Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[Snyk] Upgrade: react, react-dom, color, react-responsive, react-scripts, react-spinners, react-toggle, react-use-gesture, styled-components #1

Open
wants to merge 1 commit into
base: main
Choose a base branch
from
Open

[Snyk] Upgrade: react, react-dom, color, react-responsive, react-scripts, react-spinners, react-toggle, react-use-gesture, styled-components #1

wants to merge 1 commit into from

Conversation

yash509
Copy link
Owner

@yash509 yash509 commented Sep 16, 2024

snyk-top-banner

Snyk has created this PR to upgrade multiple dependencies.

👯 The following dependencies are linked and will therefore be updated together.

ℹ️ Keep your dependencies up-to-date. This makes it easier to fix existing vulnerabilities and to more quickly identify and fix newly disclosed vulnerabilities when they affect your project.

Name Versions Released on

react
from 16.12.0 to 16.14.0 | 3 versions ahead of your current version | 4 years ago
on 2020-10-14
react-dom
from 16.12.0 to 16.14.0 | 3 versions ahead of your current version | 4 years ago
on 2020-10-14
color
from 3.1.2 to 3.2.1 | 4 versions ahead of your current version | 3 years ago
on 2021-07-18
react-responsive
from 8.0.3 to 8.2.0 | 3 versions ahead of your current version | 4 years ago
on 2020-11-30
react-scripts
from 3.4.0 to 3.4.4 | 4 versions ahead of your current version | 4 years ago
on 2020-10-20
react-spinners
from 0.8.1 to 0.14.1 | 52 versions ahead of your current version | 3 months ago
on 2024-06-26
react-toggle
from 4.1.1 to 4.1.3 | 2 versions ahead of your current version | 2 years ago
on 2022-07-16
react-use-gesture
from 7.0.5 to 7.0.16 | 11 versions ahead of your current version | 4 years ago
on 2020-08-31
styled-components
from 5.0.1 to 5.3.11 | 33 versions ahead of your current version | a year ago
on 2023-05-26

Issues fixed by the recommended upgrade:

Issue Score Exploit Maturity
high severity Regular Expression Denial of Service (ReDoS)
SNYK-JS-WEBSOCKETEXTENSIONS-570623		 517 Proof of Concept
high severity Asymmetric Resource Consumption (Amplification)
SNYK-JS-BODYPARSER-7926860		 517 No Known Exploit
high severity Improper Verification of Cryptographic Signature
SNYK-JS-BROWSERIFYSIGN-6037026		 517 No Known Exploit
high severity Cryptographic Issues
SNYK-JS-ELLIPTIC-571484		 517 Proof of Concept
high severity Improper Input Validation
SNYK-JS-FOLLOWREDIRECTS-6141137		 517 Proof of Concept
high severity Prototype Pollution
SNYK-JS-AJV-584908		 517 No Known Exploit
high severity Prototype Pollution
SNYK-JS-ASYNC-2441827		 517 Proof of Concept
medium severity Improper Input Validation
SNYK-JS-URLPARSE-1078283		 517 No Known Exploit
critical severity Incomplete List of Disallowed Inputs
SNYK-JS-BABELTRAVERSE-5962462		 517 Proof of Concept
critical severity Improper Verification of Cryptographic Signature
SNYK-JS-ELLIPTIC-7577916		 517 Proof of Concept
critical severity Improper Verification of Cryptographic Signature
SNYK-JS-ELLIPTIC-7577917		 517 Proof of Concept
critical severity Improper Verification of Cryptographic Signature
SNYK-JS-ELLIPTIC-7577918		 517 Proof of Concept
high severity Regular Expression Denial of Service (ReDoS)
SNYK-JS-ES5EXT-6095076		 517 Proof of Concept
high severity Remote Memory Exposure
SNYK-JS-DNSPACKET-1293563		 517 No Known Exploit
high severity Arbitrary Code Injection
SNYK-JS-SERIALIZEJAVASCRIPT-570062		 517 Proof of Concept
high severity Regular Expression Denial of Service (ReDoS)
SNYK-JS-SSRI-1246392		 517 Proof of Concept
high severity Prototype Pollution
SNYK-JS-NODEFORGE-598677		 517 Proof of Concept
high severity Prototype Pollution
SNYK-JS-OBJECTPATH-1017036		 517 Proof of Concept
high severity Prototype Pollution
SNYK-JS-OBJECTPATH-1585658		 517 No Known Exploit
high severity Code Injection
SNYK-JS-LODASH-1040724		 517 Proof of Concept
high severity Prototype Pollution
SNYK-JS-LODASH-567746		 517 Proof of Concept
high severity Prototype Pollution
SNYK-JS-LODASH-608086		 517 Proof of Concept
high severity Prototype Pollution
SNYK-JS-LODASH-6139239		 517 Proof of Concept
high severity Server-side Request Forgery (SSRF)
SNYK-JS-IP-6240864		 517 Proof of Concept
high severity Regular Expression Denial of Service (ReDoS)
SNYK-JS-SSRI-1246392		 517 Proof of Concept
high severity Improper Input Validation
SNYK-JS-URLPARSE-2407770		 517 Proof of Concept
medium severity Information Exposure
SNYK-JS-EVENTSOURCE-2823375		 517 Proof of Concept
medium severity Open Redirect
SNYK-JS-EXPRESS-6474509		 517 No Known Exploit
medium severity Cross-site Scripting
SNYK-JS-EXPRESS-7926867		 517 No Known Exploit
medium severity Information Exposure
SNYK-JS-FOLLOWREDIRECTS-2332181		 517 Proof of Concept
medium severity Regular Expression Denial of Service (ReDoS)
SNYK-JS-COLORSTRING-1082939		 517 Proof of Concept
medium severity Cryptographic Issues
SNYK-JS-ELLIPTIC-1064899		 517 No Known Exploit
medium severity Denial of Service (DoS)
SNYK-JS-SOCKJS-575261		 517 Proof of Concept
medium severity Prototype Pollution
SNYK-JS-OBJECTPATH-1569453		 517 Proof of Concept
medium severity Regular Expression Denial of Service (ReDoS)
SNYK-JS-PATHPARSE-1077067		 517 Proof of Concept
medium severity Information Exposure
SNYK-JS-FOLLOWREDIRECTS-6444610		 517 Proof of Concept
medium severity Regular Expression Denial of Service (ReDoS)
SNYK-JS-LODASH-1018905		 517 Proof of Concept
medium severity Denial of Service (DoS)
SNYK-JS-HTTPPROXY-569139		 517 Proof of Concept
medium severity Regular Expression Denial of Service (ReDoS)
SNYK-JS-TERSER-2806366		 517 No Known Exploit
medium severity Open Redirect
SNYK-JS-URLPARSE-1533425		 517 Proof of Concept
medium severity Access Restriction Bypass
SNYK-JS-URLPARSE-2401205		 517 Proof of Concept
medium severity Authorization Bypass
SNYK-JS-URLPARSE-2407759		 517 Proof of Concept
medium severity Authorization Bypass Through User-Controlled Key
SNYK-JS-URLPARSE-2412697		 517 Proof of Concept
medium severity Prototype Pollution
SNYK-JS-YARGSPARSER-560381		 517 Proof of Concept
medium severity Prototype Pollution
SNYK-JS-YARGSPARSER-560381		 517 Proof of Concept
low severity Information Exposure
SNYK-JS-FOLLOWREDIRECTS-2396346		 517 No Known Exploit
low severity Cross-site Scripting
SNYK-JS-SEND-7926862		 517 No Known Exploit
low severity Cross-site Scripting
SNYK-JS-SERVESTATIC-7926865		 517 No Known Exploit
Release notes
Package name: react from react GitHub release notes
Package name: react-dom from react-dom GitHub release notes
Package name: color
  • 3.2.1 - 2021-07-18

    Patch Release 3.2.1

    • Revert color-convert back down to <2 since v2 introduced ES6 syntax.

    If you need color-convert@>=2 then you'll need to have ES6 support. It's 2021, embrace it. 🙂

  • 3.2.0 - 2021-07-17

    Minor Release 3.2.0

    NOTE: This is the final release of color that uses ES5 syntax. For those following along, 4.0.0 was just released that switches to ES6 (const/let) syntax, which will (at some point) be followed by another major release that further switches to ES Modules entirely. This will be a sweeping change across the color package suite (color, color-string, color-convert). Keep a look out if these issues have been bothering you.

    • Bumps color convert to latest (fixes some issues with HCG)
    • Bumps mocha to latest
  • 3.1.4 - 2021-07-17
  • 3.1.3 - 2020-10-09
  • 3.1.2 - 2019-06-03
from color GitHub release notes
Package name: react-responsive
  • 8.2.0 - 2020-11-30

    tag version 8.2.0

  • 8.1.1 - 2020-11-10
  • 8.1.0 - 2020-06-02
  • 8.0.3 - 2020-01-22
from react-responsive GitHub release notes
Package name: react-scripts
  • 3.4.4 - 2020-10-20
  • 3.4.3 - 2020-08-12
  • 3.4.2 - 2020-08-11
  • 3.4.1 - 2020-03-21
  • 3.4.0 - 2020-02-14
from react-scripts GitHub release notes
Package name: react-spinners
  • 0.14.1 - 2024-06-26

    What's Changed

    • Revert "fix: multiple hash loader with different color renders as the same color" by @ davidhu2000 in #605

    Full Changelog: 0.14.0...0.14.1

  • 0.14.0 - 2024-06-26

    What's Changed

    New Contributors

    Full Changelog: v0.13.8...0.14.0

  • 0.13.8 - 2023-01-19

    What's Changed

    New Contributors

    Full Changelog: v0.13.7...v0.13.8

  • 0.13.7 - 2022-12-03

    What's Changed

    fix: PacmanLoader container height/width to adjust with size prop

  • 0.13.6 - 2022-10-08

    0.13.6

  • 0.13.5 - 2022-10-04

    0.13.5

  • 0.13.4 - 2022-07-30
  • 0.13.3 - 2022-07-01

    0.13.3

  • 0.13.2 - 2022-06-28

    0.13.2

  • 0.13.1 - 2022-06-25
  • 0.13.0 - 2022-06-25

    Major Changes

    Feature: Removed @ emotion/react as a dependency and rewrote all components as functional components. This library now has ZERO dependencies.

    This resulted in a huge component size reduction. As compared between 0.12.0 and 0.13.0

    0.13.0
    Screen Shot 2022-06-25 at 4 20 30 PM
    0.12.0
    Screen Shot 2022-06-25 at 4 20 34 PM

    Feature: Add support for custom props such as aria-label
    Feature: Updated RiseLoader rise amount to be the same as size prop instead of hard coded 30px

    Breaking Change: css prop is renamed to cssOverride to avoid conflicts with css-in-js libraries

    Storybook is introduced to better demo the components. The demo site is simplified to only allow color changes.

    Minor Changes

    • replaced enzyme with react testing library
    • bugfix: add display: inherit to the default styles to fix the rendering issue
    • bugfix: GridLoader's rendering issue
  • 0.13.0-beta.7 - 2022-06-25
  • 0.13.0-beta.6 - 2022-06-25
  • 0.13.0-beta.5 - 2022-06-07
  • 0.13.0-beta.4 - 2022-06-05
  • 0.13.0-beta.3 - 2022-05-26
  • 0.13.0-beta.2 - 2022-05-26
  • 0.13.0-beta.1 - 2022-05-26
  • 0.13.0-alpha.5 - 2022-05-22
  • 0.13.0-alpha.4 - 2022-05-22
  • 0.13.0-alpha.3 - 2022-05-16
  • 0.13.0-alpha.1 - 2022-05-16
  • 0.12.0 - 2022-05-16
  • 0.12.0-beta.1 - 2022-05-16
  • 0.12.0-alpha.3 - 2022-05-03
  • 0.12.0-alpha.2 - 2021-10-06
  • 0.12.0-alpha.1 - 2021-09-25
  • 0.11.0 - 2021-05-21
  • 0.11.0-beta.1 - 2021-05-02
  • 0.11.0-alpha.8 - 2021-03-21
  • 0.11.0-alpha.7 - 2021-03-21
  • 0.11.0-alpha.6 - 2021-02-22
  • 0.11.0-alpha.5 - 2021-02-21
  • 0.11.0-alpha.4 - 2021-02-21
  • 0.11.0-alpha.3 - 2021-02-21
  • 0.11.0-alpha.2 - 2020-12-31
  • 0.11.0-alpha.1 - 2020-12-30
  • 0.10.6 - 2021-02-13
  • 0.10.4 - 2021-01-02
  • 0.10.3 - 2021-01-02
  • 0.10.2 - 2021-01-02
  • 0.10.1 - 2020-12-30
  • 0.10.0 - 2020-12-30
  • 0.10.0-beta.3 - 2020-12-30
  • 0.10.0-beta.2 - 2020-12-30
  • 0.10.0-beta.1 - 2020-12-30
  • 0.10.0-alpha.3 - 2020-12-27
  • 0.10.0-alpha.2 - 2020-10-06
  • 0.10.0-alpha.1 - 2020-10-06
  • 0.9.0 - 2020-06-20
  • 0.8.3 - 2020-05-02
  • 0.8.2 - 2020-05-02
  • 0.8.1 - 2020-03-08
from react-spinners GitHub release notes
Package name: react-toggle
  • 4.1.3 - 2022-07-16
  • 4.1.2 - 2021-03-12
  • 4.1.1 - 2019-09-30
from react-toggle GitHub release notes
Package name: react-use-gesture
  • 7.0.16 - 2020-08-31
  • 7.0.15 - 2020-04-17
  • 7.0.14 - 2020-04-15
  • 7.0.13 - 2020-04-11
  • 7.0.12 - 2020-04-09
  • 7.0.11 - 2020-04-05
  • 7.0.10 - 2020-04-05
  • 7.0.9 - 2020-04-03
  • 7.0.8 - 2020-04-02
  • 7.0.7 - 2020-04-02
  • 7.0.6 - 2020-03-29
  • 7.0.5 - 2020-03-08
from react-use-gesture GitHub release notes
Package name: styled-components
  • 5.3.11 - 2023-05-26
  • 5.3.10 - 2023-04-23
  • 5.3.9 - 2023-03-13
  • 5.3.8 - 2023-03-02
  • 5.3.7 - 2023-03-02
  • 5.3.6 - 2022-09-27
  • 5.3.5 - 2022-03-24
  • 5.3.4 - 2022-03-24
  • 5.3.3 - 2021-10-19
  • 5.3.2 - 2021-10-19
  • 5.3.1 - 2021-08-24
  • 5.3.1-pr3564 - 2021-08-21
  • 5.3.1-pr3563 - 2021-08-21
  • 5.3.0 - 2021-05-05
  • 5.2.3 - 2021-03-31
  • 5.2.2 - 2021-03-30
  • 5.2.1 - 2020-10-30
  • 5.2.0 - 2020-09-04
  • 5.2.0-test.12 - 2020-09-02
  • 5.2.0-test.11 - 2020-08-31
  • 5.2.0-test.10 - 2020-08-30
  • 5.2.0-test.9 - 2020-08-30
  • 5.2.0-test.8 - 2020-08-30
  • 5.2.0-test.7 - 2020-08-30
  • 5.2.0-test.6 - 2020-08-30
  • 5.2.0-test.5 - 2020-08-28
  • 5.2.0-test.4 - 2020-08-28
  • 5.2.0-test.3 - 2020-08-28
  • 5.2.0-test.2 - 2020-08-27
  • 5.2.0-test.1 - 2020-08-27
  • 5.2.0-test.0 - 2020-08-27
  • 5.1.1 - 2020-05-25
  • 5.1.0 - 2020-04-07
  • 5.0.1 - 2020-02-04
from styled-components GitHub release notes

Important

  • Check the changes in this PR to ensure they won't cause issues with your project.
  • This PR was automatically created by Snyk using the credentials of a real user.
  • Max score is 1000. Note that the real score may have changed since the PR was raised.

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open upgrade PRs.

For more information:

[//]: # 'snyk:metadata:{"customTemplate":{"variablesUsed":[],"fieldsUsed":[]},"dependencies":[{"name":"react","from":"16.12.0","to":"16.14.0"},{"name":"react-dom","from":"16.12.0","to":"16.14.0"},{"name":"color","from":"3.1.2","to":"3.2.1"},{"name":"react-responsive","from":"8.0.3","to":"8.2.0"},{"name":"react-scripts","from":"3.4.0","to":"3.4.4"},{"name":"react-spinners","from":"0.8.1","to":"0.14.1"},{"name":"react-toggle","from":"4.1.1","to":"4.1.3"},{"name":"react-use-gesture","from":"7.0.5","to":"7.0.16"},{"name":"styled-components","from":"5.0.1","to":"5.3.11"}],"env":"prod","hasFixes":true,"isBreakingChange":false,"isMajorUpgrade":false,"issuesToFix":[{"exploit_maturity":"proof-of-concept","id":"SNYK-JS-WEBSOCKETEXTENSIONS-570623","issue_id":"SNYK-JS-WEBSOCKETEXTENSIONS-570623","priority_score":517,"priority_score_factors":[{"type":"exploit","label":"Proof of Concept","score":107},{"type":"cvssScore","label":"8.2","score":410},{"type":"scoreVersion","label":"v1","score":1}],"severity":"high","title":"Regular Expression Denial of Service (ReDoS)"},{"exploit_maturity":"no-known-exploit","id":"SNYK-JS-BODYPARSER-7926860","issue_id":"SNYK-JS-BODYPARSER-7926860","priority_score":481,"priority_score_factors":[{"type":"freshness","label":true,"score":71},{"type":"cvssScore","label":"8.2","score":410},{"type":"scoreVersion","label":"v1","score":1}],"severity":"high","title":"Asymmetric Resource Consumption (Amplification)"},{"exploit_maturity":"no-known-exploit","id":"SNYK-JS-BROWSERIFYSIGN-6037026","issue_id":"SNYK-JS-BROWSERIFYSIGN-6037026","priority_score":375,"priority_score_factors":[{"type":"cvssScore","label":"7.5","score":375},{"type":"scoreVersion","label":"v1","score":1}],"severity":"high","title":"Improper Verification of Cryptographic Signature"},{"exploit_maturity":"proof-of-concept","id":"SNYK-JS-ELLIPTIC-571484","issue_id":"SNYK-JS-ELLIPTIC-571484","priority_score":492,"priority_score_factors":[{"type":"exploit","label":"Proof of Concept","score":107},{"type":"cvssScore","label":"7.7","score":385},{"type":"scoreVersion","label":"v1","score":1}],"severity":"high","title":"Cryptographic Issues"},{"exploit_maturity":"proof-of-concept","id":"SNYK-JS-FOLLOWREDIRECTS-6141137","issue_id":"SNYK-JS-FOLLOWREDIRECTS-6141137","priority_score":472,"priority_score_factors":[{"type":"exploit","label":"Proof of Concept","score":107},{"type":"cvssScore","label":"7.3","score":365},{"type":"scoreVersion","label":"v1","score":1}],"severity":"high","title":"Improper Input Validation"},{"exploit_maturity":"no-known-exploit","id":"SNYK-JS-AJV-584908","issue_id":"SNYK-JS-AJV-584908","priority_score":405,"priority_score_factors":[{"type":"cvssScore","label":"8.1","score":405},{"type":"scoreVersion","label":"v1","score":1}],"severity":"high","title":"Prototype Pollution"},{"exploit_maturity":"proof-of-concept","id":"SNYK-JS-ASYNC-2441827","issue_id":"SNYK-JS-ASYNC-2441827","priority_score":482,"priority_score_factors":[{"type":"exploit","label":"Proof of Concept","score":107},{"type":"cvssScore","label":"7.5","score":375},{"type":"scoreVersion","label":"v1","score":1}],"severity":"high","title":"Prototype Pollution"},{"exploit_maturity":"no-known-exploit","id":"SNYK-JS-URLPARSE-1078283","issue_id":"SNYK-JS-URLPARSE-1078283","priority_score":265,"priority_score_factors":[{"type":"cvssScore","label":"5.3","score":265},{"type":"scoreVersion","label":"v1","score":1}],"severity":"medium","title":"Improper Input Validation"},{"exploit_maturity":"proof-of-concept","id":"SNYK-JS-BABELTRAVERSE-5962462","issue_id":"SNYK-JS-BABELTRAVERSE-5962462","priority_score":572,"priority_score_factors":[{"type":"exploit","label":"Proof of Concept","score":107},{"type":"cvssScore","label":"9.3","score":465},{"type":"scoreVersion","label":"v1","score":1}],"severity":"critical","title":"Incomplete List of Disallowed Inputs"},{"exploit_maturity":"proof-of-concept","id":"SNYK-JS-ELLIPTIC-7577916","issue_id":"SNYK-JS-ELLIPTIC-7577916","priority_score":562,"priority_score_factors":[{"type":"exploit","label":"Proof of Concept","score":107},{"type":"cvssScore","label":"9.1","score":455},{"type":"scoreVersion","label":"v1","score":1}],"severity":"critical","title":"Improper Verification of Cryptographic Signature"},{"exploit_maturity":"proof-of-concept","id":"SNYK-JS-ELLIPTIC-7577917","issue_id":"SNYK-JS-ELLIPTIC-7577917","priority_score":562,"priority_score_factors":[{"type":"exploit","label":"Proof of Concept","score":107},{"type":"cvssScore","label":"9.1","score":455},{"type":"scoreVersion","label":"v1","score":1}],"severity":"critical","title":"Improper Verification of Cryptographic Signature"},{"exploit_maturity":"proof-of-concept","id":"SNYK-JS-ELLIPTIC-7577918","issue_id":"SNYK-JS-ELLIPTIC-7577918","priority_score...

@snyk-bot
fix: upgrade multiple dependencies with Snyk
14f567a 
Snyk has created this PR to upgrade:
  - react from 16.12.0 to 16.14.0.
    See this package in npm: https://www.npmjs.com/package/react
  - react-dom from 16.12.0 to 16.14.0.
    See this package in npm: https://www.npmjs.com/package/react-dom
  - color from 3.1.2 to 3.2.1.
    See this package in npm: https://www.npmjs.com/package/color
  - react-responsive from 8.0.3 to 8.2.0.
    See this package in npm: https://www.npmjs.com/package/react-responsive
  - react-scripts from 3.4.0 to 3.4.4.
    See this package in npm: https://www.npmjs.com/package/react-scripts
  - react-spinners from 0.8.1 to 0.14.1.
    See this package in npm: https://www.npmjs.com/package/react-spinners
  - react-toggle from 4.1.1 to 4.1.3.
    See this package in npm: https://www.npmjs.com/package/react-toggle
  - react-use-gesture from 7.0.5 to 7.0.16.
    See this package in npm: https://www.npmjs.com/package/react-use-gesture
  - styled-components from 5.0.1 to 5.3.11.
    See this package in npm: https://www.npmjs.com/package/styled-components

See this project in Snyk:
https://app.snyk.io/org/yash509/project/48db8f38-d673-4ee9-b32e-d10ef535a13c?utm_source=github&utm_medium=referral&page=upgrade-pr
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers
No reviews
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
2 participants
@yash509 @snyk-bot