Repository navigation
Security: 4 Electron (react-devtools dep) security advisories #19279
Description
React version: 16.8.6
There were 4 security issues filed against electron, which react-devtools has as a dep. The lowest version that fixes all 4 is 7.2.4 but the version requirement of electron for react-devtools is ^5.0.0.
I freely admit that a good solution is to install react-devtools as a dev dependency, but for "reasons" that does not work for us. There are likely others out there in similar situations.
These were buried deep in the releases so I am including the links here:
Electron Changelog from 5 -> 6
Electron Changelog from 6 -> 7
Thank you so much for any advice that you may be able to provide. Also thank you for all the work that you do. React, it's community, and it's ecosystem are awesome! 😎
Activity
bvaughn commentedon Jul 8, 2020
Interested in contributing the ugprade?
dobrite commentedon Jul 8, 2020
I'm interested but unfortunately I do not have time to dedicate to moving this through. Hopefully someone else will jump in and tackle this.
bvaughn commentedon Jul 9, 2020
Looks like someone else jumped on it already 😄 I'll review the PR in the morning.
bvaughn commentedon Jul 9, 2020
Fix published as v4.8
https://github.com/facebook/react/blob/master/packages/react-devtools/CHANGELOG.md#480-july-9-2020