[Snyk] Upgrade: react, react-dom

[snyk-bot]

Snyk has created this PR to upgrade multiple dependencies.

👯‍♂ The following dependencies are linked and will therefore be updated together. :information_source: Keep your dependencies up-to-date. This makes it easier to fix existing vulnerabilities and to more quickly identify and fix newly disclosed vulnerabilities when they affect your project.

Name	Versions	Released on
reactfrom 16.2.0 to 16.14.0	49 versions ahead of your current version	6 months agoon 2020-10-14
react-domfrom 16.2.0 to 16.14.0	50 versions ahead of your current version	6 months agoon 2020-10-14

The recommended version fixes:

Severity	Issue	PriorityScore (*)	Exploit Maturity
	Regular Expression Denial of Service (ReDoS) SNYK-JS-UAPARSERJS-610226	482/1000 Why? Proof of Concept exploit, CVSS 7.5	Proof of Concept
	Regular Expression Denial of Service (ReDoS) SNYK-JS-UAPARSERJS-1023599	482/1000 Why? Proof of Concept exploit, CVSS 7.5	Proof of Concept
	Cross-site Scripting (XSS) npm:react-dom:20180802	482/1000 Why? Proof of Concept exploit, CVSS 7.5	Proof of Concept
	Regular Expression Denial of Service (ReDoS) npm:ua-parser-js:20180227	482/1000 Why? Proof of Concept exploit, CVSS 7.5	Proof of Concept
	Regular Expression Denial of Service (ReDoS) SNYK-JS-UAPARSERJS-1072471	482/1000 Why? Proof of Concept exploit, CVSS 7.5	No Known Exploit
	Denial of Service SNYK-JS-NODEFETCH-674311	482/1000 Why? Proof of Concept exploit, CVSS 7.5	No Known Exploit

(*) Note that the real score may have changed since the PR was raised.

Release notes

Package name: react

• 16.14.0 - 2020-10-14

  React

  • Add support for the new JSX transform. (@ lunaruan in #18299)
• 16.13.1 - 2020-03-19

  React DOM

  • Fix bug in legacy mode Suspense where effect clean-up functions are not fired. This only affects users who use Suspense for data fetching in legacy mode, which is not technically supported. (@ acdlite in #18238)
  • Revert warning for cross-component updates that happen inside class render lifecycles (componentWillReceiveProps, shouldComponentUpdate, and so on). (@ gaearon in #18330)

  Artifacts

  • react: https://unpkg.com/[email protected]/umd/
  • react-art: https://unpkg.com/[email protected]/umd/
  • react-dom: https://unpkg.com/[email protected]/umd/
  • react-is: https://unpkg.com/[email protected]/umd/
  • react-test-renderer: https://unpkg.com/[email protected]/umd/
  • scheduler: https://unpkg.com/[email protected]/umd/
• 16.13.0 - 2020-02-26

  React

  • Warn when a string ref is used in a manner that's not amenable to a future codemod (@ lunaruan in #17864)
  • Deprecate React.createFactory() (@ trueadm in #17878)

  React DOM

  • Warn when changes in style may cause an unexpected collision (@ sophiebits in #14181, #18002)
  • Warn when a function component is updated during another component's render phase (@ acdlite in #17099)
  • Deprecate unstable_createPortal (@ trueadm in #17880)
  • Fix onMouseEnter being fired on disabled buttons (@ AlfredoGJ in #17675)
  • Call shouldComponentUpdate twice when developing in StrictMode (@ bvaughn in #17942)
  • Add version property to ReactDOM (@ ealush in #15780)
  • Don't call toString() of dangerouslySetInnerHTML (@ sebmarkbage in #17773)
  • Show component stacks in more warnings (@ gaearon in #17922, #17586)

  Concurrent Mode (Experimental)

  • Warn for problematic usages of ReactDOM.createRoot() (@ trueadm in #17937)
  • Remove ReactDOM.createRoot() callback params and added warnings on usage (@ bvaughn in #17916)
  • Don't group Idle/Offscreen work with other work (@ sebmarkbage in #17456)
  • Adjust SuspenseList CPU bound heuristic (@ sebmarkbage in #17455)
  • Add missing event plugin priorities (@ trueadm in #17914)
  • Fix isPending only being true when transitioning from inside an input event (@ acdlite in #17382)
  • Fix React.memo components dropping updates when interrupted by a higher priority update (@ acdlite in #18091)
  • Don't warn when suspending at the wrong priority (@ gaearon in #17971)
  • Fix a bug with rebasing updates (@ acdlite and @ sebmarkbage in #17560, #17510, #17483, #17480)

  Artifacts

  • react: https://unpkg.com/[email protected]/umd/
  • react-art: https://unpkg.com/[email protected]/umd/
  • react-dom: https://unpkg.com/[email protected]/umd/
  • react-is: https://unpkg.com/[email protected]/umd/
  • react-test-renderer: https://unpkg.com/[email protected]/umd/
  • scheduler: https://unpkg.com/[email protected]/umd/
• 16.12.0 - 2019-11-14

  React DOM

  • Fix passive effects (useEffect) not being fired in a multi-root app. (@ acdlite in #17347)

  React Is

  • Fix lazy and memo types considered elements instead of components (@ bvaughn in #17278)

  Artifacts

  • react: https://unpkg.com/[email protected]/umd/
  • react-art: https://unpkg.com/[email protected]/umd/
  • react-dom: https://unpkg.com/[email protected]/umd/
  • react-is: https://unpkg.com/[email protected]/umd/
  • react-test-renderer: https://unpkg.com/[email protected]/umd/
  • scheduler: https://unpkg.com/[email protected]/umd/

• 16.11.0 - 2019-10-22
• 16.10.2 - 2019-10-03
• 16.10.1 - 2019-09-28
• 16.10.0 - 2019-09-27
• 16.9.0 - 2019-08-08
• 16.9.0-rc.0 - 2019-08-05
• 16.9.0-alpha.0 - 2019-04-03
• 16.8.6 - 2019-03-28
• 16.8.5 - 2019-03-22
• 16.8.4 - 2019-03-05
• 16.8.3 - 2019-02-21
• 16.8.2 - 2019-02-14
• 16.8.1 - 2019-02-06
• 16.8.0 - 2019-02-06
• 16.8.0-alpha.1 - 2019-01-15
• 16.8.0-alpha.0 - 2019-01-09
• 16.7.0 - 2018-12-20
• 16.7.0-alpha.2 - 2018-11-13
• 16.7.0-alpha.1 - 2018-11-13
• 16.7.0-alpha.0 - 2018-10-25
• 16.6.3 - 2018-11-13
• 16.6.2 - 2018-11-13
• 16.6.1 - 2018-11-07
• 16.6.0 - 2018-10-23
• 16.6.0-alpha.f47a958 - 2018-10-10
• 16.6.0-alpha.8af6728 - 2018-10-10
• 16.6.0-alpha.400d197 - 2018-10-05
• 16.6.0-alpha.0 - 2018-09-17
• 16.5.2 - 2018-09-18
• 16.5.1 - 2018-09-13
• 16.5.0 - 2018-09-06
• 16.4.2 - 2018-08-01
• 16.4.1 - 2018-06-13
• 16.4.0 - 2018-05-24
• 16.4.0-alpha.0911da3 - 2018-02-27
• 16.4.0-alpha.7926752 - 2018-02-13
• 16.4.0-alpha.3174632 - 2018-02-24
• 16.3.2 - 2018-04-16
• 16.3.1 - 2018-04-04
• 16.3.0 - 2018-03-29
• 16.3.0-rc.0 - 2018-03-28
• 16.3.0-alpha.3 - 2018-03-22
• 16.3.0-alpha.2 - 2018-03-14
• 16.3.0-alpha.1 - 2018-02-12
• 16.3.0-alpha.0 - 2018-02-02
• 16.2.0 - 2017-11-28

from react GitHub release notes

Package name: react-dom

• 16.14.0 - 2020-10-14

  React

  • Add support for the new JSX transform. (@ lunaruan in #18299)
• 16.13.1 - 2020-03-19

  React DOM

  • Fix bug in legacy mode Suspense where effect clean-up functions are not fired. This only affects users who use Suspense for data fetching in legacy mode, which is not technically supported. (@ acdlite in #18238)
  • Revert warning for cross-component updates that happen inside class render lifecycles (componentWillReceiveProps, shouldComponentUpdate, and so on). (@ gaearon in #18330)

  Artifacts

  • react: https://unpkg.com/[email protected]/umd/
  • react-art: https://unpkg.com/[email protected]/umd/
  • react-dom: https://unpkg.com/[email protected]/umd/
  • react-is: https://unpkg.com/[email protected]/umd/
  • react-test-renderer: https://unpkg.com/[email protected]/umd/
  • scheduler: https://unpkg.com/[email protected]/umd/
• 16.13.0 - 2020-02-26

  React

  • Warn when a string ref is used in a manner that's not amenable to a future codemod (@ lunaruan in #17864)
  • Deprecate React.createFactory() (@ trueadm in #17878)

  React DOM

  • Warn when changes in style may cause an unexpected collision (@ sophiebits in #14181, #18002)
  • Warn when a function component is updated during another component's render phase (@ acdlite in #17099)
  • Deprecate unstable_createPortal (@ trueadm in #17880)
  • Fix onMouseEnter being fired on disabled buttons (@ AlfredoGJ in #17675)
  • Call shouldComponentUpdate twice when developing in StrictMode (@ bvaughn in #17942)
  • Add version property to ReactDOM (@ ealush in #15780)
  • Don't call toString() of dangerouslySetInnerHTML (@ sebmarkbage in #17773)
  • Show component stacks in more warnings (@ gaearon in #17922, #17586)

  Concurrent Mode (Experimental)

  • Warn for problematic usages of ReactDOM.createRoot() (@ trueadm in #17937)
  • Remove ReactDOM.createRoot() callback params and added warnings on usage (@ bvaughn in #17916)
  • Don't group Idle/Offscreen work with other work (@ sebmarkbage in #17456)
  • Adjust SuspenseList CPU bound heuristic (@ sebmarkbage in #17455)
  • Add missing event plugin priorities (@ trueadm in #17914)
  • Fix isPending only being true when transitioning from inside an input event (@ acdlite in #17382)
  • Fix React.memo components dropping updates when interrupted by a higher priority update (@ acdlite in #18091)
  • Don't warn when suspending at the wrong priority (@ gaearon in #17971)
  • Fix a bug with rebasing updates (@ acdlite and @ sebmarkbage in #17560, #17510, #17483, #17480)

  Artifacts

  • react: https://unpkg.com/[email protected]/umd/
  • react-art: https://unpkg.com/[email protected]/umd/
  • react-dom: https://unpkg.com/[email protected]/umd/
  • react-is: https://unpkg.com/[email protected]/umd/
  • react-test-renderer: https://unpkg.com/[email protected]/umd/
  • scheduler: https://unpkg.com/[email protected]/umd/
• 16.12.0 - 2019-11-14

  React DOM

  • Fix passive effects (useEffect) not being fired in a multi-root app. (@ acdlite in #17347)

  React Is

  • Fix lazy and memo types considered elements instead of components (@ bvaughn in #17278)

  Artifacts

  • react: https://unpkg.com/[email protected]/umd/
  • react-art: https://unpkg.com/[email protected]/umd/
  • react-dom: https://unpkg.com/[email protected]/umd/
  • react-is: https://unpkg.com/[email protected]/umd/
  • react-test-renderer: https://unpkg.com/[email protected]/umd/
  • scheduler: https://unpkg.com/[email protected]/umd/

• 16.11.0 - 2019-10-22
• 16.10.2 - 2019-10-03
• 16.10.1 - 2019-09-28
• 16.10.0 - 2019-09-27
• 16.9.0 - 2019-08-08
• 16.9.0-rc.0 - 2019-08-05
• 16.9.0-alpha.0 - 2019-04-03
• 16.8.6 - 2019-03-28
• 16.8.5 - 2019-03-22
• 16.8.4 - 2019-03-05
• 16.8.3 - 2019-02-21
• 16.8.2 - 2019-02-14
• 16.8.1 - 2019-02-06
• 16.8.0 - 2019-02-06
• 16.8.0-alpha.1 - 2019-01-15
• 16.8.0-alpha.0 - 2019-01-09
• 16.7.0 - 2018-12-20
• 16.7.0-alpha.2 - 2018-11-13
• 16.7.0-alpha.1 - 2018-11-13
• 16.7.0-alpha.0 - 2018-10-25
• 16.6.3 - 2018-11-13
• 16.6.2 - 2018-11-13
• 16.6.1 - 2018-11-07
• 16.6.0 - 2018-10-23
• 16.6.0-alpha.8af6728 - 2018-10-10
• 16.6.0-alpha.400d197 - 2018-10-05
• 16.6.0-alpha.0 - 2018-09-17
• 16.5.2 - 2018-09-18
• 16.5.1 - 2018-09-13
• 16.5.0 - 2018-09-06
• 16.4.2 - 2018-08-01
• 16.4.1 - 2018-06-13
• 16.4.0 - 2018-05-24
• 16.4.0-alpha.0911da3 - 2018-02-27
• 16.4.0-alpha.7926752 - 2018-02-13
• 16.4.0-alpha.3174632 - 2018-02-24
• 16.3.3 - 2018-08-01
• 16.3.2 - 2018-04-16
• 16.3.1 - 2018-04-04
• 16.3.0 - 2018-03-29
• 16.3.0-rc.0 - 2018-03-28
• 16.3.0-alpha.3 - 2018-03-22
• 16.3.0-alpha.2 - 2018-03-14
• 16.3.0-alpha.1 - 2018-02-12
• 16.3.0-alpha.0 - 2018-02-02
• 16.2.1 - 2018-08-01
• 16.2.0 - 2017-11-28

from react-dom GitHub release notes

---

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open upgrade PRs.

For more information:

🧐 View latest project report

🛠 Adjust upgrade PR settings

🔕 Ignore this dependency or unsubscribe from future upgrade PRs