Vulnerabilities

DepShield reports that this application's usage of lodash.sortby:4.7.0 results in the following vulnerability(s):

• (CVSS 7.4) CWE-471: Modification of Assumed-Immutable Data (MAID)

Occurrences

lodash.sortby:4.7.0 is a transitive dependency introduced by the following direct dependency(s):

• react-scripts:2.1.3
        └─ @svgr/webpack:2.4.1
              └─ @svgr/core:2.4.1
                    └─ h2x-core:1.1.1
                          └─ h2x-parse:1.1.1
                                └─ jsdom:13.2.0
                                      └─ whatwg-url:7.0.0
                                            └─ lodash.sortby:4.7.0
        └─ jest:23.6.0
              └─ jest-cli:23.6.0
                    └─ jest-environment-jsdom:23.4.0
                          └─ jsdom:11.12.0
                                └─ whatwg-url:6.5.0
                                      └─ lodash.sortby:4.7.0

_{This is an automated GitHub Issue created by Sonatype DepShield. Details on managing GitHub Apps, including DepShield, are available for personal and organization accounts. Please submit questions or feedback about DepShield to the Sonatype DepShield Community.}

Vulnerabilities

DepShield reports that this application's usage of mime:1.3.6 results in the following vulnerability(s):

• (CVSS 7.5) CWE-400: Uncontrolled Resource Consumption ('Resource Exhaustion')

Occurrences

mime:1.3.6 is a transitive dependency introduced by the following direct dependency(s):

• react-scripts:1.0.14
        └─ url-loader:0.5.9
              └─ mime:1.3.6

_{This is an automated GitHub Issue created by Sonatype DepShield. Details on managing GitHub Apps, including DepShield, are available for personal and organization accounts. Please submit questions or feedback about DepShield to the Sonatype DepShield Community.}

Vulnerabilities

DepShield reports that this application's usage of lodash.camelcase:4.3.0 results in the following vulnerability(s):

• (CVSS 7.4) CWE-471: Modification of Assumed-Immutable Data (MAID)
• (CVSS 6.5) [CVE-2018-3721] lodash node module before 4.17.5 suffers from a Modification of Assumed-Immutabl...

Occurrences

lodash.camelcase:4.3.0 is a transitive dependency introduced by the following direct dependency(s):

• react-scripts:2.1.3
        └─ css-loader:1.0.0
              └─ lodash.camelcase:4.3.0

_{This is an automated GitHub Issue created by Sonatype DepShield. Details on managing GitHub Apps, including DepShield, are available for personal and organization accounts. Please submit questions or feedback about DepShield to the Sonatype DepShield Community.}

Vulnerabilities

DepShield reports that this application's usage of lodash.uniq:4.5.0 results in the following vulnerability(s):

• (CVSS 7.4) CWE-471: Modification of Assumed-Immutable Data (MAID)

Occurrences

lodash.uniq:4.5.0 is a transitive dependency introduced by the following direct dependency(s):

• react-scripts:1.0.14
        └─ css-loader:0.28.4
              └─ cssnano:3.10.0
                    └─ postcss-merge-rules:2.1.2
                          └─ caniuse-api:1.6.1
                                └─ lodash.uniq:4.5.0

_{This is an automated GitHub Issue created by Sonatype DepShield. Details on managing GitHub Apps, including DepShield, are available for personal and organization accounts. Please submit questions or feedback about DepShield to the Sonatype DepShield Community.}

Vulnerabilities

DepShield reports that this application's usage of cryptiles:2.0.5 results in the following vulnerability(s):

• (CVSS 9.8) [CVE-2018-1000620] Insufficient Entropy

Occurrences

cryptiles:2.0.5 is a transitive dependency introduced by the following direct dependency(s):

• react-scripts:1.0.14
        └─ fsevents:1.1.2
              └─ node-pre-gyp:0.6.36
                    └─ request:2.81.0
                          └─ hawk:3.1.3
                                └─ cryptiles:2.0.5

_{This is an automated GitHub Issue created by Sonatype DepShield. Details on managing GitHub Apps, including DepShield, are available for personal and organization accounts. Please submit questions or feedback about DepShield to the Sonatype DepShield Community.}

Depshield will be deprecated on Monday December 12th

Please install our new product, Sonatype Lift with advanced features

Vulnerabilities

DepShield reports that this application's usage of hoek:2.16.3 results in the following vulnerability(s):

• (CVSS 6.5) [CVE-2018-3728] Improper Access Control

Occurrences

hoek:2.16.3 is a transitive dependency introduced by the following direct dependency(s):

• react-scripts:1.0.14
        └─ fsevents:1.1.2
              └─ node-pre-gyp:0.6.36
                    └─ request:2.81.0
                          └─ hawk:3.1.3
                                └─ boom:2.10.1
                                      └─ hoek:2.16.3
                                └─ hoek:2.16.3
                                └─ sntp:1.0.9
                                      └─ hoek:2.16.3

_{This is an automated GitHub Issue created by Sonatype DepShield. Details on managing GitHub Apps, including DepShield, are available for personal and organization accounts. Please submit questions or feedback about DepShield to the Sonatype DepShield Community.}

Vulnerabilities

DepShield reports that this application's usage of sshpk:1.13.0 results in the following vulnerability(s):

• (CVSS 7.5) CWE-400: Uncontrolled Resource Consumption ('Resource Exhaustion')

Occurrences

sshpk:1.13.0 is a transitive dependency introduced by the following direct dependency(s):

• react-scripts:1.0.14
        └─ fsevents:1.1.2
              └─ node-pre-gyp:0.6.36
                    └─ request:2.81.0
                          └─ http-signature:1.1.1
                                └─ sshpk:1.13.0

_{This is an automated GitHub Issue created by Sonatype DepShield. Details on managing GitHub Apps, including DepShield, are available for personal and organization accounts. Please submit questions or feedback about DepShield to the Sonatype DepShield Community.}

Vulnerabilities

DepShield reports that this application's usage of deep-extend:0.4.2 results in the following vulnerability(s):

• (CVSS 9.8) [CVE-2018-3750] Improper Input Validation
• (CVSS 7.4) CWE-471: Modification of Assumed-Immutable Data (MAID)

Occurrences

deep-extend:0.4.2 is a transitive dependency introduced by the following direct dependency(s):

• react-scripts:1.0.14
        └─ fsevents:1.1.2
              └─ node-pre-gyp:0.6.36
                    └─ rc:1.2.1
                          └─ deep-extend:0.4.2

_{This is an automated GitHub Issue created by Sonatype DepShield. Details on managing GitHub Apps, including DepShield, are available for personal and organization accounts. Please submit questions or feedback about DepShield to the Sonatype DepShield Community.}

Vulnerabilities

DepShield reports that this application's usage of lodash.defaults:4.2.0 results in the following vulnerability(s):

• (CVSS 7.4) CWE-471: Modification of Assumed-Immutable Data (MAID)

Occurrences

lodash.defaults:4.2.0 is a transitive dependency introduced by the following direct dependency(s):

• react-scripts:1.0.14
        └─ sw-precache-webpack-plugin:0.11.4
              └─ sw-precache:5.2.1
                    └─ lodash.defaults:4.2.0

_{This is an automated GitHub Issue created by Sonatype DepShield. Details on managing GitHub Apps, including DepShield, are available for personal and organization accounts. Please submit questions or feedback about DepShield to the Sonatype DepShield Community.}

Vulnerabilities

DepShield reports that this application's usage of lodash.memoize:4.1.2 results in the following vulnerability(s):

• (CVSS 7.4) CWE-471: Modification of Assumed-Immutable Data (MAID)

Occurrences

lodash.memoize:4.1.2 is a transitive dependency introduced by the following direct dependency(s):

• react-scripts:1.0.14
        └─ css-loader:0.28.4
              └─ cssnano:3.10.0
                    └─ postcss-merge-rules:2.1.2
                          └─ caniuse-api:1.6.1
                                └─ lodash.memoize:4.1.2

_{This is an automated GitHub Issue created by Sonatype DepShield. Details on managing GitHub Apps, including DepShield, are available for personal and organization accounts. Please submit questions or feedback about DepShield to the Sonatype DepShield Community.}

Vulnerabilities

DepShield reports that this application's usage of lodash.templatesettings:4.1.0 results in the following vulnerability(s):

• (CVSS 7.4) CWE-471: Modification of Assumed-Immutable Data (MAID)

Occurrences

lodash.templatesettings:4.1.0 is a transitive dependency introduced by the following direct dependency(s):

• react-scripts:2.1.3
        └─ postcss-preset-env:6.3.1
              └─ postcss-initial:3.0.0
                    └─ lodash.template:4.4.0
                          └─ lodash.templatesettings:4.1.0

_{This is an automated GitHub Issue created by Sonatype DepShield. Details on managing GitHub Apps, including DepShield, are available for personal and organization accounts. Please submit questions or feedback about DepShield to the Sonatype DepShield Community.}

Vulnerabilities

DepShield reports that this application's usage of debug:2.6.8 results in the following vulnerability(s):

• (CVSS 7.5) CWE-400: Uncontrolled Resource Consumption ('Resource Exhaustion')

Occurrences

debug:2.6.8 is a transitive dependency introduced by the following direct dependency(s):

• react-scripts:1.0.14
        └─ fsevents:1.1.2
              └─ node-pre-gyp:0.6.36
                    └─ tar-pack:3.4.0
                          └─ debug:2.6.8

_{This is an automated GitHub Issue created by Sonatype DepShield. Details on managing GitHub Apps, including DepShield, are available for personal and organization accounts. Please submit questions or feedback about DepShield to the Sonatype DepShield Community.}

Vulnerabilities

DepShield reports that this application's usage of lodash.cond:4.5.2 results in the following vulnerability(s):

• (CVSS 7.4) CWE-471: Modification of Assumed-Immutable Data (MAID)

Occurrences

lodash.cond:4.5.2 is a transitive dependency introduced by the following direct dependency(s):

• react-scripts:1.0.14
        └─ eslint-plugin-import:2.7.0
              └─ lodash.cond:4.5.2

_{This is an automated GitHub Issue created by Sonatype DepShield. Details on managing GitHub Apps, including DepShield, are available for personal and organization accounts. Please submit questions or feedback about DepShield to the Sonatype DepShield Community.}

This issue lists Renovate updates and detected dependencies. Read the Dependency Dashboard docs to learn more.

Open

These updates have all been created already. Click a checkbox below to force a retry/rebase of any.

• fix(deps): update dependency react-scripts to v5.0.1
• chore(deps): update dependency react-bootstrap to v0.33.1
• fix(deps): update react monorepo to v16.14.0 (react, react-dom)
• chore(deps): update dependency react-bootstrap to v2
• fix(deps): update react monorepo to v18 (major) (react, react-dom)
• Click on this checkbox to rebase all open PRs at once

Detected dependencies

• Check this box to trigger a request for Renovate to run again on this repository

Vulnerabilities

DepShield reports that this application's usage of tough-cookie:2.3.2 results in the following vulnerability(s):

• (CVSS 7.5) CWE-185: Incorrect Regular Expression

Occurrences

tough-cookie:2.3.2 is a transitive dependency introduced by the following direct dependency(s):

• react-scripts:1.0.14
        └─ fsevents:1.1.2
              └─ node-pre-gyp:0.6.36
                    └─ request:2.81.0
                          └─ tough-cookie:2.3.2

_{This is an automated GitHub Issue created by Sonatype DepShield. Details on managing GitHub Apps, including DepShield, are available for personal and organization accounts. Please submit questions or feedback about DepShield to the Sonatype DepShield Community.}

Vulnerabilities

DepShield reports that this application's usage of lodash.tail:4.1.1 results in the following vulnerability(s):

• (CVSS 7.4) CWE-471: Modification of Assumed-Immutable Data (MAID)

Occurrences

lodash.tail:4.1.1 is a transitive dependency introduced by the following direct dependency(s):

• react-scripts:2.1.3
        └─ sass-loader:7.1.0
              └─ lodash.tail:4.1.1

_{This is an automated GitHub Issue created by Sonatype DepShield. Details on managing GitHub Apps, including DepShield, are available for personal and organization accounts. Please submit questions or feedback about DepShield to the Sonatype DepShield Community.}

🚨 You need to enable Continuous Integration on Greenkeeper branches of this repository. 🚨

To enable Greenkeeper, you need to make sure that a commit status is reported on all branches. This is required by Greenkeeper because it uses your CI build statuses to figure out when to notify you about breaking changes.

Since we didn’t receive a CI status on the greenkeeper/initial branch, it’s possible that you don’t have CI set up yet. We recommend using Travis CI, but Greenkeeper will work with every other CI service as well.

If you have already set up a CI for this repository, you might need to check how it’s configured. Make sure it is set to run on all new branches. If you don’t want it to run on absolutely every branch, you can whitelist branches starting with greenkeeper/.

Once you have installed and configured CI on this repository correctly, you’ll need to re-trigger Greenkeeper’s initial pull request. To do this, please click the 'fix repo' button on account.greenkeeper.io.

Vulnerabilities

DepShield reports that this application's usage of lodash._reinterpolate:3.0.0 results in the following vulnerability(s):

• (CVSS 7.4) CWE-471: Modification of Assumed-Immutable Data (MAID)

Occurrences

lodash._reinterpolate:3.0.0 is a transitive dependency introduced by the following direct dependency(s):

• react-scripts:1.0.14
        └─ sw-precache-webpack-plugin:0.11.4
              └─ sw-precache:5.2.1
                    └─ lodash.template:4.4.0
                          └─ lodash._reinterpolate:3.0.0
                          └─ lodash.templatesettings:4.1.0
                                └─ lodash._reinterpolate:3.0.0

_{This is an automated GitHub Issue created by Sonatype DepShield. Details on managing GitHub Apps, including DepShield, are available for personal and organization accounts. Please submit questions or feedback about DepShield to the Sonatype DepShield Community.}

Vulnerabilities

DepShield reports that this application's usage of lodash.template:4.4.0 results in the following vulnerability(s):

• (CVSS 7.4) CWE-471: Modification of Assumed-Immutable Data (MAID)

Occurrences

lodash.template:4.4.0 is a transitive dependency introduced by the following direct dependency(s):

• react-scripts:2.1.3
        └─ postcss-preset-env:6.3.1
              └─ postcss-initial:3.0.0
                    └─ lodash.template:4.4.0
        └─ workbox-webpack-plugin:3.6.3
              └─ workbox-build:3.6.3
                    └─ lodash.template:4.4.0

_{This is an automated GitHub Issue created by Sonatype DepShield. Details on managing GitHub Apps, including DepShield, are available for personal and organization accounts. Please submit questions or feedback about DepShield to the Sonatype DepShield Community.}

Vulnerabilities

DepShield reports that this application's usage of stringstream:0.0.5 results in the following vulnerability(s):

• (CVSS 5.2) CWE-125: Out-of-bounds Read

Occurrences

stringstream:0.0.5 is a transitive dependency introduced by the following direct dependency(s):

• react-scripts:1.0.14
        └─ fsevents:1.1.2
              └─ node-pre-gyp:0.6.36
                    └─ request:2.81.0
                          └─ stringstream:0.0.5

_{This is an automated GitHub Issue created by Sonatype DepShield. Details on managing GitHub Apps, including DepShield, are available for personal and organization accounts. Please submit questions or feedback about DepShield to the Sonatype DepShield Community.}

Vulnerabilities

DepShield reports that this application's usage of lodash.debounce:4.0.8 results in the following vulnerability(s):

• (CVSS 7.4) CWE-471: Modification of Assumed-Immutable Data (MAID)
• (CVSS 6.5) [CVE-2018-3721] lodash node module before 4.17.5 suffers from a Modification of Assumed-Immutabl...

Occurrences

lodash.debounce:4.0.8 is a transitive dependency introduced by the following direct dependency(s):

• react-scripts:1.0.14
        └─ webpack:3.5.1
              └─ watchpack:1.6.0
                    └─ chokidar:2.0.4
                          └─ lodash.debounce:4.0.8

_{This is an automated GitHub Issue created by Sonatype DepShield. Details on managing GitHub Apps, including DepShield, are available for personal and organization accounts. Please submit questions or feedback about DepShield to the Sonatype DepShield Community.}