React-dom version 16.3.1 is a minor release following version 16.3.0 in the React library's DOM handling component. Both versions, described as packages for working with the DOM, share core dependencies like fbjs, prop-types, loose-envify, and object-assign, ensuring compatibility and feature parity in those areas. They also share the same peer dependency on react version ^16.0.0, indicating that both versions are designed to work seamlessly with React 16 and above. The license remains MIT, and both link to the same React GitHub repository.
The key difference lies in the release timeline and the dist metadata. Version 16.3.1 was released on April 4th, 2018, a few days after its predecessor, which was released on March 29th, 2018. Developers should note the small difference in unpacked size: 2,015,658 bytes for 16.3.1 compared to 2,005,802 bytes for 16.3.0. While the file count remains constant at 27, the slightly larger size could indicate bug fixes, performance improvements, or minor feature additions implemented in 16.3.1. For developers, upgrading to 16.3.1 is generally advised to benefit from these potential enhancements, ensuring stability and a refined React DOM experience. Checking the React changelog for these specific versions is recommended for detailed information about the included changes.
All the vulnerabilities related to the version 16.3.1 of the package
Cross-Site Scripting in react-dom
Affected versions of react-dom
are vulnerable to Cross-Site Scripting (XSS). The package fails to validate attribute names in HTML tags which may lead to Cross-Site Scripting in specific scenarios. This may allow attackers to execute arbitrary JavaScript in the victim's browser. To be affected by this vulnerability, the application needs to:
ReactDOMServer
If you are using react-dom
16.0.x, upgrade to 16.0.1 or later.
If you are using react-dom
16.1.x, upgrade to 16.1.2 or later.
If you are using react-dom
16.2.x, upgrade to 16.2.1 or later.
If you are using react-dom
16.3.x, upgrade to 16.3.3 or later.
If you are using react-dom
16.4.x, upgrade to 16.4.2 or later.
node-fetch forwards secure headers to untrusted sites
node-fetch forwards secure headers such as authorization
, www-authenticate
, cookie
, & cookie2
when redirecting to a untrusted site.