[Snyk] Upgrade react-bootstrap from 2.10.0 to 2.10.10 #113
Conversation
Snyk has created this PR to upgrade react-bootstrap from 2.10.0 to 2.10.10. See this package in npm: react-bootstrap See this project in Snyk: https://app.snyk.io/org/mohammadnewton/project/6f9f3488-d738-42f8-8f14-00b41890ccdd?utm_source=github&utm_medium=referral&page=upgrade-pr
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Summary of Changes
Hello @nejidevelops, I'm Gemini Code Assist1! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed!
This pull request, automatically generated by Snyk, updates the react-bootstrap library from version 2.10.0 to 2.10.10. The primary motivation for this upgrade is to address a medium-severity Regular Expression Denial of Service (ReDoS) vulnerability identified in @babel/runtime, along with incorporating numerous bug fixes and improvements from ten intermediate versions of react-bootstrap that have been released over the past four months.
Highlights
- Core Dependency Upgrade: The core
react-bootstraplibrary has been upgraded from version2.10.0to2.10.10. - Security Vulnerability Remediation: This update resolves a medium-severity Regular Expression Denial of Service (ReDoS) vulnerability (SNYK-JS-BABELRUNTIME-10044504) found in the
@babel/runtimetransitive dependency. - Transitive Dependency Updates: Several underlying packages, including
@babel/runtime,@react-aria/ssr,@restart/hooks,@restart/ui,@swc/helpers,@types/prop-types,ajv,tslib, andtypescript, have been updated to their latest compatible versions, bringing in their respective bug fixes and enhancements. - Improved React Compatibility: Updates within
@react-aria/ssrandreact-bootstrapitself include improved compatibility with React 19 types and better handling of ref access. - Component-Specific Bug Fixes: The upgrade incorporates various bug fixes for
react-bootstrapcomponents, such as addressingNavbartype issues,AccordionHeaderaccessibility,Faderef warnings, andOffcanvasbehavior.
Using Gemini Code Assist
The full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips.
Invoking Gemini
You can request assistance from Gemini at any point in your pull request via creating an issue comment (i.e. comment on the pull request page) using either /gemini <command> or @gemini-code-assist <command>. Below is a summary of the supported commands.
| Feature | Command | Description |
|---|---|---|
| Code Review | /gemini review |
Performs a code review for the current pull request in its current state. |
| Pull Request Summary | /gemini summary |
Provides a summary of the current pull request in its current state. |
| Comment | @gemini-code-assist | Responds in comments when explicitly tagged, both in issue comments and review comments. |
| Help | /gemini help |
Displays a list of available commands. |
Customization
To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a .gemini/ folder in the base of the repository. Detailed instructions can be found here.
Limitations & Feedback
Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for Github and other Google products, sign up here.
You can also get AI-powered code generation, chat, as well as code reviews directly in the IDE at no cost with the Gemini Code Assist IDE Extension.
Footnotes
-
Review the Privacy Notices, Generative AI Prohibited Use Policy, Terms of Service, and learn how to configure Gemini Code Assist in GitHub here. Gemini can make mistakes, so double check it and use code with caution. ↩
There was a problem hiding this comment.
Code Review
This pull request, generated by Snyk, upgrades react-bootstrap from version 2.10.0 to 2.10.10. This is a beneficial update that addresses a Regular Expression Denial of Service (ReDoS) vulnerability in a transitive dependency, @babel/runtime, by updating it to a patched version. The changes are confined to package.json and package-lock.json and appear to be correct. Given that this is a minor version bump for react-bootstrap, it is unlikely to introduce breaking changes. The update is recommended for merging to improve the project's security and maintainability.
❌ Deploy Preview for cheery-puppy-b5b31e failed.
|
❌ Deploy Preview for inspiring-phoenix-33338b failed.
|
❌ Deploy Preview for superlative-palmier-cffef4 failed.
|
❌ Deploy Preview for serene-gecko-f910ef failed.
|
Snyk has created this PR to upgrade react-bootstrap from 2.10.0 to 2.10.10.
ℹ️ Keep your dependencies up-to-date. This makes it easier to fix existing vulnerabilities and to more quickly identify and fix newly disclosed vulnerabilities when they affect your project.
The recommended version is 10 versions ahead of your current version.
The recommended version was released 4 months ago.
Issues fixed by the recommended upgrade:
SNYK-JS-BABELRUNTIME-10044504
Release notes
Package name: react-bootstrap
-
2.10.10 - 2025-05-11
- Navbar: add defaultExpanded type (#6926) (4c64270)
-
2.10.9 - 2025-01-30
- update @ restart/ui to v1.9.4 (#6893) (bbbba51)
- Variant/Color type infer (#6885) (0e3ab61)
-
2.10.8 - 2025-01-21
- Navbar: fix react 19 type compatibility (#6886) (7f69899)
- update @ restart/ui to v1.9.3 (#6890) (1277678)
-
2.10.7 - 2024-12-15
- fix type conflicts with react 19 types (#6880) (416145f)
-
2.10.6 - 2024-11-25
- AccordionHeader: apply aria-controls to button (#6868) (8475119)
- fix ref access in React 19 (#6869) (2c65f5d)
- Nav: remove prop-types-extra import from build (#6854) (ab81d6b)
-
2.10.5 - 2024-09-26
- Fade: fix ref warning for react 18.3+ (#6820) (9b8bcd7)
- Offcanvas: do not trigger Navbar onToggle when closing (#6829) (6836e99)
-
2.10.4 - 2024-06-30
- fix component type error (#6821) (ab5e5fb)
-
2.10.3 - 2024-06-19
-
2.10.2 - 2024-03-18
- update @ restart/ui to v1.6.8 (#6779) (c86187f)
- Tabs: add id attribute to nav (#6767) (3b4fd9b)
-
2.10.1 - 2024-02-10
- FormControl: ensures compatibility with @ types/[email protected] (#6763) (652e709)
-
2.10.0 - 2024-01-17
from react-bootstrap GitHub release notes2.10.10 (2025-05-11)
Bug Fixes
2.10.9 (2025-01-30)
Bug Fixes
2.10.8 (2025-01-21)
Bug Fixes
2.10.7 (2024-12-15)
Bug Fixes
2.10.6 (2024-11-25)
Bug Fixes
2.10.5 (2024-09-26)
Bug Fixes
2.10.4 (2024-06-30)
Bug Fixes
v2.10.3
2.10.2 (2024-03-18)
Bug Fixes
2.10.1 (2024-02-10)
Bug Fixes
Important
Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open upgrade PRs.
For more information: