react/create-react-app
Set up a modern web app by running one command.
How create-react-app is put together
Create React App is a deprecated but widely-used monorepo of npm packages that bootstraps single-page React applications with zero build configuration. It is a JavaScript/Node.js Lerna/npm-workspaces monorepo whose core package, react-scripts, wires together webpack, Babel, ESLint, Jest, and a webpack-dev-server into a curated dev/build/test experience. The create-react-app CLI package scaffolds new projects from cra-template and cra-template-typescript templates. Supporting packages provide the Babel preset (babel-preset-react-app), asset-import transforms (babel-plugin-named-asset-import), shared ESLint config (eslint-config-react-app), browser polyfills (react-app-polyfill), dev-server utilities (react-dev-utils), an in-browser error overlay (react-error-overlay), and a list of confusing browser globals (confusing-browser-globals). Data flow: user runs npx create-react-app -> template files are copied and dependencies installed -> react-scripts start/build/test executes the preconfigured webpack/Babel/Jest pipeline against the generated project.
Languages
Frameworks
Infrastructure
Major components
create-react-app (packages/create-react-app)
CLI initializer that validates arguments, copies a template, and installs dependencies to scaffold a new React app.
react-scripts (packages/react-scripts)
The core build tool exposing start/build/test/eject commands via bin/react-scripts.js, with webpack config under config/.
babel-preset-react-app
Shared Babel preset configuring JSX, TypeScript, Flow stripping, class properties, decorators, optional chaining, and runtime helpers per environment (dev/prod/test).
babel-plugin-named-asset-import
Babel plugin that rewrites named imports/exports of assets (e.g., SVG ReactComponent) to loader-specific module paths like @svgr/webpack.
react-dev-utils
Collection of dev-server and build utilities: webpack plugins (ForkTsChecker, InlineChunkHtml, ModuleScope), middleware (errorOverlayMiddleware, redirectServedPathMiddleware), launchEditor, openBrowser, and formatWebpackMessages.
react-error-overlay
Standalone iframe-based runtime/compile error overlay with components for stack frames, code blocks, and console proxying; built with its own webpack config.
cra-template / cra-template-typescript
Project templates (public/, src/, template.json) copied verbatim into newly created apps, one plain JS and one TypeScript variant.
eslint-config-react-app & confusing-browser-globals
Shared ESLint configuration (base.js, jest.js) plus a list of browser globals commonly shadowed by mistake, used to enforce lint rules in generated apps.
No digest this week
1 weeksWeek of
Dependencies and code review
Dependency advisories
Security Watch
No known advisories across 23 scanned dependencies.
No known advisories in the scanned dependencies.
Code review
GET /__open-stack-frame-in-editor handled by packages/react-dev-utils/errorOverlayMiddleware.js, mounted by the webpack dev server configured in packages/react-scripts/config/webpackDevServer.config.js
An attacker on the network or a malicious webpage can make the developer's editor open arbitrary local files, disclosing their contents inside the trusted editor session and enabling targeted follow-up attacks against the developer machine.
Fix: Bind the dev server to 127.0.0.1 by default instead of 0.0.0.0, and add an Origin plus Host allowlist check at the top of launchEditorMiddleware that rejects requests whose Host is not the local development host before calling launchEditor().
Get this report every week for your repos.
GitZoid learns each repo, reports what changed, and flags what needs attention. One flat price for the whole team.
$19 a month, flat · First 10 outputs free · No card required