Describe the bug
Dependabot alerts for a high severity vulnerability:
Dependabot cannot update is-svg to a non-vulnerable version
The latest possible version that can be installed is 3.0.0 because of the following conflicting dependency:
react-scripts@4.0.3 requires is-svg@^3.0.0 via a transitive dependency on postcss-svgo@4.0.2
The earliest fixed version is 4.2.2.
CVE-2021-28092
Suggested dependabot remediation
Upgrade is-svg to version 4.2.2 or later. For example:
"dependencies": {
"is-svg": ">=4.2.2"
}
or…
"devDependencies": {
"is-svg": ">=4.2.2"
}
Describe the bug
Dependabot alerts for a high severity vulnerability:
Dependabot cannot update is-svg to a non-vulnerable version
The latest possible version that can be installed is 3.0.0 because of the following conflicting dependency:
react-scripts@4.0.3requiresis-svg@^3.0.0via a transitive dependency onpostcss-svgo@4.0.2The earliest fixed version is
4.2.2.CVE-2021-28092
Suggested dependabot remediation
Upgrade is-svg to version 4.2.2 or later. For example:
or…