search

JedWatson / react-select

The Select Component for React.js
https://react-select.com/
MIT License
27.63k stars 4.13k forks source link

Yarn audit fails #5615

Closed LubosK closed 1 year ago

LubosK commented 1 year ago

I just install a new fresh next.js app and only your latest version of react-select specifically "5.7.2".

When I run yarn audit I got following error. image

amirhossein-razavi commented 1 year ago

same issue

Methuselah96 commented 1 year ago

This is not something react-select can fix itself, this is reliant on either https://github.com/emotion-js/emotion/issues/3024 and/or https://github.com/kentcdodds/babel-plugin-macros/pull/193 getting fixed/merged.

LubosK commented 1 year ago

for those who cannot wait until this issue will be fixed, as temporary! solution you can force to use yaml version "2.2.2" if you define in package.json in resolutions part the version you need to use. e.g. "resolutions": { "yaml": "2.2.2" },

But be careful and check it twice to ensure it doesn't cause you any other issues

Methuselah96 commented 1 year ago

Also worth noting that some on babel-plugin-macros are of the opinion that this the security vulnerability does not affect the users of babel-plugin-macros. For most I imagine this doesn't matter, but there's likely no real security vulnerability here.

Methuselah96 commented 1 year ago

This should be resolved now (https://github.com/kentcdodds/babel-plugin-macros/issues/192#issuecomment-1527703093).