[Snyk] Fix for 104 vulnerabilities #66
Open
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Snyk has created this PR to fix 104 vulnerabilities in the npm dependencies of this project.
Snyk changed the following file(s):
package.jsonpackage-lock.jsonVulnerabilities that will be fixed with an upgrade:
SNYK-JS-UNSETVALUE-2400660
SNYK-JS-URIJS-1055003
SNYK-JS-URIJS-1078286
SNYK-JS-URIJS-1319803
SNYK-JS-URIJS-1319806
SNYK-JS-URIJS-2401466
SNYK-JS-URIJS-2415026
SNYK-JS-URIJS-2419067
SNYK-JS-URIJS-2440699
SNYK-JS-URIJS-2441239
SNYK-JS-URLPARSE-1078283
SNYK-JS-URLPARSE-1533425
SNYK-JS-URLPARSE-2401205
SNYK-JS-URLPARSE-2407759
SNYK-JS-URLPARSE-2407770
SNYK-JS-URLPARSE-2412697
SNYK-JS-URLPARSE-543307
SNYK-JS-WEBSOCKETEXTENSIONS-570623
SNYK-JS-Y18N-1021887
SNYK-JS-YARGSPARSER-560381
SNYK-JS-LODASH-1040724
SNYK-JS-LODASHES-2434284
SNYK-JS-TAR-174125
SNYK-JS-ELLIPTIC-7577916
SNYK-JS-ELLIPTIC-7577917
SNYK-JS-ELLIPTIC-7577918
SNYK-JS-ELLIPTIC-571484
SNYK-JS-IP-6240864
SNYK-JS-HANDLEBARS-1056767
npm:url-parse:20180731
SNYK-JS-HANDLEBARS-534478
SNYK-JS-LODASH-567746
SNYK-JS-LODASHES-2434283
SNYK-JS-HANDLEBARS-534988
npm:macaddress:20180511
SNYK-JS-JSON5-3182856
SNYK-JS-LODASH-6139239
SNYK-JS-BRACES-6838727
SNYK-JS-ES5EXT-6095076
SNYK-JS-JSYAML-174129
SNYK-JS-AJV-584908
SNYK-JS-QS-3153490
SNYK-JS-ANSIREGEX-1583908
SNYK-JS-ASYNC-2441827
SNYK-JS-DECODEURICOMPONENT-3149970
SNYK-JS-SEMVER-3247795
SNYK-JS-UAPARSERJS-1023599
SNYK-JS-UAPARSERJS-610226
SNYK-JS-SETVALUE-1540541
SNYK-JS-LODASH-450202
SNYK-JS-LODASHES-2434290
SNYK-JS-INI-1048974
SNYK-JS-JSONSCHEMA-1920922
SNYK-JS-LODASH-608086
SNYK-JS-LODASHES-2434285
SNYK-JS-MIXINDEEP-450212
SNYK-JS-SETVALUE-450213
SNYK-JS-LODASH-73638
SNYK-JS-LODASHES-2434287
SNYK-JS-NODEFORGE-598677
SNYK-JS-UAPARSERJS-1072471
SNYK-JS-TAR-6476909
SNYK-JS-HANDLEBARS-1279029
SNYK-JS-INFLIGHT-6095116
SNYK-JS-DOTPROP-543489
SNYK-JS-MINIMIST-559764
SNYK-JS-HANDLEBARS-567742
SNYK-JS-HTTPPROXY-569139
SNYK-JS-LODASH-73639
SNYK-JS-LODASHES-2434286
SNYK-JS-BROWSERIFYSIGN-6037026
SNYK-JS-MICROMATCH-6838728
SNYK-JS-REACTDEVUTILS-72875
SNYK-JS-ACORN-559469
SNYK-JS-LOADERUTILS-3043105
SNYK-JS-HANDLEBARS-480388
SNYK-JS-ELLIPTIC-1064899
SNYK-JS-HANDLEBARS-173692
SNYK-JS-HANDLEBARS-174183
SNYK-JS-HANDLEBARS-469063
SNYK-JS-NODEFETCH-2342118
SNYK-JS-JSYAML-173999
SNYK-JS-NODEFETCH-674311
SNYK-JS-TAR-1579147
SNYK-JS-TAR-1579152
SNYK-JS-TAR-1579155
SNYK-JS-NODENOTIFIER-1035794
SNYK-JS-TAR-1536528
SNYK-JS-TAR-1536531
SNYK-JS-ELLIPTIC-511941
SNYK-JS-GLOBPARENT-1016905
SNYK-JS-HOSTEDGITINFO-1088355
SNYK-JS-LODASH-1018905
SNYK-JS-LODASHES-2434289
SNYK-JS-PATHPARSE-1077067
SNYK-JS-MINIMIST-2429795
SNYK-JS-KINDOF-537849
SNYK-JS-UGLIFYJS-1727251
SNYK-JS-LOADERUTILS-3042992
SNYK-JS-LOADERUTILS-3105943
SNYK-JS-MINIMATCH-3050818
npm:chownr:20180731
SNYK-JS-TAR-1536758
SNYK-JS-MACADDRESS-567156
Release notes
Package name: react
-
16.5.0 - 2018-09-06
- Add a warning if
- Improve the error message when passing an element to
- Don't call profiler
- Add support for React DevTools Profiler (@ bvaughn in #13058)
- Add
- Add
- Add
- Add
- Minimally support iframes (nested browsing contexts) in selection event handling (@ acusti in #12037)
- Support passing booleans to the
- Ignore
- Fix
- Fix incorrect data in
- Fix a crash when using dynamic
- Fix the
- Fix hydration of
- Fix a warning about missing controlled
- Fix
- Fix the
- Fix the
- Fix a performance issue when thousands of roots are re-rendered (@ gaearon in #13335)
- Fix a performance regression that also caused
- Handle errors in more edge cases gracefully (@ gaearon in #13237 and @ acdlite in #13269)
- Don't use proxies for synthetic events in development (@ gaearon in #12171)
- Warn when
- Warn when
- Don't compare
- Include
- Don't overwrite
- Improve component stack for the
- Improve a warning when using
- Improve a warning about invalid textarea usage (@ raunofreiberg in #13361)
- Treat invalid Symbol and function values more consistently (@ raunofreiberg in #13362 and #13389)
- Allow Electron
- Don't show the uncaught error addendum if
- Warn about rendering Generators (@ gaearon in #13312)
- Remove irrelevant suggestion of a legacy method from a warning (@ zx6658 in #13169)
- Remove
- Fix unstable asynchronous mode from doing unnecessary work when an update takes too long (@ acdlite in #13503)
- Fix crash with nullish children when using
- Fix crash when
- Fix
- Deprecate a Jest-specific
- Warn about
- Improve a confusing error message (@ gaearon in #13351)
- Add support for DevTools (@ yunchancho in #13173)
- New package for cooperatively scheduling work in a browser environment. It's used by React internally, but its public API is not finalized yet. (@ flarnie in #12624)
-
16.4.2 - 2018-08-01
-
-
-
16.4.1 - 2018-06-13
- You can now assign
- Fix a crash when the input
- Fix a crash in IE11 when restoring focus to an SVG element. (@ ThaddeusJiang in #12996)
- Fix a range input not updating in some cases. (@ Illu in #12939)
- Fix input validation triggering unnecessarily in Firefox. (@ nhunzaker in #12925)
- Fix an incorrect
- Fix a false positive error when returning an empty
- Fix an incorrect value being provided by new context API. (@ ericsoderberghp in #12985, @ gaearon in #13019)
- Allow multiple root children in test renderer traversal API. (@ gaearon in #13017)
- Fix
-
16.4.0 - 2018-05-24
- Add a new experimental
- Add support for the Pointer Events specification. (@ philipp-spiess in #12507)
- Properly call
- Fix a bug that prevented context propagation in some cases. (@ gaearon in #12708)
- Fix re-rendering of components using
- Fix some attributes incorrectly getting removed from custom element nodes. (@ airamrguez in #12702)
- Fix context providers to not bail out on children if there's a legacy context provider above. (@ gaearon in #12586)
- Add the ability to specify
- Fix a false positive warning when using
- Warn when the
- Improve how
- Change internal event names. This can break third-party packages that rely on React internals in unsupported ways. (@ philipp-spiess in #12629)
- Fix the
- Fix a
- Shallow renderer now ignores
- Fix reading context provided from the tree managed by React DOM. (@ acdlite in #12779)
- This experiment was deleted because it was affecting the bundle size and the API wasn't good enough. It's likely to come back in the future in some other form. (@ gaearon in #12820)
- The new host config shape is flat and doesn't use nested objects. (@ gaearon in #12792)
-
16.4.0-alpha.0911da3 - 2018-02-27
-
16.4.0-alpha.7926752 - 2018-02-13
-
16.4.0-alpha.3174632 - 2018-02-24
-
16.3.2 - 2018-04-16
- Improve the error message when passing
- Fix an IE crash in development when using
- Fix labels in User Timing measurements for new component types. (@ bvaughn in #12609)
- Improve the warning about wrong component type casing. (@ nicolevy in #12533)
- Improve general performance in development mode. (@ gaearon in #12537)
- Improve performance of the experimental
- Add a UMD build. (@ bvaughn in #12594)
from react GitHub release notes16.5.0 (September 5, 2018)
React
React.forwardRefrender function doesn't take exactly two arguments (@ bvaughn in #13168)createElementby mistake (@ DCtheTall in #13131)onRenderuntil after mutations (@ bvaughn in #13572)React DOM
react-dom/profilingentry point alias for profiling in production (@ bvaughn in #13570)onAuxClickevent for browsers that support it (@ jquense in #11571)movementXandmovementYfields to mouse events (@ jasonwilliams in #9018)tangentialPressureandtwistfields to pointer events (@ motiz88 in #13374)focusableSVG attribute (@ gaearon in #13339)<noscript>on the client when when hydrating (@ Ephem in #13537)gridAreato be treated as a unitless CSS property (@ mgol in #13550)compositionendevent when typing Korean on IE11 (@ crux153 in #12563)childrenin the<option>tag (@ Slowyn in #13261, @ gaearon in #13465)checkedattribute not getting initially set on theinput(@ dilidili in #13114)dangerouslySetInnerHTMLwhen__htmlis not a string (@ gaearon in #13353)onChangeto fire on falsy values too (@ nicolevy in #12628)submitandresetbuttons getting an empty label (@ ellsclytn in #12780)onSelectevent not being triggered after drag and drop (@ gaearon in #13422)onClickevent not working inside a portal on iOS (@ aweary in #11927)onChangeto not fire in some cases (@ gaearon in #13423)"false"or"true"is the value of a boolean DOM prop (@ motiz88 in #13372)this.stateis initialized toprops(@ veekas in #11658)styleon hydration in IE due to noisy false positives (@ mgol in #13534)StrictModein the component stack (@ gaearon in #13240)window.eventin IE (@ ConradIrwin in #11696)folder/index.jsnaming convention (@ gaearon in #12059)getDerivedStateFromPropswithout initialized state (@ flxwu in #13317)<webview>tag without warnings (@ philipp-spiess in #13301)e.preventDefault()was called (@ gaearon in #13384)unstable_deferredUpdatesin favor ofunstable_scheduleWorkfromschedule(@ gaearon in #13488)React DOM Server
dangerouslySetInnerHtmlin a selected<option>(@ mridgway in #13078)setTimeoutis missing (@ dustinsoftware in #13088)React Test Renderer and Test Utils
thisin a functional component for shallow renderer to beundefined(@ koba04 in #13144)ReactTestUtils.mockComponent()helper (@ bvaughn in #13193)ReactDOM.createPortalusage within the test renderer (@ bvaughn in #12895)React ART
Schedule (Experimental)
16.4.2 (August 1, 2018)
React DOM Server
Fix a potential XSS vulnerability when the attacker controls an attribute name (
CVE-2018-6341). This fix is available in the latest[email protected], as well as in previous affected minor versions:[email protected],[email protected],[email protected], and[email protected]. (@ gaearon in #13302)Fix a crash in the server renderer when an attribute is called
hasOwnProperty. This fix is only available in[email protected]. (@ gaearon in #13303)16.4.1 (June 13, 2018)
React
propTypesto components returned byReact.ForwardRef. (@ bvaughn in #12911)React DOM
typechanges from some other types totext. (@ spirosikmd in #12135)event.targetvalue for theonChangeevent in IE9. (@ nhunzaker in #12976)<React.Fragment />from a component. (@ philipp-spiess in #12966)React DOM Server
React Test Renderer
getDerivedStateFromProps()in the shallow renderer to not discard the pending state. (@ fatfisz in #13030)React
React.unstable_Profilercomponent for measuring performance. (@ bvaughn in #12745)React DOM
getDerivedStateFromProps()regardless of the reason for re-rendering. (@ acdlite in #12600 and #12802)forwardRef()on a deepersetState(). (@ gaearon in #12690)propTypeson a context provider component. (@ nicolevy in #12658)react-lifecycles-compatin<StrictMode>. (@ bvaughn in #12644)forwardRef()render function haspropTypesordefaultProps. (@ bvaughn in #12644)forwardRef()and context consumers are displayed in the component stack. (@ sophiebits in #12777)React Test Renderer
getDerivedStateFromProps()support to match the new React DOM behavior. (@ koba04 in #12676)testInstance.parentcrash when the parent is a fragment or another special node. (@ gaearon in #12813)forwardRef()components are now discoverable by the test renderer traversal methods. (@ gaearon in #12725)setState()updaters that returnnullorundefined. (@ koba04 in #12756)React ART
React Call Return (Experimental)
React Reconciler (Experimental)
16.3.2 (April 16, 2018)
React
nullorundefinedtoReact.cloneElement. (@ nicolevy in #12534)React DOM
<StrictMode>. (@ bvaughn in #12546)unstable_observedBitsAPI with nesting. (@ gaearon in #12543)React Test Renderer
Package name: react-redux
🎉 This is our first big release supporting the new Context API added in React 16.4!
As such, we now require React 16.4 or higher. Make sure to update your version when updating to this release.
This work has been mostly lead by @ cellog and @ markerikson, with special guest appearances by yours truly and a whole cast of helpful reviewers.
Breaking Changes
The
withRefoption toconnecthas been replaced withforwardRef. If{forwardRef : true}has been passed toconnect, adding a ref to the connected wrapper component will actually return the instance of the wrapped component.Passing
storeas a prop to a connected component is no longer supported. Instead, you may pass a customcontext={MyContext}prop to both<Provider>and<ConnectedComponent>. You may also pass{context : MyContext}as an option toconnect.Behavior Changes
Any library that attempts to access the store instance out of legacy context will break, because we now put the store state into a
<Context.Provider>instead. Examples of this includeconnected-react-routerandreact-redux-subspace. (The current implementation does also put the store itself into that same context. While accessing the store in context is not part of our public API, we will still try to make it possible for other libraries to access it, with the understanding that this could break at any time.)Also, there is a behavior change around dispatching actions in constructors /
componentWillMount. Previously, dispatching in a parent component's constructor would cause its children to immediately use the updated state as they mounted, because each component read from the store individually. In version 6, all components read the same current store state value from context, which means the tree will be consistent and not have "tearing". This is an improvement overall, but there may be applications that relied on the existing behavior.Changes
nullas a valid plain object prototype inisPlainObject()(#1075 by @ rgrove)Changes
nullas a valid plain object prototype inisPlainObject()(#1075 by @ rgrove)