make @babel, browserslist versions ^

Created by: dulmandakh

Babel, and browserlist are well maintained open source project, thus propose to make versions less explicit or use ^ so that developers have less duplication.

requested review from @root

requested review from @root

requested review from @root

requested review from @root

added CLA Signed label

mentioned in issue #10928

Created by: gregmarr

@iansu @mrmckeb @ianschmitz @petetnt The current dependencies include a pinned version that has a security vulnerability. Can this please be reviewed so that we can resolve this issue?

mentioned in issue #11012 (closed)

Created by: stale[bot]

This pull request has been automatically marked as stale because it has not had any recent activity. It will be closed in 5 days if no further activity occurs.

added stale label

Created by: gregmarr

Not stale

removed stale label

Created by: mlegait

Any news about this?

Created by: Hypnosphi

@mlegait if you're asking it because of npm audit, please read this: http://metis.lti.cs.cmu.edu:8023/facebook/create-react-app/-/issues/11174

Created by: mlegait

@Hypnosphi I was asking because of OWASP dependency-check, but it's clearly the same as npm audit.

Thank you for your answer. But I'm still curious, why block the version number? Why not add a ^?

Created by: Hypnosphi

@mlegait here's some explanation: http://metis.lti.cs.cmu.edu:8023/facebook/create-react-app/-/issues/11174#issuecomment-873432520

Created by: dulmandakh

My motivation is to reduce duplicate dependencies in my projects with slight patch version difference.

Created by: dulmandakh

@gaearon please review and merge

Created by: stale[bot]

This pull request has been automatically marked as stale because it has not had any recent activity. It will be closed in 5 days if no further activity occurs.

added stale label