NPM Audit Security report

[dsemenovsky]

Steps to reproduce the behavior:
Install react-images as a dependency

Expected behavior:
Expected to have npm audit passing.

Actual behavior:

                       === npm audit security report ===                        
                                                                                
                                                                                
                                 Manual Review                                  
             Some vulnerabilities require your attention to resolve             
                                                                                
          Visit https://go.npm.me/audit-guide for additional guidance           
                                                                                
                                                                                
  Low             Denial of Service                                             
                                                                                
  Package         node-fetch                                                    
                                                                                
  Patched in      >=2.6.1 <3.0.0-beta.1|| >= 3.0.0-beta.9                       
                                                                                
  Dependency of   react-images [dev]                                            
                                                                                
  Path            react-images > glam > fbjs > isomorphic-fetch > node-fetch    
                                                                                
  More info       https://npmjs.com/advisories/1556  

[davwheat]

Please read the README.

I'm thinking of creating my own version of this library, though.

⚠️ Warning!

Don't use this in a new project. This package hasn't been properly maintained in a long time and there are much better options available.

Instead, try...

• React Responsive Carousel

[davwheat]

@dsemenovsky Turns out this is a dev dependencies used for the docs. This does not affect the package itself.

[jossmac]

@davwheat

I'm thinking of creating my own version of this library, though.

If you end up doing this (I hope you do) try to render as little as possible for the consumer by employing hooks and render props. Once you take control of render the API becomes infinite.