safe-airdrop icon indicating copy to clipboard operation
safe-airdrop copied to clipboard

Update react-scripts

Open bh2smith opened this issue 2 years ago • 0 comments

Dependabot has detected this security vulnerability:

https://github.com/bh2smith/safe-airdrop/security/dependabot/31

which is rooted in react-scripts v4.x and would be fixed by bumping to "react-scripts": "^5.0.1",

Unfortunately this clashes with another dependency of ours ("@fast-csv/parse": "^4.3.6") for which there is no new release. Specifically:

Module not found: Error: Can't resolve 'stream' in '/Users/bensniff/Projects/bh2smith/safe-airdrop/node_modules/@fast-csv/parse/build/src'
BREAKING CHANGE: webpack < 5 used to include polyfills for node.js core modules by default.
This is no longer the case. Verify if you need this module and configure a polyfill for it.

If you want to include a polyfill, you need to:
        - add a fallback 'resolve.fallback: { "stream": require.resolve("stream-browserify") }'
        - install 'stream-browserify'
If you don't want to include a polyfill, you can use an empty module like this:
        resolve.fallback: { "stream": false }

Perhaps we also need a new csv alternative.

In fact, all of our critical vulnerability alerts are related to react-scripts v4.0.3

An alternative csv-parser would be https://www.npmjs.com/package/csv-parse which appears to be maintained (last publish was 2 days ago).

bh2smith avatar Jul 01 '22 07:07 bh2smith