-
Notifications
You must be signed in to change notification settings - Fork 0
[Snyk] Upgrade react-dom from 18.2.0 to 18.3.1 #379
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
base: master
Are you sure you want to change the base?
Conversation
Snyk has created this PR to upgrade react-dom from 18.2.0 to 18.3.1. See this package in npm: react-dom See this project in Snyk: https://app.snyk.io/org/newtonombese1/project/0dbeb3c7-0f2b-4df0-ac5a-fd0108caddf4?utm_source=github&utm_medium=referral&page=upgrade-pr
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Hello @nejidevelops, I'm Gemini Code Assist1! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed!
Summary of Changes
Hello team, gemini-code-assist here with a summary of this pull request. This PR, automatically generated by Snyk, aims to upgrade the react-dom
dependency from version 18.2.0
to 18.3.1
. The primary motivation for this upgrade is to address a significant number of reported vulnerabilities across various transitive dependencies, as detailed in the PR description provided by Snyk. The upgrade to 18.3.1
also includes changes needed for compatibility with React 19 and exports the act
function from the react
package.
Highlights
- Dependency Upgrade: The core change is the upgrade of the
react-dom
package from version18.2.0
to18.3.1
. - Security Fixes: This upgrade is intended to fix numerous reported vulnerabilities, including high and critical severity issues like ReDoS, Prototype Pollution, SSRF, and more, as identified by Snyk.
- React 19 Preparation: Version 18.3.0 (which 18.3.1 is based on) includes warnings for deprecated APIs and other changes necessary for the upcoming React 19 release.
Changelog
- 0x01-react_intro/task_3/dashboard/package.json
- Updated the
react-dom
dependency version from^18.1.0
to^18.3.1
.
- Updated the
Using Gemini Code Assist
The full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips.
Invoking Gemini
You can request assistance from Gemini at any point in your pull request via creating an issue comment (i.e. comment on the pull request page) using either /gemini <command>
or @gemini-code-assist <command>
. Below is a summary of the supported commands.
Feature | Command | Description |
---|---|---|
Code Review | /gemini review |
Performs a code review for the current pull request in its current state. |
Pull Request Summary | /gemini summary |
Provides a summary of the current pull request in its current state. |
Comment | @gemini-code-assist | Responds in comments when explicitly tagged, both in issue comments and review comments. |
Help | /gemini help |
Displays a list of available commands. |
Customization
To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a .gemini/
folder in the base of the repository. Detailed instructions can be found here.
Limitations & Feedback
Gemini Code Assist is currently in preview and may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments to provide feedback.
You can also get AI-powered code generation, chat, as well as code reviews directly in the IDE at no cost with the Gemini Code Assist IDE Extension.
Dependencies grow old,
Security holes unfold.
Upgrade them with care,
Keep your project safe there,
A story often told.
Footnotes
-
Review the Privacy Notices, Generative AI Prohibited Use Policy, Terms of Service, and learn how to configure Gemini Code Assist in GitHub here. Gemini can make mistakes, so double check it and use code with caution. ↩
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Code Review
This Snyk PR proposes an upgrade of react-dom
from 18.2.0
to 18.3.1
. This is a valuable update as it addresses numerous security vulnerabilities, including several critical and high-severity ones, as detailed in the PR description.
The upgrade to [email protected]
is generally a positive step. According to the release notes, version 18.3.0 (which 18.3.1 builds upon) is functionally identical to 18.2.0 but introduces new warnings for APIs deprecated in preparation for React 19. Version 18.3.1 itself includes a minor change related to the act
export.
While the upgrade is primarily for security, it's crucial to ensure it doesn't introduce regressions or new issues. Your react
version is ^18.1.0
, which should be compatible.
Summary of Findings
- Security Vulnerabilities Addressed: The upgrade from
react-dom
18.2.0 to 18.3.1 is crucial as it resolves a significant number of security vulnerabilities, including critical and high-severity ones. - Essential Post-Upgrade Verification: It is essential to conduct thorough testing across the application and meticulously check for new console warnings after applying this upgrade.
react-dom
18.3.x introduces warnings for APIs that are deprecated in preparation for React 19, and these should be investigated. - PR Description Anomaly (Low Severity - Not Commented): The Snyk PR description contains a statement: 'The recommended version was released a year ago.' This appears to be inaccurate, as
[email protected]
was released on April 26, 2024, a fact correctly noted in the detailed release notes within the PR body. This minor discrepancy in the summary text could be confusing. No specific comment was added for this due to the repository's review settings for low-severity issues.
Merge Readiness
This pull request is highly recommended for merging due to the critical security vulnerabilities it addresses by upgrading react-dom
. However, before merging, it is essential that the maintainers perform thorough testing of the application and carefully check for any new console warnings that might be introduced by react-dom
18.3.x.
Once these verification steps are completed and no blocking issues are found, the PR should be safe to merge. As an AI, I am not authorized to approve pull requests; please ensure a human reviewer approves these changes after the necessary checks have been successfully performed.
@@ -7,7 +7,7 @@ | |||
"@testing-library/react": "^13.1.1", | |||
"@testing-library/user-event": "^13.5.0", | |||
"react": "^18.1.0", | |||
"react-dom": "^18.1.0", | |||
"react-dom": "^18.3.1", |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
This upgrade to [email protected]
is important for security. However, there are a couple of critical post-upgrade steps that need to be performed:
-
Thorough Testing: Please ensure all existing tests (unit, integration, E2E, etc.) pass after this upgrade. Dependency updates, even minor ones, can sometimes have unexpected side effects on the application's behavior or test suite.
-
Check Console Warnings: React 18.3.0 (which is part of this 18.3.1 update) introduces new warnings for deprecated APIs in preparation for React 19. After upgrading and running the application, please thoroughly check the browser's developer console for any new warnings. Addressing these warnings proactively will help in future migrations to React 19 and maintain overall code health.
Could you please confirm that these verification steps will be performed before merging this PR?
Snyk has created this PR to upgrade react-dom from 18.2.0 to 18.3.1.
ℹ️ Keep your dependencies up-to-date. This makes it easier to fix existing vulnerabilities and to more quickly identify and fix newly disclosed vulnerabilities when they affect your project.
The recommended version is 388 versions ahead of your current version.
The recommended version was released a year ago.
Issues fixed by the recommended upgrade:
SNYK-JS-ANSIHTML-1296849
SNYK-JS-ANSIREGEX-1583908
SNYK-JS-HTTPPROXYMIDDLEWARE-8229906
SNYK-JS-IP-6240864
SNYK-JS-SSRI-1246392
SNYK-JS-UNSETVALUE-2400660
SNYK-JS-MERGE-1040469
SNYK-JS-MERGE-1042987
SNYK-JS-MICROMATCH-6838728
SNYK-JS-MICROMATCH-6838728
SNYK-JS-MICROMATCH-6838728
SNYK-JS-BRACES-6838727
SNYK-JS-BRACES-6838727
SNYK-JS-BRACES-6838727
SNYK-JS-BROWSERIFYSIGN-6037026
SNYK-JS-WS-7266574
SNYK-JS-SERIALIZEJAVASCRIPT-536840
SNYK-JS-SERIALIZEJAVASCRIPT-570062
SNYK-JS-SERIALIZEJAVASCRIPT-6056521
SNYK-JS-SHELLQUOTE-1766506
SNYK-JS-LOADERUTILS-3043105
SNYK-JS-LODASHTEMPLATE-1088054
SNYK-JS-NODEFORGE-2430339
SNYK-JS-CROSSSPAWN-8303230
SNYK-JS-ELLIPTIC-8172694
SNYK-JS-FOLLOWREDIRECTS-6141137
SNYK-JS-BODYPARSER-7926860
SNYK-JS-WEBPACKDEVMIDDLEWARE-6476555
SNYK-JS-WS-7266574
SNYK-JS-IP-7148531
SNYK-JS-TERSER-2806366
SNYK-JS-TOUGHCOOKIE-5672873
SNYK-JS-TOUGHCOOKIE-5672873
SNYK-JS-UGLIFYJS-1727251
SNYK-JS-WEBPACK-7840298
SNYK-JS-NODEFORGE-2430341
SNYK-JS-PATHTOREGEXP-7925106
SNYK-JS-PATHTOREGEXP-8482416
SNYK-JS-POSTCSS-1255640
SNYK-JS-PROMPTS-1729737
SNYK-JS-MINIMATCH-3050818
SNYK-JS-NODEFORGE-2330875
SNYK-JS-NODEFORGE-2331908
SNYK-JS-BROWSERSLIST-1090194
SNYK-JS-COOKIE-8163060
SNYK-JS-YARGSPARSER-560381
SNYK-JS-YARGSPARSER-560381
SNYK-JS-SOCKJS-575261
SNYK-JS-ISTANBULREPORTS-2328088
SNYK-JS-JSON5-3182856
SNYK-JS-LOADERUTILS-3042992
SNYK-JS-LOADERUTILS-3105943
SNYK-JS-NODEFORGE-2430337
npm:braces:20180219
SNYK-JS-SERVESTATIC-7926865
SNYK-JS-ELLIPTIC-7577916
SNYK-JS-ELLIPTIC-7577917
SNYK-JS-ELLIPTIC-7577918
SNYK-JS-ELLIPTIC-8187303
SNYK-JS-ELLIPTIC-8720086
SNYK-JS-EXPRESS-6474509
SNYK-JS-EXPRESS-7926867
SNYK-JS-FOLLOWREDIRECTS-6444610
SNYK-JS-GLOBPARENT-1016905
SNYK-JS-HTMLMINIFIER-3091181
SNYK-JS-REACTDEVUTILS-1083268
SNYK-JS-REQUEST-3361831
SNYK-JS-SEND-7926862
SNYK-JS-BABELTRAVERSE-5962462
SNYK-JS-BABELTRAVERSE-5962463
SNYK-JS-WORDWRAP-3149973
Release notes
Package name: react-dom
act
fromreact
f1338fThis release is identical to 18.2 but adds warnings for deprecated APIs and other changes that are needed for React 19.
Read the React 19 Upgrade Guide for more info.
React
this.refs
to support string ref codemod 909071findDOMNode
outside StrictMode c3b283test-utils
methods d4ea75defaultProps
for function components #25699key
#25697act
fromtest-utils
d4ea75React DOM
unmountComponentAtNode
8a015brenderToStaticNodeStream
#28874React DOM
onRecoverableError
. (@ gnoff in #24591)document
causing a blank page on mismatch. (@ gnoff in #24523)setState
in Safari when adding an iframe. (@ gaearon in #24459)React DOM Server
<title>
elements to match the browser constraints. (@ gnoff in #24679)highWaterMark
to0
. (@ jplhomer in #24641)Server Components (Experimental)
useId()
inside Server Components. (@ gnoff) in #24172Important
Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open upgrade PRs.
For more information:
[//]: # 'snyk:metadata:{"customTemplate":{"variablesUsed":[],"fieldsUsed":[]},"dependencies":[{"name":"react-dom","from":"18.2.0","to":"18.3.1"}],"env":"prod","hasFixes":true,"isBreakingChange":false,"isMajorUpgrade":false,"issuesToFix":["SNYK-JS-ANSIHTML-1296849","SNYK-JS-ANSIREGEX-1583908","SNYK-JS-HTTPPROXYMIDDLEWARE-8229906","SNYK-JS-IP-6240864","SNYK-JS-SSRI-1246392","SNYK-JS-UNSETVALUE-2400660","SNYK-JS-MERGE-1040469","SNYK-JS-MERGE-1042987","SNYK-JS-MICROMATCH-6838728","SNYK-JS-MICROMATCH-6838728","SNYK-JS-MICROMATCH-6838728","SNYK-JS-BRACES-6838727","SNYK-JS-BRACES-6838727","SNYK-JS-BRACES-6838727","SNYK-JS-BROWSERIFYSIGN-6037026","SNYK-JS-WS-7266574","SNYK-JS-SERIALIZEJAVASCRIPT-536840","SNYK-JS-SERIALIZEJAVASCRIPT-570062","SNYK-JS-SERIALIZEJAVASCRIPT-6056521","SNYK-JS-SHELLQUOTE-1766506","SNYK-JS-LOADERUTILS-3043105","SNYK-JS-LODASHTEMPLATE-1088054","SNYK-JS-NODEFORGE-2430339","SNYK-JS-CROSSSPAWN-8303230","SNYK-JS-ELLIPTIC-8172694","SNYK-JS-FOLLOWREDIRECTS-6141137","SNYK-JS-BODYPARSER-7926860","SNYK-JS-WEBPACKDEVMIDDLEWARE-6476555","SNYK-JS-WS-7266574","SNYK-JS-IP-7148531","SNYK-JS-TERSER-2806366","SNYK-JS-TOUGHCOOKIE-5672873","SNYK-JS-TOUGHCOOKIE-5672873","SNYK-JS-UGLIFYJS-1727251","SNYK-JS-WEBPACK-7840298","SNYK-JS-NODEFORGE-2430341","SNYK-JS-PATHTOREGEXP-7925106","SNYK-JS-PATHTOREGEXP-8482416","SNYK-JS-POSTCSS-1255640","SNYK-JS-PROMPTS-1729737","SNYK-JS-MINIMATCH-3050818","SNYK-JS-NODEFORGE-2330875","SNYK-JS-NODEFORGE-2331908","SNYK-JS-BROWSERSLIST-1090194","SNYK-JS-COOKIE-8163060","SNYK-JS-YARGSPARSER-560381","SNYK-JS-YARGSPARSER-560381","SNYK-JS-SOCKJS-575261","SNYK-JS-ISTANBULREPORTS-2328088","SNYK-JS-JSON5-3182856","SNYK-JS-LOADERUTILS-3042992","SNYK-JS-LOADERUTILS-3105943","SNYK-JS-NODEFORGE-2430337","npm:braces:20180219","SNYK-JS-SERVESTATIC-7926865","SNYK-JS-ELLIPTIC-7577916","SNYK-JS-ELLIPTIC-7577917","SNYK-JS-ELLIPTIC-7577918","SNYK-JS-ELLIPTIC-8187303","SNYK-JS-ELLIPTIC-8720086","SNYK-JS-EXPRESS-6474509","SNYK-JS-EXPRESS-7926867","SNYK-JS-FOLLOWREDIRECTS-6444610","SNYK-JS-GLOBPARENT-1016905","SNYK-JS-HTMLMINIFIER-3091181","SNYK-JS-REACTDEVUTILS-1083268","SNYK-JS-REQUEST-3361831","SNYK-JS-SEND-7926862","SNYK-JS-BABELTRAVERSE-5962462","SNYK-JS-BABELTRAVERSE-5962463","SNYK-JS-WORDWRAP-3149973"],"prId":"a995e622-aadd-4f6a-8273-b02c2c2da8f6","prPublicId":"a995e622-aadd-4f6a-8273-b02c2c2da8f6","packageManager":"npm","priorityScoreList":[696,696,542,751,696,589,589,686,589,696,589,696,619,706,619,619,589,681,365,756,629,472,410,477,646,265,646,479,402,280,452,452,586,372,265,372,315,586,315,601,586,429,641,265,265,280,506,105,776,776,776,786,771,305,255,432,586,586,601,646,105,786,786,506],"projectPublicId":"0dbeb3c7-0f2b-4df0-ac5a-fd0108caddf4","projectUrl":"https://app.snyk.io/org/newtonombese1/project/0dbeb3c7-0f2b-4df0-ac5a-fd0108caddf4?utm_source=github&utm_medium=referral&page=upgrade-pr","prType":"upgrade","templateFieldSources":{"branchName":"default","commitMessage":"default","description":"default","title":"default"},"templateVariants":["priorityScore"],"type":"auto","upgrade":["SNYK-JS-ANSIHTML-1296849","SNYK-JS-ANSIREGEX-1583908","SNYK-JS-HTTPPROXYMIDDLEWARE-8229906","SNYK-JS-IP-6240864","SNYK-JS-SSRI-1246392","SNYK-JS-UNSETVALUE-2400660","SNYK-JS-MERGE-1040469","SNYK-JS-MERGE-1042987","SNYK-JS-MICROMATCH-6838728","SNYK-JS-MICROMATCH-6838728","SNYK-JS-MICROMATCH-6838728","SNYK-JS-BRACES-6838727","SNYK-JS-BRACES-6838727","SNYK-JS-BRACES-6838727","SNYK-JS-BROWSERIFYSIGN-6037026","SNYK-JS-WS-7266574","SNYK-JS-SERIALIZEJAVASCRIPT-536840","SNYK-JS-SERIALIZEJAVASCRIPT-570062","SNYK-JS-SERIALIZEJAVASCRIPT-6056521","SNYK-JS-SHELLQUOTE-1766506","SNYK-JS-LOADERUTILS-3043105","SNYK-JS-LODASHTEMPLATE-1088054","SNYK-JS-NODEFORGE-2430339","SNYK-JS-CROSSSPAWN-8303230","SNYK-JS-ELLIPTIC-8172694","SNYK-JS-FOLLOWREDIRECTS-6141137","SNYK-JS-BODYPARSER-7926860","SNYK-JS-WEBPACKDEVMIDDLEWARE-6476555","SNYK-JS-WS-7266574","SNYK-JS...