Repository: create-react-app
Issue: vulnerabilities using npx create-react-app on npm v8.0.0
Labels: stale,needs triage,issue: bug report

<!--
    Please note that your issue will be fixed much faster if you spend about
    half an hour preparing it, including the exact reproduction steps and a demo.

    If you're in a hurry or don't feel confident, it's fine to report bugs with
    less details, but this makes it less likely they'll get fixed soon.

    In either case, please use this template and fill in as many fields below as you can.

    Note that we don't provide help for webpack questions after ejecting.
    You can find webpack docs at https://webpack.js.org/.
-->

### Describe the bug

58 vulnerabilities (16 moderate, 40 high, 2 critical)
and after npm audit fix -f ...
# npm audit report

ansi-html  *
Severity: high
Uncontrolled Resource Consumption in ansi-html - https://github.com/advisories/GHSA-whgm-jr23-g3j9
fix available via `npm audit fix --force`
Will install react-scripts@4.0.3, which is a breaking change
node_modules/ansi-html
  react-dev-utils  0.2.0 - 11.0.3
  Depends on vulnerable versions of ansi-html
  node_modules/react-dev-utils
    react-scripts  0.1.0 - 4.0.0-next.117
    Depends on vulnerable versions of eslint-plugin-import
    Depends on vulnerable versions of http-proxy-middleware
    Depends on vulnerable versions of jest
    Depends on vulnerable versions of react-dev-utils
    Depends on vulnerable versions of url-loader
    Depends on vulnerable versions of webpack
    Depends on vulnerable versions of webpack-dev-server
    node_modules/react-scripts

braces  <2.3.1
Regular Expression Denial of Service in braces - https://github.com/advisories/GHSA-g95f-p29q-9xw4
fix available via `npm audit fix --force`
Will install react-scripts@4.0.3, which is a breaking change
node_modules/braces
  micromatch  0.2.0 - 2.3.11
  Depends on vulnerable versions of braces
  Depends on vulnerable versions of parse-glob
  node_modules/micromatch
    anymatch  1.2.0 - 1.3.2
    Depends on vulnerable versions of micromatch
    node_modules/anymatch
      chokidar  1.0.0-rc1 - 2.1.8
      Depends on vulnerable versions of anymatch
      Depends on vulnerable versions of glob-parent
      node_modules/chokidar
        watchpack  0.2.2 - 1.6.1
        Depends on vulnerable versions of chokidar
        node_modules/watchpack
    http-proxy-middleware  0.3.0 - 0.17.4
    Depends on vulnerable versions of micromatch
    node_modules/http-proxy-middleware
      react-scripts  0.1.0 - 4.0.0-next.117
      Depends on vulnerable versions of eslint-plugin-import
      Depends on vulnerable versions of http-proxy-middleware
      Depends on vulnerable versions of jest
      Depends on vulnerable versions of react-dev-utils
      Depends on vulnerable versions of url-loader
      Depends on vulnerable versions of webpack
      Depends on vulnerable versions of webpack-dev-server
      node_modules/react-scripts
      webpack-dev-server  <=3.1.10
      Depends on vulnerable versions of http-proxy-middleware
      Depends on vulnerable versions of open
      Depends on vulnerable versions of optimist
      node_modules/webpack-dev-server
    jest-haste-map  16.1.0-alpha.691b0e22 - 24.0.0
    Depends on vulnerable versions of micromatch
    Depends on vulnerable versions of sane
    node_modules/jest-haste-map
      jest-cli  0.5.5 - 24.1.0
      Depends on vulnerable versions of jest-config
      Depends on vulnerable versions of jest-haste-map
      Depends on vulnerable versions of jest-resolve
      Depends on vulnerable versions of jest-runtime
      Depends on vulnerable versions of node-notifier
      Depends on vulnerable versions of sane
      Depends on vulnerable versions of yargs
      node_modules/jest-cli
        jest  13.3.0-alpha.4eb0c908 - 23.6.0
        Depends on vulnerable versions of jest-cli
        node_modules/jest
      jest-resolve  18.1.0 - 19.0.2
      Depends on vulnerable versions of jest-haste-map
      node_modules/jest-resolve
        jest-config  18.1.0 - 19.0.4
        Depends on vulnerable versions of jest-resolve
        node_modules/jest-config
        jest-resolve-dependencies  18.1.0
        Depends on vulnerable versions of jest-resolve
        node_modules/jest-resolve-dependencies
        jest-runtime  12.1.1-alpha.2935e14d - 24.0.0-alpha.16
        Depends on vulnerable versions of babel-jest
        Depends on vulnerable versions of babel-plugin-istanbul
        Depends on vulnerable versions of jest-haste-map
        Depends on vulnerable versions of jest-resolve
        Depends on vulnerable versions of micromatch
        Depends on vulnerable versions of yargs
        node_modules/jest-runtime
    test-exclude  <=4.2.3
    Depends on vulnerable versions of micromatch
    node_modules/test-exclude
      babel-plugin-istanbul  <=5.0.0
      Depends on vulnerable versions of test-exclude
      node_modules/babel-plugin-istanbul
        babel-jest  14.2.0-alpha.ca8bfb6e - 24.0.0-alpha.16
        Depends on vulnerable versions of babel-plugin-istanbul
        node_modules/babel-jest

color-string  <1.5.5
Severity: moderate
Regular Expression Denial of Service (ReDOS) - https://github.com/advisories/GHSA-257v-vj4p-3w2h
fix available via `npm audit fix`
node_modules/color-string
  color  <=0.11.4
  Depends on vulnerable versions of color-string
  node_modules/color
    colormin  *
    Depends on vulnerable versions of color
    node_modules/colormin
      postcss-colormin  <=2.2.2
      Depends on vulnerable versions of colormin
      node_modules/postcss-colormin
        cssnano  <=3.10.0
        Depends on vulnerable versions of postcss-colormin
        Depends on vulnerable versions of postcss-svgo
        node_modules/cssnano

debug  <2.6.9
Regular Expression Denial of Service in debug - https://github.com/advisories/GHSA-gxpj-cx7g-858c
fix available via `npm audit fix --force`
Will install react-scripts@4.0.3, which is a breaking change
node_modules/eslint-module-utils/node_modules/debug
  eslint-module-utils  1.0.0-beta.0 - 2.0.0
  Depends on vulnerable versions of debug
  node_modules/eslint-module-utils
    eslint-plugin-import  2.0.0-beta.0 - 2.1.0
    Depends on vulnerable versions of eslint-module-utils
    node_modules/eslint-plugin-import
      react-scripts  0.1.0 - 4.0.0-next.117
      Depends on vulnerable versions of eslint-plugin-import
      Depends on vulnerable versions of http-proxy-middleware
      Depends on vulnerable versions of jest
      Depends on vulnerable versions of react-dev-utils
      Depends on vulnerable versions of url-loader
      Depends on vulnerable versions of webpack
      Depends on vulnerable versions of webpack-dev-server
      node_modules/react-scripts

glob-parent  <5.1.2
Severity: high
Regular expression denial of service - https://github.com/advisories/GHSA-ww39-953v-wcq6
fix available via `npm audit fix --force`
Will install react-scripts@4.0.3, which is a breaking change
node_modules/glob-parent
  chokidar  1.0.0-rc1 - 2.1.8
  Depends on vulnerable versions of anymatch
  Depends on vulnerable versions of glob-parent
  node_modules/chokidar
    watchpack  0.2.2 - 1.6.1
    Depends on vulnerable versions of chokidar
    node_modules/watchpack
  glob-base  *
  Depends on vulnerable versions of glob-parent
  node_modules/glob-base
    parse-glob  >=2.1.0
    Depends on vulnerable versions of glob-base
    node_modules/parse-glob
      micromatch  0.2.0 - 2.3.11
      Depends on vulnerable versions of braces
      Depends on vulnerable versions of parse-glob
      node_modules/micromatch
        anymatch  1.2.0 - 1.3.2
        Depends on vulnerable versions of micromatch
        node_modules/anymatch
        http-proxy-middleware  0.3.0 - 0.17.4
        Depends on vulnerable versions of micromatch
        node_modules/http-proxy-middleware
          react-scripts  0.1.0 - 4.0.0-next.117
          Depends on vulnerable versions of eslint-plugin-import
          Depends on vulnerable versions of http-proxy-middleware
          Depends on vulnerable versions of jest
          Depends on vulnerable versions of react-dev-utils
          Depends on vulnerable versions of url-loader
          Depends on vulnerable versions of webpack
          Depends on vulnerable versions of webpack-dev-server
          node_modules/react-scripts
          webpack-dev-server  <=3.1.10
          Depends on vulnerable versions of http-proxy-middleware
          Depends on vulnerable versions of open
          Depends on vulnerable versions of optimist
          node_modules/webpack-dev-server
        jest-haste-map  16.1.0-alpha.691b0e22 - 24.0.0
        Depends on vulnerable versions of micromatch
        Depends on vulnerable versions of sane
        node_modules/jest-haste-map
          jest-cli  0.5.5 - 24.1.0
          Depends on vulnerable versions of jest-config
          Depends on vulnerable versions of jest-haste-map
          Depends on vulnerable versions of jest-resolve
          Depends on vulnerable versions of jest-runtime
          Depends on vulnerable versions of node-notifier
          Depends on vulnerable versions of sane
          Depends on vulnerable versions of yargs
          node_modules/jest-cli
            jest  13.3.0-alpha.4eb0c908 - 23.6.0
            Depends on vulnerable versions of jest-cli
            node_modules/jest
          jest-resolve  18.1.0 - 19.0.2
          Depends on vulnerable versions of jest-haste-map
          node_modules/jest-resolve
            jest-config  18.1.0 - 19.0.4
            Depends on vulnerable versions of jest-resolve
            node_modules/jest-config
            jest-resolve-dependencies  18.1.0
            Depends on vulnerable versions of jest-resolve
            node_modules/jest-resolve-dependencies
            jest-runtime  12.1.1-alpha.2935e14d - 24.0.0-alpha.16
            Depends on vulnerable versions of babel-jest
            Depends on vulnerable versions of babel-plugin-istanbul
            Depends on vulnerable versions of jest-haste-map
            Depends on vulnerable versions of jest-resolve
            Depends on vulnerable versions of micromatch
            Depends on vulnerable versions of yargs
            node_modules/jest-runtime
        test-exclude  <=4.2.3
        Depends on vulnerable versions of micromatch
        node_modules/test-exclude
          babel-plugin-istanbul  <=5.0.0
          Depends on vulnerable versions of test-exclude
          node_modules/babel-plugin-istanbul
            babel-jest  14.2.0-alpha.ca8bfb6e - 24.0.0-alpha.16
            Depends on vulnerable versions of babel-plugin-istanbul
            node_modules/babel-jest

is-svg  2.1.0 - 4.2.1
Severity: high
Regular Expression Denial of Service (ReDoS) - https://github.com/advisories/GHSA-7r28-3m3f-r2pr
fix available via `npm audit fix`
node_modules/is-svg

js-yaml  <=3.13.0
Severity: high
Denial of Service in js-yaml - https://github.com/advisories/GHSA-2pr6-76vf-7546
Code Injection in js-yaml - https://github.com/advisories/GHSA-8j8c-7jfh-h6hx
fix available via `npm audit fix`
node_modules/svgo/node_modules/js-yaml
  svgo  0.4.2 - 1.0.5
  Depends on vulnerable versions of js-yaml
  node_modules/svgo
    postcss-svgo  <=2.1.6
    Depends on vulnerable versions of svgo
    node_modules/postcss-svgo
      cssnano  <=3.10.0
      Depends on vulnerable versions of postcss-colormin
      Depends on vulnerable versions of postcss-svgo
      node_modules/cssnano

merge  <2.1.1
Severity: high
Prototype Pollution in merge - https://github.com/advisories/GHSA-7wpw-2hjm-89gp
fix available via `npm audit fix --force`
Will install react-scripts@4.0.3, which is a breaking change
node_modules/merge
  exec-sh  <=0.3.1
  Depends on vulnerable versions of merge
  node_modules/exec-sh
    sane  1.0.4 - 4.0.1
    Depends on vulnerable versions of exec-sh
    node_modules/sane
      jest-cli  0.5.5 - 24.1.0
      Depends on vulnerable versions of jest-config
      Depends on vulnerable versions of jest-haste-map
      Depends on vulnerable versions of jest-resolve
      Depends on vulnerable versions of jest-runtime
      Depends on vulnerable versions of node-notifier
      Depends on vulnerable versions of sane
      Depends on vulnerable versions of yargs
      node_modules/jest-cli
        jest  13.3.0-alpha.4eb0c908 - 23.6.0
        Depends on vulnerable versions of jest-cli
        node_modules/jest
          react-scripts  0.1.0 - 4.0.0-next.117
          Depends on vulnerable versions of eslint-plugin-import
          Depends on vulnerable versions of http-proxy-middleware
          Depends on vulnerable versions of jest
          Depends on vulnerable versions of react-dev-utils
          Depends on vulnerable versions of url-loader
          Depends on vulnerable versions of webpack
          Depends on vulnerable versions of webpack-dev-server
          node_modules/react-scripts
      jest-haste-map  16.1.0-alpha.691b0e22 - 24.0.0
      Depends on vulnerable versions of micromatch
      Depends on vulnerable versions of sane
      node_modules/jest-haste-map
        jest-resolve  18.1.0 - 19.0.2
        Depends on vulnerable versions of jest-haste-map
        node_modules/jest-resolve
          jest-config  18.1.0 - 19.0.4
          Depends on vulnerable versions of jest-resolve
          node_modules/jest-config
          jest-resolve-dependencies  18.1.0
          Depends on vulnerable versions of jest-resolve
          node_modules/jest-resolve-dependencies
          jest-runtime  12.1.1-alpha.2935e14d - 24.0.0-alpha.16
          Depends on vulnerable versions of babel-jest
          Depends on vulnerable versions of babel-plugin-istanbul
          Depends on vulnerable versions of jest-haste-map
          Depends on vulnerable versions of jest-resolve
          Depends on vulnerable versions of micromatch
          Depends on vulnerable versions of yargs
          node_modules/jest-runtime

mime  <1.4.1
Severity: moderate
Regular Expression Denial of Service in mime - https://github.com/advisories/GHSA-wrvr-8mpx-r7pp
fix available via `npm audit fix --force`
Will install react-scripts@4.0.3, which is a breaking change
node_modules/mime
  url-loader  0.5.5 - 0.5.9
  Depends on vulnerable versions of mime
  node_modules/url-loader
    react-scripts  0.1.0 - 4.0.0-next.117
    Depends on vulnerable versions of eslint-plugin-import
    Depends on vulnerable versions of http-proxy-middleware
    Depends on vulnerable versions of jest
    Depends on vulnerable versions of react-dev-utils
    Depends on vulnerable versions of url-loader
    Depends on vulnerable versions of webpack
    Depends on vulnerable versions of webpack-dev-server
    node_modules/react-scripts

minimist  <0.2.1
Severity: moderate
Prototype Pollution in minimist - https://github.com/advisories/GHSA-vh95-rmgr-6w4m
fix available via `npm audit fix --force`
Will install react-scripts@4.0.3, which is a breaking change
node_modules/optimist/node_modules/minimist
  optimist  >=0.6.0
  Depends on vulnerable versions of minimist
  node_modules/optimist
    webpack  0.11.0-beta1 - 2.0.2-beta
    Depends on vulnerable versions of optimist
    node_modules/webpack
      extract-text-webpack-plugin  <=1.0.1
      Depends on vulnerable versions of webpack
      node_modules/extract-text-webpack-plugin
      react-scripts  0.1.0 - 4.0.0-next.117
      Depends on vulnerable versions of eslint-plugin-import
      Depends on vulnerable versions of http-proxy-middleware
      Depends on vulnerable versions of jest
      Depends on vulnerable versions of react-dev-utils
      Depends on vulnerable versions of url-loader
      Depends on vulnerable versions of webpack
      Depends on vulnerable versions of webpack-dev-server
      node_modules/react-scripts
    webpack-dev-server  <=3.1.10
    Depends on vulnerable versions of http-proxy-middleware
    Depends on vulnerable versions of open
    Depends on vulnerable versions of optimist
    node_modules/webpack-dev-server

node-notifier  <8.0.1
Severity: moderate
OS Command Injection in node-notifier - https://github.com/advisories/GHSA-5fw9-fq32-wv5p
fix available via `npm audit fix --force`
Will install react-scripts@4.0.3, which is a breaking change
node_modules/node-notifier
  jest-cli  0.5.5 - 24.1.0
  Depends on vulnerable versions of jest-config
  Depends on vulnerable versions of jest-haste-map
  Depends on vulnerable versions of jest-resolve
  Depends on vulnerable versions of jest-runtime
  Depends on vulnerable versions of node-notifier
  Depends on vulnerable versions of sane
  Depends on vulnerable versions of yargs
  node_modules/jest-cli
    jest  13.3.0-alpha.4eb0c908 - 23.6.0
    Depends on vulnerable versions of jest-cli
    node_modules/jest
      react-scripts  0.1.0 - 4.0.0-next.117
      Depends on vulnerable versions of eslint-plugin-import
      Depends on vulnerable versions of http-proxy-middleware
      Depends on vulnerable versions of jest
      Depends on vulnerable versions of react-dev-utils
      Depends on vulnerable versions of url-loader
      Depends on vulnerable versions of webpack
      Depends on vulnerable versions of webpack-dev-server
      node_modules/react-scripts

open  <6.0.0
Severity: critical
Command Injection in open - https://github.com/advisories/GHSA-28xh-wpgr-7fm8
fix available via `npm audit fix --force`
Will install react-scripts@4.0.3, which is a breaking change
node_modules/open
  webpack-dev-server  <=3.1.10
  Depends on vulnerable versions of http-proxy-middleware
  Depends on vulnerable versions of open
  Depends on vulnerable versions of optimist
  node_modules/webpack-dev-server
    react-scripts  0.1.0 - 4.0.0-next.117
    Depends on vulnerable versions of eslint-plugin-import
    Depends on vulnerable versions of http-proxy-middleware
    Depends on vulnerable versions of jest
    Depends on vulnerable versions of react-dev-utils
    Depends on vulnerable versions of url-loader
    Depends on vulnerable versions of webpack
    Depends on vulnerable versions of webpack-dev-server
    node_modules/react-scripts

react-dev-utils  0.2.0 - 11.0.3
Severity: high
Improper Neutralization of Special Elements used in an OS Command. - https://github.com/advisories/GHSA-5q6m-3h65-w53x
Depends on vulnerable versions of ansi-html
fix available via `npm audit fix --force`
Will install react-scripts@4.0.3, which is a breaking change
node_modules/react-dev-utils
  react-scripts  0.1.0 - 4.0.0-next.117
  Depends on vulnerable versions of eslint-plugin-import
  Depends on vulnerable versions of http-proxy-middleware
  Depends on vulnerable versions of jest
  Depends on vulnerable versions of react-dev-utils
  Depends on vulnerable versions of url-loader
  Depends on vulnerable versions of webpack
  Depends on vulnerable versions of webpack-dev-server
  node_modules/react-scripts

webpack-dev-server  <=3.1.10
Severity: critical
Missing Origin Validation in webpack-dev-server - https://github.com/advisories/GHSA-cf66-xwfp-gvc4
Depends on vulnerable versions of http-proxy-middleware
Depends on vulnerable versions of open
Depends on vulnerable versions of optimist
fix available via `npm audit fix --force`
Will install react-scripts@4.0.3, which is a breaking change
node_modules/webpack-dev-server
  react-scripts  0.1.0 - 4.0.0-next.117
  Depends on vulnerable versions of eslint-plugin-import
  Depends on vulnerable versions of http-proxy-middleware
  Depends on vulnerable versions of jest
  Depends on vulnerable versions of react-dev-utils
  Depends on vulnerable versions of url-loader
  Depends on vulnerable versions of webpack
  Depends on vulnerable versions of webpack-dev-server
  node_modules/react-scripts

yargs-parser  <=5.0.0
Severity: moderate
Prototype Pollution in yargs-parser - https://github.com/advisories/GHSA-p9pc-299p-vxgp
fix available via `npm audit fix --force`
Will install react-scripts@4.0.3, which is a breaking change
node_modules/yargs-parser
  yargs  4.0.0-alpha1 - 7.0.0-alpha.3 || 7.1.1
  Depends on vulnerable versions of yargs-parser
  node_modules/yargs
    jest-cli  0.5.5 - 24.1.0
    Depends on vulnerable versions of jest-config
    Depends on vulnerable versions of jest-haste-map
    Depends on vulnerable versions of jest-resolve
    Depends on vulnerable versions of jest-runtime
    Depends on vulnerable versions of node-notifier
    Depends on vulnerable versions of sane
    Depends on vulnerable versions of yargs
    node_modules/jest-cli
      jest  13.3.0-alpha.4eb0c908 - 23.6.0
      Depends on vulnerable versions of jest-cli
      node_modules/jest
        react-scripts  0.1.0 - 4.0.0-next.117
        Depends on vulnerable versions of eslint-plugin-import
        Depends on vulnerable versions of http-proxy-middleware
        Depends on vulnerable versions of jest
        Depends on vulnerable versions of react-dev-utils
        Depends on vulnerable versions of url-loader
        Depends on vulnerable versions of webpack
        Depends on vulnerable versions of webpack-dev-server
        node_modules/react-scripts
    jest-runtime  12.1.1-alpha.2935e14d - 24.0.0-alpha.16
    Depends on vulnerable versions of babel-jest
    Depends on vulnerable versions of babel-plugin-istanbul
    Depends on vulnerable versions of jest-haste-map
    Depends on vulnerable versions of jest-resolve
    Depends on vulnerable versions of micromatch
    Depends on vulnerable versions of yargs
    node_modules/jest-runtime

48 vulnerabilities (12 low, 18 moderate, 16 high, 2 critical)

To address issues that do not require attention, run:
  npm audit fix

To address all issues (including breaking changes), run:
  npm audit fix --force
josselin@josselin-HP-Laptop-14-ck0xxx:~/dyma/react/testapp$ 



### Did you try recovering your dependencies?

<!--
  Your module tree might be corrupted, and that might be causing the issues.
  Let's try to recover it. First, delete these files and folders in your project:

    * node_modules
    * package-lock.json
    * yarn.lock

  Then you need to decide which package manager you prefer to use.
  We support both npm (https://npmjs.com) and yarn (https://yarnpkg.com/).
  However, **they can't be used together in one project** so you need to pick one.

  If you decided to use npm, run this in your project directory:

    npm install -g npm@latest
    npm install

  This should fix your project.

  If you decided to use yarn, update it first (https://yarnpkg.com/en/docs/install).
  Then run in your project directory:

    yarn

  This should fix your project.

  Importantly, **if you decided to use yarn, you should never run `npm install` in the project**.
  For example, yarn users should run `yarn add <library>` instead of `npm install <library>`.
  Otherwise your project will break again.

  Have you done all these steps and still see the issue?
  Please paste the output of `npm --version` and/or `yarn --version` to confirm.
-->

(Write your answer here.)

### Which terms did you search for in User Guide?

<!--
  There are a few common documented problems, such as watcher not detecting changes, or build failing.
  They are described in the Troubleshooting section of the User Guide:

  https://facebook.github.io/create-react-app/docs/troubleshooting

  Please scan these few sections for common problems.
  Additionally, you can search the User Guide itself for something you're having issues with:

  https://facebook.github.io/create-react-app/

  If you didn't find the solution, please share which words you searched for.
  This helps us improve documentation for future readers who might encounter the same problem.
-->

(Write your answer here if relevant.)

### Environment

<!--
  To help identify if a problem is specific to a platform, browser, or module version, information about your environment is required.
  This enables the maintainers quickly reproduce the issue and give feedback.

  Run the following command in your React app's folder in terminal.
  Note: The result is copied to your clipboard directly.

  `npx create-react-app --info`

  Paste the output of the command in the section below.
-->

(paste the output of the command here.)

### Steps to reproduce

<!--
  How would you describe your issue to someone who doesn’t know you or your project?
  Try to write a sequence of steps that anybody can repeat to see the issue.
-->

(Write your steps here:)

1.
2.
3.

### Expected behavior

<!--
  How did you expect the tool to behave?
  It’s fine if you’re not sure your understanding is correct.
  Just write down what you thought would happen.
-->

(Write what you thought would happen.)

### Actual behavior

<!--
  Did something go wrong?
  Is something broken, or not behaving as you expected?
  Please attach screenshots if possible! They are extremely helpful for diagnosing issues.
-->

(Write what happened. Please add screenshots!)

### Reproducible demo

<!--
  If you can, please share a project that reproduces the issue.
  This is the single most effective way to get an issue fixed soon.

  There are two ways to do it:

    * Create a new app and try to reproduce the issue in it.
      This is useful if you roughly know where the problem is, or can’t share the real code.

    * Or, copy your app and remove things until you’re left with the minimal reproducible demo.
      This is useful for finding the root cause. You may then optionally create a new project.

  This is a good guide to creating bug demos: https://stackoverflow.com/help/mcve
  Once you’re done, push the project to GitHub and paste the link to it below:
-->