Done
Details
Details
Assignee
John Coburn
John CoburnReporter
Julian Ladisch
Julian LadischPriority
Sprint
None
Development Team
Stripes Force
Fix versions
RCA Group
TBD
TestRail: Cases
Open TestRail: Cases
TestRail: Runs
Open TestRail: Runs
Created March 22, 2022 at 10:20 AM
Updated June 14, 2022 at 7:40 PM
Resolved April 5, 2022 at 4:06 PM
Overview:
react-hot-loader should be replaced because it is no longer maintained and has security issues.
Steps to Reproduce:
stripes-components uses react-hot-loader in https://github.com/folio-org/stripes-components/blob/v10.1.0/util/childrenOf.js#L10
react-hot-loader hasn't been maintained since Jun 1, 2021. There are 116 open issues and 246 open pull requests as of March 22, 2022: https://github.com/gaearon/react-hot-loader
react-hot-loader has security vulnerabilities: https://nvd.nist.gov/vuln/detail/CVE-2020-7598 , https://nvd.nist.gov/vuln/detail/CVE-2021-44906
Steps to Fix:
The react-hot-loader maintainers say: "Please remove React-Hot-Loader": https://github.com/gaearon/react-hot-loader#moving-towards-next-step
The react-hot-loader maintainers advise to replace it by React Hot Refresh: https://github.com/facebook/react/issues/16604