react-scripts@1.1.4 is missing dependency react-dev-utils@5.0.1 on npm and yarn registry

[mindcrash]

This was a temporary npm registry glitch. It should be fixed now.

Is this a bug report?

Yes

Did you try recovering your dependencies?

Yes

Environment

Environment:
OS: Windows 10
Node: 8.11.0
Yarn: 1.9.4
npm: 5.6.0
Watchman: Not Found
Xcode: N/A
Android Studio: Not Found

Packages: (wanted => installed)
react: ^16.4.1 => 16.4.2
react-dom: ^16.4.1 => 16.4.2
react-scripts: 1.1.4 => 1.1.4

Steps to Reproduce

Run yarn install (or npm install)

Or

Start a web browser
Try to download the package tarball (e.g. https://registry.yarnpkg.com/react-dev-utils/-/react-dev-utils-5.0.1.tgz)

Expected Behavior

react-dev-utils@5.0.1 can be resolved

Actual Behavior

react-dev-utils@5.0.1 cannot be resolved

HTTP error 404 is returned.

Note that this is a critical issue for everyone trying to use tools with a dependency on react-scripts 1.1.4 or use react-scripts 1.1.4 to prepare a React app for production (we can't do this atm)

[prashanth9962]

react-dev-utils@next also fails. I could not proceed with my development work. I am blocked.
react-dev-utils@https://registry.npmjs.org/react-dev-utils/-/react-dev-utils-6.0.0-next.a671462c.tgz

[sebastianplsim]

Also running into this issue.

[alessandrocentanni]

That issue is ongoing for every version, the URL is malformed

https://registry.npmjs.org/react-dev-utils/-/react-dev-utils-6.0.0-next.a671462c.tgz
will return a 404, whereas
https://registry.npmjs.org/react-dev-utils/react-dev-utils-6.0.0-next.a671462c.tgz
will download the package

[stam]

Had the same issue but for https://registry.yarnpkg.com/react-dev-utils/-/react-dev-utils-5.0.1.tgz

To fix it we updated to https://registry.yarnpkg.com/react-dev-utils/react-dev-utils-5.0.1.tgz in the yarn.lock

[sebastianplsim]

# THIS IS AN AUTOGENERATED FILE. DO NOT EDIT THIS FILE DIRECTLY.

Running yarn update worked for me - but with a newer project with fewer dependencies.

[jonnyelliot]

yarn upgrade worked for me, if you don't want to upgrade all your dependencies the relevant change in the lockfile for me was:

 react-dev-utils@^5.0.1:
-  resolved "https://registry.yarnpkg.com/react-dev-utils/-/react-dev-utils-5.0.1.tgz#1f396e161fe44b595db1b186a40067289bf06613"
+  resolved "https://registry.yarnpkg.com/react-dev-utils/-/react-dev-utils-5.0.2.tgz#7bb68d2c4f6ffe7ed1184c5b0124fcad692774d2"

[gaearon]

There was a security vulnerability in react-dev-utils@5.0.1 which was patched in 5.0.2 and other patches for every major release.

What Happened

We fixed it and reported it to npm but to be honest I didn't expect this to result in the package being taken down. I expected that people would see a report when running npm audit with actionable suggestions for how to fix the dependency.

Here's how to fix this.

How to Fix If You Didn't Eject

If you have not ejected you should be able to fix this by:

• Noting which version of react-scripts you have in package.json
• Removing the package
  • npm users: npm uninstall react-scripts
  • yarn users: yarn remove react-scripts
• Re-adding the same version
  • npm users: npm install react-scripts@YOUR_VERSION
  • yarn users: yarn add react-scripts@YOUR_VERSION

How to Fix If You Ejected

If you ejected you should be able to fix this by:

• Changing react-dev-utils version in package.json to the latest depending on your major:
  • react-dev-utils@1.0.4
  • react-dev-utils@2.0.2
  • react-dev-utils@3.1.2
  • react-dev-utils@4.2.2
  • react-dev-utils@5.0.2
  • react-dev-utils@6.0.0-next.a671462c
• Re-running your package manager's install command

Sorry about the disruption.

Why Did Packages Disappear?

I'm following up with npm to understand what happened. I don't know.

[laspinacristian]

It seems like react-dev-utils is Not Found again on NPM

[gaearon]

@CristianCT46 Did you follow my instructions above?

[adityakakarot]

https://registry.npmjs.org/react-dev-utils/-/react-dev-utils-5.0.2.tgz is throwing a 404 in India, working in US.

[gaearon]

Works for me in UK. I’m sorry, I can’t help with this. Something must have gone wrong on the npm side.

[phacks]

The link works in France as well.