N
N
n1ksON2021-02-21 00:33:53
React
n1ksON, 2021-02-21 00:33:53

What's the problem with create-react-app?

When creating a project with create-react-app, "1 high severity vulnerability" appears.
npm audit:

High            Prototype Pollution                                           

  Package         immer                                                         

  Patched in      >=8.0.1                                                       

  Dependency of   react-scripts                                                 

  Path            react-scripts > react-dev-utils > immer                       

  More info       https://npmjs.com/advisories/1603                             

found 1 high severity vulnerability in 1934 scanned packages
  1 vulnerability requires manual review. See the full report for details.

With npm audit fix:
npm WARN [email protected] requires a peer of [email protected]>=2.8.0 || >= 3.2.0-dev || >= 3.3.0-dev || >= 3.4.0-dev || >= 3.5.0-dev || >= 3.6.0-dev || >= 3.6.0-beta || >= 3.7.0-dev || >= 3.7.0-beta but none is installed. You must install peer dependencies yourself.
npm WARN optional SKIPPING OPTIONAL DEPENDENCY: [email protected] (node_modules\fsevents):
npm WARN notsup SKIPPING OPTIONAL DEPENDENCY: Unsupported platform for [email protected]: wanted {"os":"darwin","arch":"any"} (current: {"os":"win32","arch":"x64"})
npm WARN optional SKIPPING OPTIONAL DEPENDENCY: [email protected] (node_modules\watchpack-chokidar2\node_modules\fsevents):
npm WARN notsup SKIPPING OPTIONAL DEPENDENCY: Unsupported platform for [email protected]: wanted {"os":"darwin","arch":"any"} (current: {"os":"win32","arch":"x64"})
npm WARN optional SKIPPING OPTIONAL DEPENDENCY: [email protected] (node_modules\webpack-dev-server\node_modules\fsevents):
npm WARN notsup SKIPPING OPTIONAL DEPENDENCY: Unsupported platform for [email protected]: wanted {"os":"darwin","arch":"any"} (current: {"os":"win32","arch":"x64"})

up to date in 51.076s

120 packages are looking for funding
  run `npm fund` for details

fixed 0 of 1 vulnerability in 1934 scanned packages
  1 vulnerability required manual review and could not be updated


I found a similar problem on Reddit, it says that you need to score. Previously, such a problem did not arise. I don't quite understand what to do?

Answer the question

In order to leave comments, you need to log in

2 answer(s)
P
Pavel Shvedov, 2021-02-21
@mmmaaak

Do not mind it

Y
YoungJser, 2021-02-21
@YoungJser

+

Didn't find what you were looking for?

Ask your question

Ask a Question

731 491 924 answers to any question