React DOM versions 16.3.0 and 16.2.1 are both packages designed for working with the Document Object Model (DOM) in React applications. Both versions share common peer dependencies, notably requiring React version 16.0.0 or higher, and utilize the same core dependencies like fbjs, prop-types, loose-envify, and object-assign, implying a consistent underlying architecture for handling DOM interactions.
A key change between these versions resides in the dist object reflecting the package's distribution details. Version 16.3.0 features a larger unpacked size of 2005802 bytes, an increase from version 16.2.1's 1863665 bytes. While both versions consist of the same number of files(27), this increase in size hints at potential enhancements, bug fixes, or new features incorporated in version 16.3.0. This difference is important from a performance/bundle size point of view.
The release date reveals that version 16.3.0 was released earlier, on March 29, 2018, while version 16.2.1 was released later, on August 1, 2018. This is clearly wrong and the order is inverted. Developers should consider the more recent version for the latest bug fixes and performance improvements. Examining the React changelog between these versions would provide a more thorough understanding of the specific improvements implemented. For those choosing between these versions, the updated 16.3.0 offers potential benefits in terms of stability or added functionality, but requires a trade-off with a bigger bundle size.
All the vulnerabilities related to the version 16.3.0 of the package
Cross-Site Scripting in react-dom
Affected versions of react-dom are vulnerable to Cross-Site Scripting (XSS). The package fails to validate attribute names in HTML tags which may lead to Cross-Site Scripting in specific scenarios. This may allow attackers to execute arbitrary JavaScript in the victim's browser. To be affected by this vulnerability, the application needs to:
ReactDOMServerIf you are using react-dom 16.0.x, upgrade to 16.0.1 or later.
If you are using react-dom 16.1.x, upgrade to 16.1.2 or later.
If you are using react-dom 16.2.x, upgrade to 16.2.1 or later.
If you are using react-dom 16.3.x, upgrade to 16.3.3 or later.
If you are using react-dom 16.4.x, upgrade to 16.4.2 or later.
node-fetch forwards secure headers to untrusted sites
node-fetch forwards secure headers such as authorization, www-authenticate, cookie, & cookie2 when redirecting to a untrusted site.