React-dom versions 16.1.0 and 16.0.1 are React packages designed for interacting with the Document Object Model (DOM). Both versions share core dependencies like fbjs, prop-types, loose-envify, and object-assign, indicating similar functionalities and reliance on the same underlying utility libraries. They also maintain the same peer dependency: react version 16.0.0 or higher, which ensures compatibility. Furthermore, both versions are released under the MIT license and share the same source code repository on GitHub.
The primary differences lie in their release dates and the properties for the distribution package. Version 16.1.0 was released on November 9, 2017, while version 16.0.1 seemingly had a later release date of August 1, 2018. The 16.0.1 version has the info about fileCount (23) and unpackedSize (2100602), probably this information was not tracked for the 16.1.0 version, so is difficult to compare the size between the two versions.
For developers, these versions provide the necessary tools to build user interfaces with React in a web browser environment. Given there isn't significant upgrades besides of bug fixes between the two version, developers choosing between these two versions should likely opt for the newer 16.1.0 since it is more up to date. However, assessing newer React-dom releases is always recommended for leveraging the latest features, performance improvements, and bug fixes within the React ecosystem.
All the vulnerabilities related to the version 16.1.0 of the package
Cross-Site Scripting in react-dom
Affected versions of react-dom are vulnerable to Cross-Site Scripting (XSS). The package fails to validate attribute names in HTML tags which may lead to Cross-Site Scripting in specific scenarios. This may allow attackers to execute arbitrary JavaScript in the victim's browser. To be affected by this vulnerability, the application needs to:
ReactDOMServerIf you are using react-dom 16.0.x, upgrade to 16.0.1 or later.
If you are using react-dom 16.1.x, upgrade to 16.1.2 or later.
If you are using react-dom 16.2.x, upgrade to 16.2.1 or later.
If you are using react-dom 16.3.x, upgrade to 16.3.3 or later.
If you are using react-dom 16.4.x, upgrade to 16.4.2 or later.
node-fetch forwards secure headers to untrusted sites
node-fetch forwards secure headers such as authorization, www-authenticate, cookie, & cookie2 when redirecting to a untrusted site.