Upgrading react-scripts 0.9 to 1
Breaking0.9.5 → 1.1.5Breaking17Security3Platform1New41Changed77Fixed91Other189
SecurityFixes a Windows-only vulnerability (CVE-2018-6342) in the development server via react-dev-utils.#4866 ↗
BreakingUpgrade verdict
17 breaking changes and a platform requirement change and 3 security fixes.
In plain terms
- Importing a file used to give you its text contents, but now you get a URL to the file instead.
- Browser globals must now be written with a window. prefix, for example window.confirm instead of confirm.
- You can only use standard import statements placed at the top of a file now.
- Apps relying on the old 2009 Flexbox syntax will no longer get an automatic fallback.
Must act Top 5 of 21 that need code or config changes
Node.js requirement changed in 1.0.0-alpha.58689133: >=4 → >=6.
Adds dotenv-expand 4.2.0, postcss-flexbugs-fixes 3.2.0, raf 3.4.0, resolve 1.6.0, sw-precache-webpack-plugin 0.11.4.
Drops connect-history-api-fallback, cross-spawn, detect-port, http-proxy-middleware, json-loader.
Installs 1415 packages in all (was 1093).
What you must change
Breaking17
Importing a file no longer returns its contents as an encoded string; unknown extensions are included in the build and return a URL.
Global methods such as confirm can no longer be used without the window qualifier.
window.confirmconfirmAMD import syntax is no longer allowed, and imports must be at the top of the file.
The 2009 Flexbox specification is no longer polyfilled automatically.
Ignores Moment.js locales by default.
Moment.jsAutofixes some flexbox bugs and drops support for the 2009 flexbox spec.
Application and test files must now reside in src/; imports from outside src/ are no longer supported.
Moment.js locales are excluded from the bundle unless explicitly imported.
momentJest 20 is used, requiring migration for Jest 19 and 20 breaking changes and likely snapshot updates.
JestAdds ModuleScopePlugin to ensure imported files reside in src/.
ModuleScopePluginUpgrades to Jest 20.
JestWhitelists files that can be embedded through url-loader.
url-loaderTweaks lint rules.
Upgrades eslint-plugin-jsx-a11y and activates more rules.
eslint-plugin-jsx-a11yBlacklists confusing global variables.
Only runs tests in src/.
Unhandled Promise rejections now crash tests.
Security3
Fixes a Windows-only vulnerability (CVE-2018-6342) in the development server via react-dev-utils.
Updates url-loader to 0.6.2 for a mime ReDoS vulnerability.
url-loaderFixes a Webpack vulnerability affecting projects that used the HTTPS=true environment variable in development.
HTTPSPlatform1
Drops support for Node 4 and NPM 2; requires Node 6 LTS or newer.