create-react-app icon indicating copy to clipboard operation
create-react-app copied to clipboard
verified publisher icon facebook

Update dependencies in react-scripts to pull in latest babel traverse to get past known vulnerability.

Open thekbb opened this issue 2 years ago • 3 comments

This updates dependencies (mainly in packages/react-scripts) to update babel/traverse to get past a security vulnerability (CVE-2023-45133) see #13470

Steps taken

  1. update babel-core (which transitively pulls in babel/traverse) to latest in package/react/scripts
  2. run npm audit fix in root to update package-lock.json with the new babel-traverse and other dependencies.

the tests pass and running a skeleton app appears to work.

thekbb avatar Dec 12 '23 20:12 thekbb

@thekbb Please can you provide the solution for this issue so it can be fixed in our environment for now? while upgrading the transitive dependency it breaks in other cases and throws different errors. We may not know when it would be the next release. Any ETA you're aware of? Thanks for creating a PR and helping the community.

AnupSingh97 avatar Dec 14 '23 07:12 AnupSingh97

@AnupSingh97, you had issues with upgrading babel/core to 7.23.6? to update babel/traverse? What happened? It is working for me.

thekbb avatar Dec 20 '23 20:12 thekbb

@AnupSingh97, you had issues with upgrading babel/core to 7.23.6? to update babel/traverse? What happened? It is working for me.

If I consume your changes from here, it may work but the PR hasn't merged yet. I was asking about the alternate option to update the babel/traverse dependency to remove the critical vulnerability. I found an overrides section approach to update the transitive dependency for now. if you have any other approach please suggest and what's your input on the overrides section approach?

thanks, @thekbb for replying and looking forward.

overrides reference: https://docs.npmjs.com/cli/v9/configuring-npm/package-json#overrides

AnupSingh97 avatar Dec 21 '23 07:12 AnupSingh97

Hi, is there an update regarding this PR? This is a critical vulnerability of remote code execution. It doesn't make sense that it hasn't been fixed yet. Is there a reason for the delay with fix it??

aviadFeig avatar Feb 19 '24 13:02 aviadFeig

@thekbb any update as to when this will be merged?

MrNoyce avatar Feb 28 '24 19:02 MrNoyce

@thekbb any update as to when this will be merged?

I can't say when or if it will be merged, I am not a maintainer. This project is abandoned - I've moved on and would advice you to do so as well.

thekbb avatar Mar 28 '24 14:03 thekbb