Upgrading react 0.3 to 0.5
Breaking0.3.5 → 0.5.2Breaking4Security1New11Changed4Fixed8Other1
SecurityModerate · CVSS 6.5Fixes a potential XSS vulnerability when using user content as a `key`.GHSA-g53w-52xc-2j85 · CVE-2013-7035 ↗
BreakingUpgrade verdict
4 breaking changes and a security fix.
In plain terms
- The deprecated autoBind helper is gone.
- The function for unmounting a component at a DOM node has a new name.
- If your JSX uses class instead of className, your components will be visually broken until you rename it.
- Props are now always turned into strings before being set on DOM elements, which removes extra type checking and some confusing cases.
Must act Top 4 of 5 that need code or config changes
What you must change
Breaking4
Removes React.autoBind, which was deprecated in v0.4.
React.autoBindRenames React.unmountAndReleaseReactRootNode to React.unmountComponentAtNode.
React.unmountAndReleaseReactRootNodeReact.unmountComponentAtNodeJSX no longer transforms class to className; using class requires changing it to className.
classclassNameStandardizes prop to DOM attribute conversion, always converting values to strings before inserting into the DOM.
Security1
Fixes a potential XSS vulnerability when using user content as a
key.keyModerate · CVSS 6.5