Snyk has created this PR to upgrade react-redux from 7.2.5 to 7.2.6.
:information_source: Keep your dependencies up-to-date. This makes it easier to fix existing vulnerabilities and to more quickly identify and fix newly disclosed vulnerabilities when they affect your project.
The recommended version is 1 version ahead of your current version.
The recommended version was released 6 months ago, on 2021-10-25.
This release shrinks the size of our internal Subscription class, and updates useSelector to avoid an unnecessary selector call on mount.
Changes
Subscription Size Refactor
Our internal Subscription implementation has been written as a class ever since it was added in v5. By rewriting it as a closure factory, we were able to shave a few bytes off the final bundle size.
useSelector Mount Optimization
A user noticed that useSelector had never been given an early "bail out if the root state is the same" check to match how connect works. This resulted in a usually-unnecessary second call to the provided selector on mount. We've added that check.
Entry Point Consolidation
We've consolidated the list of exported public APIs into a single file, and both the index.js and alternate-renderers.js entry points now re-export everything from that file. No meaningful change here, just shuffling lines of code around for consistency.
Other Updates
React-Redux v8 and React 18 Development
With the announcement of React 18, we've been working with the React team to plan our migration path to keep React-Redux fully compatible with React's upcoming features.
Snyk has created this PR to upgrade react-redux from 7.2.5 to 7.2.6.
The recommended version fixes:
SNYK-JS-FOLLOWREDIRECTS-2332181
Why? Proof of Concept exploit, CVSS 5.3
SNYK-JS-FOLLOWREDIRECTS-2396346
Why? Proof of Concept exploit, CVSS 5.3
(*) Note that the real score may have changed since the PR was raised.
Release notes
Package name: react-redux
-
7.2.6 - 2021-10-25
- Remove
-
7.2.5 - 2021-09-04
- Port entry point consolidation from 8.x branch (#1811 - @ markerikson)
- Update v7 branch to use Yarn v2 and improve CI process (#1810 - @ markerikson)
- Reduce unnecessary calls to useSelector selector (#1803 - @ sufian-slack )
- Port Subscription closure implementation from 8.x to 7.x (#1809 - @ mbelsky)
from react-redux GitHub release notesJust a quick fix for a Yarn install warning. Sorry about the noise!
Changes
workspacesfrom our package.json to silence a Yarn warning (@ timdorr)This release shrinks the size of our internal
Subscriptionclass, and updatesuseSelectorto avoid an unnecessary selector call on mount.Changes
Subscription Size Refactor
Our internal
Subscriptionimplementation has been written as a class ever since it was added in v5. By rewriting it as a closure factory, we were able to shave a few bytes off the final bundle size.useSelectorMount OptimizationA user noticed that
useSelectorhad never been given an early "bail out if the root state is the same" check to match howconnectworks. This resulted in a usually-unnecessary second call to the provided selector on mount. We've added that check.Entry Point Consolidation
We've consolidated the list of exported public APIs into a single file, and both the
index.jsandalternate-renderers.jsentry points now re-export everything from that file. No meaningful change here, just shuffling lines of code around for consistency.Other Updates
React-Redux v8 and React 18 Development
With the announcement of React 18, we've been working with the React team to plan our migration path to keep React-Redux fully compatible with React's upcoming features.
We've already migrated the React-Redux main development branch to TypeScript, and are prototyping compatibility implementation updates. We'd appreciate any assistance from the community in testing out these changes so that we can ensure React-Redux works great for everyone when React 18 is ready!
Internal Tooling Updates
Our
masterbranch now uses Yarn v2 for package management, is built with TypeScript, and we've made CI updates to test against multiple TS versions.The
7.xbranch has also been updated to use Yarn v2 for consistency.These only affect contributors to the React-Redux package itself.
Changelog
v7.2.4...v7.2.5
Commit messages
Package name: react-redux
- 0bcaec4 7.2.6
- 27e2332 Upgrade a bunch of stuff.
- 9890491 Backwards action steps
- e94b191 Remove yarn and workspace for website
CompareNote: You are seeing this because you or someone else with access to this repository has authorized Snyk to open upgrade PRs.
For more information:
🧐 View latest project report
🛠 Adjust upgrade PR settings
🔕 Ignore this dependency or unsubscribe from future upgrade PRs