Bump tmp and react-scripts#6
Conversation
Removes [tmp](https://github.com/raszi/node-tmp). It's no longer used after updating ancestor dependency [react-scripts](https://github.com/facebook/create-react-app/tree/HEAD/packages/react-scripts). These dependencies need to be updated together. Removes `tmp` Updates `react-scripts` from 1.0.13 to 5.0.1 - [Release notes](https://github.com/facebook/create-react-app/releases) - [Changelog](https://github.com/react/create-react-app/blob/main/CHANGELOG-1.x.md) - [Commits](https://github.com/facebook/create-react-app/commits/react-scripts@5.0.1/packages/react-scripts) --- updated-dependencies: - dependency-name: tmp dependency-version: dependency-type: indirect - dependency-name: react-scripts dependency-version: 5.0.1 dependency-type: direct:production ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependencies
|
Semgrep found 1 Risk: Affected versions of bootstrap are vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'). Bootstrap's collapse plugin passes the Fix: Upgrade this library to at least version 3.4.0 at react-redux-embedded-login/package-lock.json:5357. Reference(s): GHSA-3wqf-4x89-9g79, CVE-2018-14040 Semgrep found 1 Risk: Affected versions of bootstrap and bootstrap-sass are vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'). Bootstrap's JavaScript plugins (Alert, Carousel, Collapse, Dropdown, Modal, Tab) pass the Fix: Upgrade this library to at least version 3.4.0 at react-redux-embedded-login/package-lock.json:5357. Reference(s): GHSA-4p24-vmcr-4gqj, CVE-2016-10735 Semgrep found 1 Risk: Affected versions of axios are vulnerable to Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting') / Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') / Server-Side Request Forgery (SSRF). Axios can be used as a gadget for header injection: if another dependency enables prototype pollution, polluted properties can be merged into Axios request headers and written without CRLF sanitization, allowing request smuggling/SSRF that can reach internal services such as AWS IMDSv2 and potentially lead to credential theft or broader compromise. Fix: Upgrade this library to at least version 0.31.0 at react-redux-embedded-login/package-lock.json:4942. Reference(s): GHSA-fvcv-3m26-pcqx, CVE-2026-40175 Semgrep found 1 Risk: Affected versions of axios are vulnerable to Server-Side Request Forgery (SSRF) / Unintended Proxy or Intermediary ('Confused Deputy'). Axios does not normalize hostnames before applying Manual Review Advice: A vulnerability from this advisory is reachable if you have Fix: Upgrade this library to at least version 0.31.0 at react-redux-embedded-login/package-lock.json:4942. Reference(s): GHSA-3p68-rc4w-qgx5, CVE-2025-62718 Semgrep found 1 Risk: Affected versions of ua-parser-js are vulnerable to Uncontrolled Resource Consumption. UAParser.js uses a vulnerable regular expression to parse User-Agent headers. A malicious header can trigger catastrophic backtracking in the regex, resulting in prolonged processing times and potential denial of service. Manual Review Advice: A vulnerability from this advisory is reachable if you are using ua-parser-js via npx cli Fix: Upgrade this library to at least version 0.7.24 at react-redux-embedded-login/package-lock.json:16827. Reference(s): GHSA-78cj-fxph-m83p, CVE-2021-27292 Semgrep found 1 Risk: Affected versions of ua-parser-js are vulnerable to Uncontrolled Resource Consumption. A specially crafted user agent string can trigger catastrophic backtracking in the regex designed for Redmi Phones and Mi Pad Tablets. This may result in a Regular Expression Denial of Service, causing resource exhaustion when ua-parser-js attempts to parse the malicious input. Manual Review Advice: A vulnerability from this advisory is reachable if you are using ua-parser-js via npx cli Fix: Upgrade this library to at least version 0.7.22 at react-redux-embedded-login/package-lock.json:16827. Reference(s): GHSA-662x-fhqg-9p8v, CVE-2020-7733 Semgrep found 1 Risk: Affected versions of ua-parser-js are vulnerable to Uncontrolled Resource Consumption. UAParser.js is vulnerable to Regular Expression Denial of Service (ReDoS) attacks. Maliciously crafted user agent strings can trigger inefficient regex patterns, leading to excessive backtracking and high CPU consumption, which may ultimately cause service degradation or a denial of service. Manual Review Advice: A vulnerability from this advisory is reachable if you are using ua-parser-js via npx cli Fix: Upgrade this library to at least version 0.7.23 at react-redux-embedded-login/package-lock.json:16827. Reference(s): GHSA-394c-5j6w-4xmx, CVE-2020-7793 |
Removes tmp. It's no longer used after updating ancestor dependency react-scripts. These dependencies need to be updated together.
Removes
tmpUpdates
react-scriptsfrom 1.0.13 to 5.0.1Release notes
Sourced from react-scripts's releases.
... (truncated)
Changelog
Sourced from react-scripts's changelog.
... (truncated)
Commits
19fa58dPublish9802941fix: webpack noise printed only if error or warning (#12245)2eef1d0Update templates to use React 18createRoot(#12220)221e511Publish5614c87Add support for Tailwind (#11717)20edab4fix(webpackDevServer): disable overlay for warnings (#11413)3afbbc0Update all dependencies (#11624)f5467d5feat(eslint-config-react-app): support ESLint 8.x (#11375)c7627ceUpdate webpack and dev server (#11646)544befeUpdate package.json (#11597)Maintainer changes
This version was pushed to npm by iansu, a new releaser for react-scripts since your current version.
Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)You can disable automated security fix PRs for this repo from the Security Alerts page.