Replies: 3 comments 14 replies
-
|
Unfortunately |
Beta Was this translation helpful? Give feedback.
-
|
@alexander-akait , any updates on this fix? |
Beta Was this translation helpful? Give feedback.
-
|
@alexander-akait, any update ? |
Beta Was this translation helpful? Give feedback.
-
|
@alexander-akait bump and thanks in advance |
Beta Was this translation helpful? Give feedback.
-
|
@alexander-akait bump and thanks in advance |
Beta Was this translation helpful? Give feedback.
-
|
@alexander-akait any update? Unfortunately we are unable to move away from react-scripts at this time and need to be able to build locally. I believe @Wajih-Ul-Hasan said he had a PR for this already. Are security fixes still on the table for version 4? Thank you! |
Beta Was this translation helpful? Give feedback.
-
|
@alexander-akait can you provide the any alternative to resolve this issue we need to fix it for our client by the end of the next Monday. |
Beta Was this translation helpful? Give feedback.
-
|
You can send a PR with backporting fixes to v4, I am planning to do it, but can't find time right now |
Beta Was this translation helpful? Give feedback.
-
|
@alexander-akait PR created with backporting fixes to v4. |
Beta Was this translation helpful? Give feedback.
-
|
Thanks @Wajih-Ul-Hasan ! @alexander-akait , it this PR being considered for a potential version 4 update? The problem we have, is we cannot override to webpack-dev-server 5.2.2 because of the config-override changes in format that react-scripts uses. It causes our build to fail. The vulnerability, while I realize is dev env only, is something we really want to get cleaned up for our client. Thanks so much for discussing this! |
Beta Was this translation helpful? Give feedback.
-
|
@alexander-akait I simply override "webpack-dev-server" to version "^5.2.2", and it fixed my issue. Since webpack-dev-server is only used for local development, and production environments serve only static files, this override does not affect the app’s behavior in production — at least as far as I understand it. |
Beta Was this translation helpful? Give feedback.
-
|
Yeah, webpack-dev-server is only for development env |
Beta Was this translation helpful? Give feedback.
-
|
But it breaks the ability to run the dev server for the developers local environments. Is there a link for us to track v4 progress? |
Beta Was this translation helpful? Give feedback.
Uh oh!
There was an error while loading. Please reload this page.
-
I'm using react-scripts@5.0.1, which is locked to webpack-dev-server@4.x.
A vulnerability was found: CVE-2025-30360
While webpack5.2.1 fixes the CVE (using override), the upgrade doesn't let me run the app. I get this error on npm start:
Invalid options object. Dev Server has been initialized using an options object that does not match the API schema.
options has an unknown property 'onAfterSetupMiddleware'. These properties are valid:
object { allowedHosts?, bonjour?, client?, compress?, devMiddleware?, headers?, historyApiFallback?, host?, hot?, ipc?, liveReload?, onListening?, open?, port?, proxy?, server?, app?, setupExitSignals?, setupMiddlewares?, static?, watchFiles?, webSocketServer? }
any solutions?
Beta Was this translation helpful? Give feedback.
All reactions