook/create-react-app#11400)
• 150dbd8 chore: update lockfile after publish
• 6f44529 v27.0.0-next.10
• cbcec7d Upgrade fsevents in jest-haste-map (npx creat-react-app project creates lots of error in cmd  facebook/create-react-app#11428)
• 9633a26 feat: support reporters written in ESM (Allow configuring jest's cacheDirectory facebook/create-react-app#11427)
• 59f42d8 fix: do not cache modules that throw during evaluation (Support for changing the cache location facebook/create-react-app#11263)
• 57e32e9 Detect open handles with done callbacks (Delete .gitignore facebook/create-react-app#11382)
• a397607 Document and test dontThrow for custom inline snapshot matchers (Create React App (CommonJS, ESNext) + Path Alias + Module (Import/Export) + NodeJS + TSConfig.json facebook/create-react-app#10995)
• 4fa3a0b feat: custom haste (import-plugin-helpers facebook/create-react-app#11107)
• 2047a36 chore: bump deps (Error Overlay appears on TS compilation errors when TSC_COMPILE_ON_ERROR=true  facebook/create-react-app#11419)
• a4358d6 chore: run prettier on changelog
• bdd6282 Move all default values into `jest-config` (Showing blank page when the site is idle facebook/create-react-app#9924)
• db643a1 Link to Jest config (#11106)
• b16082c Fix locale issue Use "paths" in tsconfig.json and jsconfig.json facebook/create-react-app#10014 (Bug: when i run react locally the on network ip address is not correct  facebook/create-react-app#11412)

See the full diff

Package name: optimize-css-assets-webpack-plugin

The new version differs by 5 commits.

• 09d29b3 5.0.5
• d0a7da7 feat(deps): update dependencies (initial settings for editorconfig facebook/create-react-app#154)
• 41d1e23 Redirect to css-minimizer-webpack-plugin for webpack 5 or above
• e9b84f1 5.0.4
• b3a3ada Update dependencies (Adds simple HMR for React facebook/create-react-app#133)

See the full diff

Package name: react-dev-utils

The new version differs by 250 commits.

• 221e511 Publish
• 6a3315b Update CONTRIBUTING.md
• 5614c87 Add support for Tailwind (Add support for Tailwind facebook/create-react-app#11717)
• 657739f chore(test): make all tests install with `npm ci` (chore(test): make all tests install with npm ci facebook/create-react-app#11723)
• 20edab4 fix(webpackDevServer): disable overlay for warnings (fix(webpackDevServer): disable overlay for warnings facebook/create-react-app#11413)
• 69321b0 Remove cached lockfile (Remove cached lockfile facebook/create-react-app#11706)
• 3afbbc0 Update all dependencies (Update all dependencies facebook/create-react-app#11624)
• f5467d5 feat(eslint-config-react-app): support ESLint 8.x (feat(eslint-config-react-app): support ESLint 8.x facebook/create-react-app#11375)
• e8319da [WIP] Fix integration test teardown / cleanup and missing yarn installation ([WIP] Fix integration test teardown / cleanup and missing yarn installation facebook/create-react-app#11686)
• c7627ce Update webpack and dev server (Update webpack and dev server facebook/create-react-app#11646)
• f85b064 The default port used by `serve` has changed (The default port used by serve has changed facebook/create-react-app#11619)
• 544befe Update package.json (Update package.json facebook/create-react-app#11597)
• 9d0369b Fix ESLint Babel preset resolution (Fix ESLint Babel preset resolution facebook/create-react-app#11547)
• d7b23c8 test(create-react-app): assert for exit code (test(create-react-app): assert for exit code facebook/create-react-app#10973)
• 1465357 Prepare 5.0.0 alpha release
• 3880ba6 Remove dependency pinning (Remove dependency pinning facebook/create-react-app#11474)
• 8b9fbee Update CODEOWNERS
• cacf590 Bump template dependency version (Bump template dependency version facebook/create-react-app#11415)
• 5cedfe4 Bump browserslist from 4.14.2 to 4.16.5 (Bump browserslist from 4.14.2 to 4.16.5 facebook/create-react-app#11476)
• 50ea5ad allow CORS on webpack-dev-server (allow CORS on webpack-dev-server facebook/create-react-app#11325)
• 63bba07 Upgrade jest and related packages from 26.6.0 to 27.1.0 (Upgrade jest and related packages from 26.6.0 to 27.1.0 facebook/create-react-app#11338)
• 960b21e Bump immer from 8.0.4 to 9.0.6 (Bump immer from 8.0.4 to 9.0.6 facebook/create-react-app#11364)
• 134cd3c Resolve dependency issues in v5 alpha (fix: resolve dependency issues in v5 alpha facebook/create-react-app#11294)
• b45ae3c Update CONTRIBUTING.md

See the full diff

Package name: webpack

The new version differs by 250 commits.

• 610f368 5.0.0
• 5ce65c1 update examples
• bbe1230 Merge pull request #11628 from webpack/bugfix/real-content-hash
• 75ecff2 5.0.0-rc.6
• bfc35d6 Merge pull request HMR not reloading index.js facebook/create-react-app#11603 from MayaWolf/master
• 76e8cbd Merge pull request updated deprecated rules facebook/create-react-app#11622 from webpack/dependabot/npm_and_yarn/types/node-13.13.25
• 9fd1be2 chore(deps-dev): bump @ types/node from 13.13.23 to 13.13.25
• 36bcfaa Merge pull request difference in version of webpack-dev-server locally and on github in react-scripts package facebook/create-react-app#11621 from webpack/bugfix/11619
• 9130d10 fix called variables with ProvidePlugin
• 3e42105 Merge pull request Can not create new react-app  facebook/create-react-app#11620 from webpack/bugfix/11617
• 4709719 skip connections copied to concatenated module
• 57b493f 5.0.0-rc.5
• 1658e2f Merge pull request Linking react-scripts with the projects throws an error. facebook/create-react-app#11618 from webpack/bugfix/11615
• a8fb45d fixes crash in SideEffectsFlagPlugin
• 84b196d emit error instead of crashing when unexpected problem occurs
• 5573fed Merge pull request React create-react-app errors, npm audit fix and npm install facebook/create-react-app#11601 from Hornwitser/improve-suggested-polyfill-config
• 9b5cce9 Merge pull request Add Node 17 to test matrix facebook/create-react-app#11609 from snitin315/export-types
• 37c495c export type RuleSetUseItem
• 39faf34 export type RuleSetUse
• e5fd246 export type RuleSetConditionAbsolute
• 660baad export RuleSetCondition types
• 13e3ca5 Merge pull request Can't open error frame in VSCodium facebook/create-react-app#11602 from webpack/bugfix/shared-runtime-chunk
• 9c0587e Merge pull request need solution  facebook/create-react-app#11606 from webpack/dependabot/npm_and_yarn/simple-git-2.21.0
• 502d166 Merge pull request Critical vulnerability in shell-quote facebook/create-react-app#11607 from webpack/dependabot/npm_and_yarn/acorn-8.0.4

See the full diff

Package name: webpack-dev-server

The new version differs by 250 commits.

• c9271b9 chore(release): 4.0.0
• 18bf369 test: fix stability (Can't use NODE_PATH with two directories facebook/create-react-app#3676)
• cdcabb2 fix: respect protocol from browser for manual setup (add experimental babel-plugin-macros support facebook/create-react-app#3675)
• 1768d6b fix: initial reloading for lazy compilation (Overlay launch editor in Webstorm 2017.3.2 does not work facebook/create-react-app#3662)
• 4f5bab1 docs: improve examples (Preparing the next release facebook/create-react-app#3672)
• f2d87fb fix: improve https CLI output (I am trying to run 'create-react-app blog-app' command on cmd but its giving me errors  facebook/create-react-app#3673)
• 0277c5e chore: remove redundant console statements (Including from a CDN facebook/create-react-app#3671)
• 16fcdbc docs: add `ipc` example (typescript facebook/create-react-app#3667)
• 8915fb8 test: add e2e tests for built in routes (Allow user to define what node_modules to transpile down to ES5 facebook/create-react-app#3669)
• 4d1cbe1 docs: ask `version` information in issue template (stylus facebook/create-react-app#3668)
• b6c1881 chore(deps-dev): bump core-js from 3.16.1 to 3.16.2 (Error: Cannot find module 'react-dev-utils/ignoredFiles' facebook/create-react-app#3666)
• ffa8cc5 chore(deps-dev): bump supertest from 6.1.5 to 6.1.6 (Invalidate cache by service worker facebook/create-react-app#3665)
• f1fdaa7 chore(release): 4.0.0-rc.1
• c4678bc fix: legacy API (Add WebWorker Support facebook/create-react-app#3660)
• d8bdd03 test: fix stability (Travis CI use trusty instead precise facebook/create-react-app#3661)
• 22b1414 refactor: remove `killable` (Stop Treating warnings as errors because process.env.CI = true. facebook/create-react-app#3657)
• 75bafbf test: add e2e tests for module federation (An issue to compile facebook/create-react-app#3658)
• 493ccbd chore(deps): update `ws` (added code-insiders to the editor list facebook/create-react-app#3652)
• ae8c523 test: add e2e test for universal compiler (Better documentation for setupTests.js when ejecting facebook/create-react-app#3656)
• f94b84f chore(deps): update (unable to install react script, react and react-dom facebook/create-react-app#3655)
• 1923132 test: fix cli
• 2adfd01 test: fix todo (Document common peer dependency warnings facebook/create-react-app#3653)
• 6e2cbde fix: proxy logging and allow to pass options without the `target` option (Why react-scripts is a dependency instead of a dev-dependency? facebook/create-react-app#3651)
• c9ccc96 fix: respect infastructureLogging.level for client.logging (Service worker fails to load new dynamic/code-split chunk facebook/create-react-app#3613)

See the full diff

Package name: workbox-webpack-plugin

The new version differs by 250 commits.

• 9cbed27 v6.0.0
• e2bae90 Misc. webpack changes (Fix typo facebook/create-react-app#2683)
• f2ef912 Re-enable yarn test
• 1567f16 rc.0
• 43c375f v6.0.0-rc.0
• 5692d74 Update the stage at which the webpack plugin runs (TypeError: Class constructor cannot be invoked without 'new' facebook/create-react-app#2675)
• 666f7e4 Make use of AssetInfo in webpack build (Bootstrap with Yarn facebook/create-react-app#2673)
• 06e51db Feature/workbox recipes (Changelog for 1.0.8 facebook/create-react-app#2664)
• 57ad215 Add declare to WorkboxPlugin interface (Put react-scripts in dependencies, not devDependencies facebook/create-react-app#2657)
• c2eddf4 Mark BackgroundSyncPlugin options param as optional (Don't ask to install webpack for using Styleguidist facebook/create-react-app#2656)
• df93286 Don't update data: sourcemaps (Issue installing React facebook/create-react-app#2654)
• ed69eca Updates for html-webpack-plugin and webpack v5 (Occasionally wrong offset in crash overlay points it to wrong file/line facebook/create-react-app#2651)
• bf8c949 networkTimeoutSeconds in NetworkOnly (asdsdf facebook/create-react-app#2620)
• d62c185 Version bumps
• f78cfb8 Remove importScriptsViaChunks JSDoc (format UglifyJs error facebook/create-react-app#2650)
• 00ba074 v6.0.0-alpha.3
• 4669bdc Task needs to be async
• cbb18c8 webpack v5 compatibility (Provide readable error messages on top of Uglify facebook/create-react-app#2641)
• ff9d868 Adjust PrecacheEntry type to allow null revisions (Ignore "Skipping static resource" message from SW precache facebook/create-react-app#2645)
• ae29e17 Warn when an async matchCallback is used (If i use nginx as proxy,this port is 80,react app's port 3000,webpackHotdev create websocket with port 80,and the error occur. facebook/create-react-app#2591)
• a6751b9 Precaching updates for v6 (Jest 22 facebook/create-react-app#2639)
• bb21e82 Add gulp build to hint (Update template and dependencies for ServiceMax facebook/create-react-app#2629)
• f993ab4 Add missing spaces in multiline logs (Should ejecting change lockfile? facebook/create-react-app#2627)
• 6d38919 Allow cacheKeyWillBeUsed to influence the request method check (create-react-app failed facebook/create-react-app#2616)

See the full diff

Check the changes in this PR to ensure they won't cause issues with your project.

---

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report

🛠 Adjust project settings

📚 Read more about Snyk's upgrade and patch logic

---

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Regular Expression Denial of Service (ReDoS)
🦉 Improper Input Validation
🦉 Server-side Request Forgery (SSRF)
🦉 More lessons are available in Snyk Learn