Bump shell-quote and react-scripts#10
Conversation
Bumps [shell-quote](https://github.com/ljharb/shell-quote) to 1.8.4 and updates ancestor dependency [react-scripts](https://github.com/facebook/create-react-app/tree/HEAD/packages/react-scripts). These dependencies need to be updated together. Updates `shell-quote` from 1.6.1 to 1.8.4 - [Changelog](https://github.com/ljharb/shell-quote/blob/main/CHANGELOG.md) - [Commits](ljharb/shell-quote@v1.6.1...v1.8.4) Updates `react-scripts` from 1.0.13 to 5.0.1 - [Release notes](https://github.com/facebook/create-react-app/releases) - [Changelog](https://github.com/react/create-react-app/blob/main/CHANGELOG-1.x.md) - [Commits](https://github.com/facebook/create-react-app/commits/react-scripts@5.0.1/packages/react-scripts) --- updated-dependencies: - dependency-name: shell-quote dependency-version: 1.8.4 dependency-type: indirect - dependency-name: react-scripts dependency-version: 5.0.1 dependency-type: direct:production ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependencies
![semgrep-code-auth0-samples[bot]](https://avatars.githubusercontent.com/in/1042765?s=60&v=4){kind=small}
| range-parser "^1.2.1" | ||
| schema-utils "^4.0.0" | ||
|
|
||
| webpack-dev-server@^4.6.0: |
There was a problem hiding this comment.
Medium severity vulnerability may affect your project—review required:
Line 8492 lists a dependency (webpack-dev-server) with a known Medium severity vulnerability.
ℹ️ Why this matters
Affected versions of webpack-dev-server are vulnerable to Exposed Dangerous Method or Function. webpack-dev-server serves bundled assets without rejecting cross-origin classic script requests. Because such <script src> requests bypass the same-origin policy, a malicious website visited by a developer running the dev server can load the application bundle cross-origin and, via prototype pollution of the webpack runtime, extract the application source code.
To resolve this comment:
Check if you are using webpack dev server CLI setup.
- If you're affected, upgrade this dependency to at least version 5.2.1 at yarn.lock.
- If you're not affected, comment
/fp we don't use this [condition]
💬 Ignore this finding
To ignore this, reply with:
/fp <comment>for false positive/ar <comment>for acceptable risk/other <comment>for all other reasons
You can view more details on this finding in the Semgrep AppSec Platform here.
| range-parser "^1.2.1" | ||
| schema-utils "^4.0.0" | ||
|
|
||
| webpack-dev-server@^4.6.0: |
There was a problem hiding this comment.
Medium severity vulnerability may affect your project—review required:
Line 8492 lists a dependency (webpack-dev-server) with a known Medium severity vulnerability.
ℹ️ Why this matters
Affected versions of webpack-dev-server are vulnerable to Origin Validation Error. webpack-dev-server improperly validates the WebSocket connection Origin header, unconditionally accepting any IP-address-based Origin. A malicious website can perform a cross-site WebSocket hijack against a running dev server and exfiltrate the developer source code carried in Hot Module Reloading (HMR) messages. The insecure origin check is the package default and is reached on every WebSocket connection, so any project running an affected version is vulnerable.
To resolve this comment:
Check if you are using webpack dev server CLI setup and access untrusted web site with non-Chromium based browser.
- If you're affected, upgrade this dependency to at least version 5.2.1 at yarn.lock.
- If you're not affected, comment
/fp we don't use this [condition]
💬 Ignore this finding
To ignore this, reply with:
/fp <comment>for false positive/ar <comment>for acceptable risk/other <comment>for all other reasons
You can view more details on this finding in the Semgrep AppSec Platform here.
|
Semgrep found 1 Risk: Affected versions of bootstrap and bootstrap-sass are vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'). Bootstrap's affix plugin passes its Manual Review Advice: A vulnerability from this advisory is reachable if you are calling Fix: Upgrade this library to at least version 3.4.0 at react-redux-embedded-login/package-lock.json:5367. Reference(s): GHSA-ph58-4vrj-w6hr, CVE-2018-20677 Semgrep found 1 Risk: Affected versions of webpack-dev-server are vulnerable to Exposed Dangerous Method or Function. webpack-dev-server serves bundled assets without rejecting cross-origin classic script requests. Because such Manual Review Advice: A vulnerability from this advisory is reachable if you are using Fix: Upgrade this library to at least version 5.2.1 at react-redux-embedded-login/package-lock.json:17256. Reference(s): GHSA-4v9v-hfq4-rm2v, CVE-2025-30359 Semgrep found 1 Risk: Affected versions of webpack-dev-server are vulnerable to Origin Validation Error. webpack-dev-server improperly validates the WebSocket connection Origin header, unconditionally accepting any IP-address-based Origin. A malicious website can perform a cross-site WebSocket hijack against a running dev server and exfiltrate the developer source code carried in Hot Module Reloading (HMR) messages. The insecure origin check is the package default and is reached on every WebSocket connection, so any project running an affected version is vulnerable. Manual Review Advice: A vulnerability from this advisory is reachable if you are using Fix: Upgrade this library to at least version 5.2.1 at react-redux-embedded-login/package-lock.json:17256. Reference(s): GHSA-9jgg-88mc-972h, CVE-2025-30360 Semgrep found 1 Risk: Affected versions of bootstrap are vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'). Bootstrap's collapse plugin passes the Fix: Upgrade this library to at least version 3.4.0 at react-redux-embedded-login/package-lock.json:5367. Reference(s): GHSA-3wqf-4x89-9g79, CVE-2018-14040 Semgrep found 1 Risk: Affected versions of bootstrap and bootstrap-sass are vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'). Bootstrap's JavaScript plugins (Alert, Carousel, Collapse, Dropdown, Modal, Tab) pass the Fix: Upgrade this library to at least version 3.4.0 at react-redux-embedded-login/package-lock.json:5367. Reference(s): GHSA-4p24-vmcr-4gqj, CVE-2016-10735 Semgrep found 1 Risk: Affected versions of axios are vulnerable to Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting') / Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') / Server-Side Request Forgery (SSRF). Axios can be used as a gadget for header injection: if another dependency enables prototype pollution, polluted properties can be merged into Axios request headers and written without CRLF sanitization, allowing request smuggling/SSRF that can reach internal services such as AWS IMDSv2 and potentially lead to credential theft or broader compromise. Fix: Upgrade this library to at least version 0.31.0 at react-redux-embedded-login/package-lock.json:4952. Reference(s): GHSA-fvcv-3m26-pcqx, CVE-2026-40175 Semgrep found 1 Risk: Affected versions of axios are vulnerable to Server-Side Request Forgery (SSRF) / Unintended Proxy or Intermediary ('Confused Deputy'). Axios does not normalize hostnames before applying Manual Review Advice: A vulnerability from this advisory is reachable if you have Fix: Upgrade this library to at least version 0.31.0 at react-redux-embedded-login/package-lock.json:4952. Reference(s): GHSA-3p68-rc4w-qgx5, CVE-2025-62718 Semgrep found 1 Risk: Affected versions of axios are vulnerable to Inefficient Regular Expression Complexity / Uncontrolled Resource Consumption. axios is vulnerable to a regular expression denial of service (ReDoS). The internal Manual Review Advice: A vulnerability from this advisory is reachable if you are using axios in browser with untrusted Fix: Upgrade this library to at least version 0.32.0 at react-redux-embedded-login/package-lock.json:4952. Reference(s): GHSA-hfxv-24rg-xrqf Semgrep found 1 Risk: Affected versions of ua-parser-js are vulnerable to Uncontrolled Resource Consumption. UAParser.js uses a vulnerable regular expression to parse User-Agent headers. A malicious header can trigger catastrophic backtracking in the regex, resulting in prolonged processing times and potential denial of service. Manual Review Advice: A vulnerability from this advisory is reachable if you are using ua-parser-js via npx cli Fix: Upgrade this library to at least version 0.7.24 at react-redux-embedded-login/package-lock.json:16848. Reference(s): GHSA-78cj-fxph-m83p, CVE-2021-27292 Semgrep found 1 Risk: Affected versions of ua-parser-js are vulnerable to Uncontrolled Resource Consumption. A specially crafted user agent string can trigger catastrophic backtracking in the regex designed for Redmi Phones and Mi Pad Tablets. This may result in a Regular Expression Denial of Service, causing resource exhaustion when ua-parser-js attempts to parse the malicious input. Manual Review Advice: A vulnerability from this advisory is reachable if you are using ua-parser-js via npx cli Fix: Upgrade this library to at least version 0.7.22 at react-redux-embedded-login/package-lock.json:16848. Reference(s): GHSA-662x-fhqg-9p8v, CVE-2020-7733 Semgrep found 1 Risk: Affected versions of ua-parser-js are vulnerable to Uncontrolled Resource Consumption. UAParser.js is vulnerable to Regular Expression Denial of Service (ReDoS) attacks. Maliciously crafted user agent strings can trigger inefficient regex patterns, leading to excessive backtracking and high CPU consumption, which may ultimately cause service degradation or a denial of service. Manual Review Advice: A vulnerability from this advisory is reachable if you are using ua-parser-js via npx cli Fix: Upgrade this library to at least version 0.7.23 at react-redux-embedded-login/package-lock.json:16848. Reference(s): GHSA-394c-5j6w-4xmx, CVE-2020-7793 |
Bumps shell-quote to 1.8.4 and updates ancestor dependency react-scripts. These dependencies need to be updated together.
Updates
shell-quotefrom 1.6.1 to 1.8.4Changelog
Sourced from shell-quote's changelog.
... (truncated)
Commits
ff166e2v1.8.44378a6e[Fix]quote: validate object-token shapes22ebec0[Dev Deps] update@ljharb/eslint-config,auto-changelog,eslint, `npmig...9f3caa3[Tests] increase coverage3344a04[readme] replace runkit CI badge with shields.io check-runs badge699c511[Dev Deps] update@ljharb/eslint-config487a9b4v1.8.301faaff[Fix] remove unnecessary backslash escaping in single quotesb19fc77v1.8.259d29ea[Fix]quote: preserve empty stringsMaintainer changes
This version was pushed to npm by ljharb, a new releaser for shell-quote since your current version.
Install script changes
This version adds
prepublishscript that runs during installation. Review the package contents before updating.Updates
react-scriptsfrom 1.0.13 to 5.0.1Release notes
Sourced from react-scripts's releases.
... (truncated)
Changelog
Sourced from react-scripts's changelog.
... (truncated)
Commits
19fa58dPublish9802941fix: webpack noise printed only if error or warning (#12245)2eef1d0Update templates to use React 18createRoot(#12220)221e511Publish5614c87Add support for Tailwind (#11717)20edab4fix(webpackDevServer): disable overlay for warnings (#11413)3afbbc0Update all dependencies (#11624)f5467d5feat(eslint-config-react-app): support ESLint 8.x (#11375)c7627ceUpdate webpack and dev server (#11646)544befeUpdate package.json (#11597)Maintainer changes
This version was pushed to npm by iansu, a new releaser for react-scripts since your current version.
Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)You can disable automated security fix PRs for this repo from the Security Alerts page.