Currently seeing 24 npm vulnerabilities (1 critical, 16 high, 3 moderate, 4 low).
Main issues
- react-router-dom ^7.5.2 in package.json but project uses React 16 (v7 needs React 18+). This came from a Dependabot PR and blocks npm audit fix
- react-scripts@5.0.0 has multiple vulnerabilities in its dependencies
Proposed Solution
Phase 1 - Fix react-router-dom
- Downgrade react-router-dom to ^5.3.4 (React 16 compatible)
- Run npm audit fix to resolve fixable vulnerabilities
- Reduces vulnerabilities from 24 to 9
Phase 2 (Mid-term)
Consider migration from react-scripts to a more modern build tool, for example:
- Vite (faster, actively maintained)
- Or a plain webpack config
- Or update to React 18 with latest tooling
This would probably resolve the remaining 9 vulnerabilities and improve build performance.