search

v0ltoz / react-datetimepicker

MIT License
92 stars 71 forks source link

Missing Origin Validation - vulnerability #17

Closed quynhntn1988 closed 5 years ago

quynhntn1988 commented 5 years ago

There is a vulnerability with react-scripts 2.1.1 that the project is dependent on as shown below. Please update the package.json to use react-scripts 2.1.3.

Thank You!

v2.1.3 is a maintenance release to fix a vulnerability in webpack-dev-server. https://github.com/facebook/create-react-app/releases

from-nibly commented 5 years ago

This is the only react library in my node modules currently using react-scripts. This causes all kinds of problems when trying to use this dependency in an actual app. react-scripts should be used in react apps not react libraries.

v0ltoz commented 5 years ago

Fixed, it is now a dev dependency. Has also been upgraded and an npm audit completed.