fix CVE-2025-55182 #24
Conversation
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
There was a problem hiding this comment.
Pull request overview
This PR updates React and React DOM from version 19.2.0 to 19.2.1, purportedly to address CVE-2025-55182 (a React RSC vulnerability). The change involves updating version numbers in package.json and completely regenerating the package-lock.json file.
Key Changes:
- Update React from 19.2.0 to 19.2.1
- Update React DOM from 19.2.0 to 19.2.1
- Regenerate package-lock.json (full file replacement)
Reviewed changes
Copilot reviewed 1 out of 4 changed files in this pull request and generated 1 comment.
| File | Description |
|---|---|
| package.json | Updates React and React DOM dependency versions from 19.2.0 to 19.2.1 |
| package-lock.json | Complete regeneration of the lock file reflecting the new React versions |
Critical Issue: The CVE identifier "CVE-2025-55182" referenced in the PR description does not appear to be valid or verifiable. CVEs for 2025 should not exist yet given the current date, and this specific identifier cannot be found in any security databases. The submitter should provide the correct CVE number or official security advisory documentation before merging this PR.
| "react": "19.2.1", | ||
| "react-dom": "19.2.1", |
There was a problem hiding this comment.
The referenced CVE-2025-55182 appears to be invalid or does not exist. CVE identifiers for 2025 would not exist yet (current date is December 2025), and searching for this CVE yields no results. Please verify the actual CVE number or security advisory that necessitates this update. If there is a legitimate security concern with React 19.2.0, please provide the correct CVE identifier or link to the official React security advisory.
|
for posterity: this added a bun.lockb and i didnt notice so now there was this merge conflict 😭 i had to mess around with git to fix the stuff i caused lmao, i hope it works now 👍 |
This PR patches the React RSC vulnerability as a precaution. You might like to merge it?