[Snyk] Security upgrade react-scripts from 3.4.4 to 5.0.0

[amplience-snyk]

Snyk has created this PR to fix 1 vulnerabilities in the yarn dependencies of this project.

Snyk changed the following file(s):

• packages/extension/package.json

Note for zero-installs users

If you are using the Yarn feature zero-installs that was introduced in Yarn V2, note that this PR does not update the .yarn/cache/ directory meaning this code cannot be pulled and immediately developed on as one would expect for a zero-install project - you will need to run yarn to update the contents of the ./yarn/cache directory.
If you are not using zero-install you can ignore this as your flow should likely be unchanged.

⚠️ Warning

Failed to update the yarn.lock, please update manually before merging.

Vulnerabilities that will be fixed with an upgrade:

	Issue	Score
	Inefficient Algorithmic Complexity SNYK-JS-SHELLQUOTE-17457810	710

Breaking Change Risk

Notice: This assessment is enhanced by AI.

---

Important

• Check the changes in this PR to ensure they won't cause issues with your project.
• Max score is 1000. Note that the real score may have changed since the PR was raised.
• This PR was automatically created by Snyk using the credentials of a real user.

---

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report
📜 Customise PR templates
🛠 Adjust project settings
📚 Read about Snyk's upgrade logic

---

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Learn about vulnerability in an interactive lesson of Snyk Learn.

[amplience-snyk]

This is a major upgrade from version 3 to 5, introducing significant breaking changes, most notably the upgrade to Webpack 5 which no longer provides automatic polyfills for Node.js core modules.

Key Breaking Changes:

• Webpack 5 Upgrade (High Impact): react-scripts@5.0.0 uses Webpack 5, which has removed automatic polyfills for Node.js built-in modules (e.g., crypto, buffer, stream). This is a common cause of build failures after upgrading, as many front-end dependencies transitively rely on these modules. Applications using such packages will fail to compile until the dependencies are replaced with browser-compatible alternatives or polyfills are manually configured.
• Tooling Upgrades: The upgrade path includes major bumps for key tooling, which may introduce new errors or require configuration changes:
  • ESLint: Upgraded to v7 and then v8, introducing new linting rules.
  • Jest: Upgraded to v26 and then v27, which could affect existing tests, particularly around mocking behavior.
  • PostCSS: Upgraded to v8.
• Node.js Version Support: Support for Node.js versions 8, 10, and 12 has been dropped. Your development and CI/CD environments must be using a supported Node.js version (14+).
• Configuration: The deprecated NODE_PATH flag for setting a base path has been removed in favor of using jsconfig.json.

Recommendation: This upgrade is high-risk due to the Webpack 5 changes. Before merging, developers must audit their project's dependencies for reliance on Node.js core modules. Be prepared to replace incompatible libraries or use a tool like craco or react-app-rewired to add the necessary polyfills. Also, expect to fix new ESLint errors and failing Jest tests.

Source: Create React App v5.0.0 Release Notes, Create React App v4.0.0 Release Notes

Notice 🤖: This content was augmented using artificial intelligence. AI-generated content may contain errors and should be reviewed for accuracy before use.

[amplience-snyk]

✅ Snyk checks have passed. No issues have been found so far.

Status	Scan Engine	Critical	High	Medium	Low	Total (0)
✅	Open Source Security	0	0	0	0	0 issues
✅	Licenses	0	0	0	0	0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

[orca-security-eu]

Orca Security Scan Summary

Status	Check	Issues by priority
Passed	Infrastructure as Code	0   0   0   0	View in Orca
Passed	SAST	0   0   0   0	View in Orca
Passed	Secrets	0   0   0   0	View in Orca
Passed	Vulnerabilities	0   0   0   0	View in Orca