browserlist Security Vulnerability

[zpeterson]

Your dependency on browserslist v4.14.2 is vulnerable and needs to be updated here: react-dev-utils/package.json#L57.

[ohhyunjin]

Not sure if I can mention this here, but there's also a vulnerability issue I'm getting in a project, which is with postcss dependency in react-scripts and Github Dependabot is telling me to upgrade to v8.2.10 or later

UPDATE
After a few days, today, I got another alert now with another dependency: normalize-url and it won't let me update to a non-vulnerable version due to conflicting dependencies with react-scripts. Screenshot attached below.

[thisKeeWord]

^ likewise

[ohhyunjin]

Any updates on this issue? I keep getting vulnerability alerts in my repo.

[croraf]

Can this be closed in favor of: #11012 ?

[gaearon]

These warnings are false positives. There are no actual vulnerabilities affecting your app here.

To fix npm audit warnings, move react-scripts from dependencies to devDependencies in your package.json.

That will remove the false positive warnings.

I agree with the point in #11102 and will make this change so that new projects don't keep having these false positive warnings.

If you want to discuss this, please comment in #11102.

[gaearon]

Please see #11174.