React-dom versions 16.3.1 and 16.3.2 represent incremental updates to Facebook's popular library for building user interfaces. Both versions share the same core description, acting as the React package specifically designed for interacting with the Document Object Model (DOM) in web browsers. Key dependencies like fbjs, prop-types, loose-envify, and object-assign remain consistent across both releases, indicating a stable foundation. The peer dependency on react also remains unchanged, requiring a version compatible with ^16.0.0. This highlights a continued focus on compatibility within the React ecosystem.
The license remains under the permissive MIT license and the location of the source code continues to resolve predictably from the react repository on Github.
The primary difference lies in the dist object. Version 16.3.2 showcases a slightly larger unpacked size of 2020779 bytes compared to version 16.3.1's 2015658 bytes, suggesting minor additions or adjustments in the code. Further this is coupled with the newer release date, 2018-04-16 for 16.3.2 versus 2018-04-04 for 16.3.1. Developers considering upgrading should investigate the specific changes between these versions, potentially through the project's changelog, to understand the performance improvements or bug fixes introduced in the newer release. This may lead to better code maintainability.
All the vulnerabilities related to the version 16.3.2 of the package
Cross-Site Scripting in react-dom
Affected versions of react-dom
are vulnerable to Cross-Site Scripting (XSS). The package fails to validate attribute names in HTML tags which may lead to Cross-Site Scripting in specific scenarios. This may allow attackers to execute arbitrary JavaScript in the victim's browser. To be affected by this vulnerability, the application needs to:
ReactDOMServer
If you are using react-dom
16.0.x, upgrade to 16.0.1 or later.
If you are using react-dom
16.1.x, upgrade to 16.1.2 or later.
If you are using react-dom
16.2.x, upgrade to 16.2.1 or later.
If you are using react-dom
16.3.x, upgrade to 16.3.3 or later.
If you are using react-dom
16.4.x, upgrade to 16.4.2 or later.
node-fetch forwards secure headers to untrusted sites
node-fetch forwards secure headers such as authorization
, www-authenticate
, cookie
, & cookie2
when redirecting to a untrusted site.