![Oracle Drags Its Feet in the JavaScript Trademark Dispute](https://cdn.sanity.io/images/cgdhsj6q/production/919c3b22c24f93884c548d60cbb338e819ff2435-1024x1024.webp?w=400&fit=max&auto=format)
Security News
Oracle Drags Its Feet in the JavaScript Trademark Dispute
Oracle seeks to dismiss fraud claims in the JavaScript trademark dispute, delaying the case and avoiding questions about its right to the name.
Security News
Sarah Gooding
February 11, 2025
TL;DR
React 19 introduced breaking changes that cause create-react-app to fail when setting up new projects. The primary issue is a peer dependency mismatch between the React Testing Library (@testing-library/react) and React 19. Here's how it happens:
“Starting with the release of React 19, users running create-react-app my-app began experiencing hard errors from npm during project setup.,” Redux maintainer Mark Erikson said, detailing in a recent GitHub issue how this causes “a perfect storm of incompatibility.”
A fix was proposed in PR #13738, which updates React Testing Library to a version that supports React 19. However, this is only a short-term fix—the bigger problem is that CRA is fundamentally outdated.
Despite being unmaintained for years, CRA is still one of the most commonly recommended tools for setting up a React project. This is largely because:
“As an educator in the space, CRA's lack of deprecation notices are a constant stumbling block for new developers and inexperienced React users,” Theo Browne commented. “It's an unnecessary harm to the entire ecosystem and it's SO easy to mitigate.
“I’m sorry guys. There's really no excuse. It's time to mark this project as deprecated.”
The people most likely to run into these problems are beginners. Someone just starting with React might follow an old tutorial, try to use CRA, and get stuck with dependency errors right away.
Since CRA is no longer actively maintained, the React team is taking official steps to deprecate it:
“The CRA CLI should be updated to print a loud and clear ‘CRA is deprecated, see the React docs 'Start a Project' page for alternatives’ message (but, ideally, not throw an error for now),” Erikson commented.
“As a longer-term step, it's worth seriously considering if the CRA repo should be archived until there's any decision or forward motion on future changes such as turning CRA into a "meta-launcher" for creating a project.”
Some users have suggested immediately marking CRA as deprecated on npm. However, React Core team member Rick Hanlon explained why that’s not happening yet:
“Deprecating an entire package on npm is basically deleting it,” Hanlon said. “We're not deleting Create React App yet.”
At the time of publishing, the package still gets 25K weekly downloads on npm.
The React team has been pushing for framework-based solutions like Next.js, Remix, and Gatsby for modern React projects. However, if you just want a simple SPA setup, the best alternative is Vite.
“Today, Vite is by far the best tool for creating a new basic React client SPA project,” Erikson said. “CRA projects can be straightforwardly migrated to Vite, Vite comes with basic React templates built into create-vite, and Vite also forms the basis for some React-based frameworks already.”
Vite is:
✅ Faster than CRA (hot reload is near-instant)
✅ Simpler to set up
✅ Maintained and actively developed
✅ Already the standard for modern React projects
Migrating from CRA to Vite is also relatively straightforward—guides and tools are available to help developers make the switch.
Create React App is officially being deprecated due to:
While a temporary fix is being applied to allow CRA to work with React 19, the React team is actively discouraging its use and recommending developers migrate to Vite or other modern alternatives.
If you're still using CRA, now is the time to move on.
✅ If you're starting a new project, use an alternative like Vite.
✅ If you're using CRA, start planning your migration—there are guides to help you move to Vite, Next.js, or other frameworks.
✅ If you have tutorials or documentation referencing CRA, update them to avoid misleading new developers.
For more details, check out the official discussion:
📌 GitHub Issue #17004
Subscribe to our newsletter
Get notified when we publish new security blog posts!
Try it now
Security News
Oracle seeks to dismiss fraud claims in the JavaScript trademark dispute, delaying the case and avoiding questions about its right to the name.
Security News
The Linux Foundation is warning open source developers that compliance with global sanctions is mandatory, highlighting legal risks and restrictions on contributions.
Security News
Maven Central now validates Sigstore signatures, making it easier for developers to verify the provenance of Java packages.