3 ms·
My few tiny steps in JS world were alienating in that sense: having a brand new install of all tools, doing a “npx create-react-app” and got greeted with “congr
by rollulus 2y ago
My few tiny steps in JS world were alienating in that sense: having a brand new install of all tools, doing a “npx create-react-app” and got greeted with “congrats, your app is initialised, it has 13 vulnerable dependencies”.
- hombre_fatal 2y agoTbf those are development deps rather than production server deps, and the vuln will be something like "DOS possible if you let users craft their own regex string as input to lib.foo(re) in a server ctx" rather than "by using this in development to build your static js app, people get remote access to your dev machine."
- robertlagrant 2y agoIt is a bit silly then that it reports them as vulnerabilities by default.
- vdvsvwvwvwvwv 2y agoWorse CRA goes from saviour to deprecated, "use nextjs or vite instead" in a blink. Meta should maintain it. Nextjs will probably morph again in the future so you hope investing in learning vite is the answer. JS has this way. Meanwhile Rails is so old it is thinking it needs to find a partner, settle down and buy a picket fenced house.
- mplewis 2y agoUnfortunately, in Rails, your major breaking changes without a migration path come from the core team.
- veidelis 2y agocreate-react-app is not maintained AFAIK