[Snyk] Security upgrade react-scripts from 1.1.4 to 5.0.0

[snyk-io]

Snyk has created this PR to fix 1 vulnerabilities in the npm dependencies of this project.

Snyk changed the following file(s):

• demo/package.json
• demo/package-lock.json

Vulnerabilities that will be fixed with an upgrade:

	Issue	Score
	Uncaught Exception SNYK-JS-QS-19432019	738

Breaking Change Risk

Notice: This assessment is enhanced by AI.

---

Important

• Check the changes in this PR to ensure they won't cause issues with your project.
• Max score is 1000. Note that the real score may have changed since the PR was raised.
• This PR was automatically created by Snyk using the credentials of a real user.

---

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report
📜 Customise PR templates
🛠 Adjust project settings
📚 Read about Snyk's upgrade logic

---

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Uncaught Exception

[snyk-io]

This is a massive upgrade across four major versions (v1 → v5) and introduces a very high number of significant breaking changes. A direct upgrade is not recommended and will likely fail. This migration will require significant effort, code changes, and configuration updates.

Key Breaking Changes by Version:

• v2.0.0:

  • Dropped support for Node.js 6.
  • Upgraded core dependencies to Babel 7, Webpack 4, and Jest 23.
  • Polyfills for Internet Explorer 9, 10, and 11 are no longer included by default.

• v3.0.0:

  • Added full support for React Hooks and integrated TypeScript linting with ESLint.
  • The test command now runs in watch mode by default; CI scripts may need the --watchAll=false flag added.

• v4.0.0:

  • Introduced Fast Refresh for better hot-reloading.
  • Upgraded to ESLint 7 and enabled the new JSX transform by default.

• v5.0.0 (Most Critical Changes):

  • Node.js Polyfills Removed: This is the most significant breaking change. Webpack 5 no longer automatically includes polyfills for Node.js core modules. Any dependency relying on modules like buffer, crypto, or stream in the browser will cause the build to fail. This often requires re-configuring the build process or replacing the offending packages.
  • Node.js Version: Dropped support for Node.js 10 and 12; Node 14 or higher is now required.
  • Major Dependency Upgrades: Includes Webpack 5, Jest 27, and ESLint 8.

Source: Create React App GitHub Changelogs.

Recommendation: This upgrade should be treated as a major project. It is highly recommended to perform the migration one major version at a time (1 → 2, 2 → 3, etc.) to isolate and fix breaking changes incrementally. Pay special attention to the Webpack 5 polyfill issue when migrating from v4 to v5, as it is the most common and difficult blocker. Also, note that as of early 2026, the Create React App project is being sunsetted and the React team recommends migrating to modern frameworks like Next.js or Remix.

Notice 🤖: This content was augmented using artificial intelligence. AI-generated content may contain errors and should be reviewed for accuracy before use.

[snyk-io]

⛔ Snyk checks have failed. 7 issues have been found so far.

Status	Scan Engine	Critical	High	Medium	Low	Total (7)
⛔	Open Source Security	0	3	3	0	6 issues
⛔	Licenses	0	0	1	0	1 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

[Copilot]

Pull request overview

This PR is an automated Snyk security upgrade intended to remediate a reported qs vulnerability by bumping the demo app’s Create React App tooling (react-scripts) to a non-vulnerable version.

Changes:

• Upgraded demo app dependency react-scripts from 1.1.4 to 5.0.0.
• Updated demo/package-lock.json to reflect the new dependency graph for react-scripts@5.0.0.

Reviewed changes

Copilot reviewed 1 out of 2 changed files in this pull request and generated 1 comment.

File	Description
demo/package.json	Bumps react-scripts to 5.0.0 in demo dependencies.
demo/package-lock.json	Regenerates lockfile entries to align with react-scripts@5.0.0 and its transitive dependencies.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.