Re:Security alerts on GitHub
by alexlrobertson on Thursday November 16, 2017 @02:37PM
(#15715796)
Just looked at the "dependencies" for one of my projects and it interprets "react" as this 5 year old, defunct repo: https://github.com/wballard/react.
[ Parent
| on HN ]
I am thinking that it's because the React package.json does not have `repository` listed.
https://github.com/facebook/react/blob/master/package.json
See Redux: https://github.com/reactjs/redux/blob/master/package.json#L3...
Re:Security alerts on GitHub
by wereHamster on Thursday November 16, 2017 @04:03PM
(#15716594)
Let's be honest, unless you use a private NPM registry, "react" means https://www.npmjs.com/package/react. GitHub should use the standard resolution algorithm as employed by npm/yarn (the CLI tools).
That's not the package.json that gets published in the npm react package. This one is what you're looking for:
https://github.com/facebook/react/blob/master/packages/react...
How are you depending on react?
I just checked 3 of my projects that use it, and all 3 are pointing to the correct "facebook react" repo.
Re:Security alerts on GitHub
by alexlrobertson on Friday November 17, 2017 @11:07AM
(#15723141)
Just a standard dependency on version 15. It figured out react-dom just fine though.
{
"dependencies": {
"react": "^15.6.1",
"react-dom": "^15.6.1"
}
}