React DOM, the essential package for building user interfaces with React in web browsers, saw a minor version update from 16.1.0 to 16.1.1 in November 2017. While seemingly small, such updates can contain important bug fixes and performance improvements that impact developers directly. Examining the provided package data, the core dependencies remained consistent: fbjs, prop-types, loose-envify, and object-assign versions remained the same, ensuring backward compatibility at the dependency level. The peerDependencies, specifically requiring React version "^16.0.0", also remained unchanged, suggesting that the update was not related to a new React core feature or API. Developers should note that the fundamental API surface they interact with likely remained consistent.
The most notable difference is the release date: version 16.1.1 was released on November 13, 2017, just a few days after version 16.1.0 released on November 9, 2017. This short interval strongly indicates that 16.1.1 likely addressed a critical bug or issue discovered shortly after the 16.1.0 release. While the specific nature of the fix isn't detailed in this data, developers using React DOM should generally upgrade to the latest patch version within a minor version series to benefit from these improvements, ensuring applications are stable and perform optimally. Because of this, version 16.1.1 is the version that developer should use.
All the vulnerabilities related to the version 16.1.1 of the package
Cross-Site Scripting in react-dom
Affected versions of react-dom are vulnerable to Cross-Site Scripting (XSS). The package fails to validate attribute names in HTML tags which may lead to Cross-Site Scripting in specific scenarios. This may allow attackers to execute arbitrary JavaScript in the victim's browser. To be affected by this vulnerability, the application needs to:
ReactDOMServerIf you are using react-dom 16.0.x, upgrade to 16.0.1 or later.
If you are using react-dom 16.1.x, upgrade to 16.1.2 or later.
If you are using react-dom 16.2.x, upgrade to 16.2.1 or later.
If you are using react-dom 16.3.x, upgrade to 16.3.3 or later.
If you are using react-dom 16.4.x, upgrade to 16.4.2 or later.
node-fetch forwards secure headers to untrusted sites
node-fetch forwards secure headers such as authorization, www-authenticate, cookie, & cookie2 when redirecting to a untrusted site.