React: Security: 4 Electron (react-devtools dep) security advisories

[dobrite]

React version: 16.8.6

There were 4 security issues filed against electron, which react-devtools has as a dep. The lowest version that fixes all 4 is 7.2.4 but the version requirement of electron for react-devtools is ^5.0.0.

I freely admit that a good solution is to install react-devtools as a dev dependency, but for "reasons" that does not work for us. There are likely others out there in similar situations.

• Issue 1: low
• Issue 2: high
• Issue 3: moderate
• Issue 4: high

These were buried deep in the releases so I am including the links here:

Electron Changelog from 5 -> 6
Electron Changelog from 6 -> 7

Thank you so much for any advice that you may be able to provide. Also thank you for all the work that you do. React, it's community, and it's ecosystem are awesome! 😎

[bvaughn]

Interested in contributing the ugprade?

[dobrite]

I'm interested but unfortunately I do not have time to dedicate to moving this through. Hopefully someone else will jump in and tackle this.

[bvaughn]

Looks like someone else jumped on it already :smile: I'll review the PR in the morning.

[bvaughn]

Fix published as v4.8

https://github.com/facebook/react/blob/master/packages/react-devtools/CHANGELOG.md#480-july-9-2020