create-react-app

Next.js 9.5 added opt-in support for Webpack 5: https://nextjs.org/blog/next-9-5 and looks like Create-React-App plans to support Webpack 5 in an upcoming CRA 4.1 release (4.0 is in alpha now): https://github.com/facebook/create-react-app/issues/9613#iss...

Thank you for your professionalism and humility. I too would like to apologise for not giving the full context and incorrectly suggesting that the vulnerability might actually affect apps created by CRA. I think that the real concern was not the non-existent security implications (although it's a bad habit to ignore even an overzealous audit checker), but that the release process for CRA seemed to make it very hard to cut new patch releases. Your comment suggests that it wasn't so hard after all, for which I am relieved and grateful, but the policy of expecting people to wait for (and deal with the backwards incompatibility of) major version updates[0] doesn't feel like an industry best practice. [0] https://github.com/facebook/create-react-app/issues/9033#iss...

To be clear, the vulnerability has no actual effect on CRA apps. The description says it’s for a DDOS attack which is completely irrelevant because CRA doesn’t use WDS for production environments. (It doesn’t even have a production web server.) While I agree that ideally a release should be cut to satisfy people affected by enterprise requirements, we are looking at a case of an overzealous audit checker, not an actual vulnerability that affects your apps. (Edit: I've cut a release though; see my response in https://github.com/facebook/create-react-app/issues/9033#iss...)

> the biggest challenge in the JavaScript community was how fast everything moved If you don't like things moving too fast, then React does seem to be the ideal ecosystem: https://github.com/facebook/create-react-app/issues/9033#iss... TL;DR A vulnerability was discovered in a transitive dependency of "create-react-app" and announced back in March, but the one line patch to update the hard-coded reference to the vulnerable version is being held back for a future major version upgrade of the "create-react-app" package. 5 months on and the issue is marked as Closed but the new version hasn't been released.

When you found the fetch API horrendous were you using async/await? They make it not horrendous. You don't have to keep up with which feature ships in which browser; that's what browserslist is for. https://github.com/facebook/create-react-app/blob/master/pac...

> Surprisingly, create-react-app just worked out of the box. create-react-app is the only thing I've used in the ecosystem that hasn't catastrophically broken for me due to some years-old issue. Except for monorepos/yarn workspaces, that still doesn't have first class support[0] [0] https://github.com/facebook/create-react-app/issues/1333

So the issue I'm referring to is this, which has been open since 2017 https://github.com/facebook/create-react-app/issues/2353 There's a slew of workarounds offered in that github issue, most people (including another team in my org) opted to just rebuild the app every time a docker container is created which kind of defeats one of the major pros of using docker IMO. I ultimately ended up forking off this repository and customizing it to my needs https://github.com/beam-australia/react-env that solution in itself is very hacky. as far as I know, vue doesn't have this feature either but I think next.js and nuxt.js does.

The Apps I've tried don't seem to work offline on iOS after saving to home screen. Does iOS support offline use of PWAs? (Or perhaps this is an issue with my phone... anyone able to reproduce, or find an App that does work offline?) Steps: Open App, enable airplane mode, go to iPhone home screen, open the App again, App is unresponsive. Apps I tried: https://progressiveapp.store/pwa/219 and https://progressiveapp.store/pwa/87 EDIT: Might be a bug: https://github.com/facebook/create-react-app/issues/8889

I have been following the progress of this project on Twitter for months. However I'm very skeptical to see this project used in a production app. Re-implementing the entire JS toolchain for a modern SPA is a HUGE task, just checkout CRA dependencies : https://github.com/facebook/create-react-app/blob/master/pac...

> It's not a thing that happens any more Except it literally happened again 2 years after the left-pad incident: https://status.npmjs.org/incidents/41zfb8qpvrdj https://github.com/facebook/create-react-app/issues/3701 https://github.com/angular/angular-cli/issues/9113 But anyway whether or not the module is un-published doesn't really matter. The module could also just become malicious. Ownership changes, quality of code changes, etc... If you're pinning with lockfiles you're basically back to copy/pasting or checking in a clone of an upstream repo - the maintenance burden shifts back to you at that point. You still then have to manually go update, and remember to do that, or you become just as easily obsolete as the copy/pasted snippet.

If you are looking to build a web application, create-react-app is a great way to get started if you're willing to learn React. It's an open source project from facebook. Here is the link the github: https://github.com/facebook/create-react-app. It's good quick start to building the front end of an application.

I would look into CRA (https://github.com/facebook/create-react-app). It handles all the Babel/Transpiling/Webpack mumbo-jumbo for you so you can focus on writing code. Although I would eventually recommend learning how to utilize Babel & Webpack yourself because knowing why and how it works is useful.