
Security News
Attackers Are Hunting High-Impact Node.js Maintainers in a Coordinated Social Engineering Campaign
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.
webpack-config-react
Advanced tools
A bare, modern Webpack 5 config to create a react app without create-react-app. Not battery included!
A bare, modern Webpack 5 config to create a react app without create-react-app. Not battery included!
Note: This package is only for those who are experienced with web bundling, transpilation (eg. @babel/preset-env), optimization, since it comes with no opinionated configuration out of the box. If you are a beginner, it's better to stick with create-react-app or use Next.js.
./public)npm i --save-dev webpack-config-react webpack webpack-cli webpack-dev-server
Add the following scripts to your package.json:
{
"scripts": {
"build": "webpack --mode=production",
"dev": "webpack serve"
}
}
To serve the built app, you can use sirv-cli:
{
"scripts": {
"start": "sirv build"
}
}
Create React App Deployment article also helps since this config also outputs file to build (by defaults).
Create webpack.config.js:
const { createConfig } = require("webpack-config-react");
module.exports = async (env, argv) => {
const webpackConfig = await createConfig(
argv.mode === "production" || env.production
);
return webpackConfig;
};
To extend webpack-config-react, we can use webpack-merge to merge additional configs into the return value of await createConfig().
npm i --save-dev webpack-merge
See examples for some usages.
Up next, depending on your preferences and requirements, we can either use babel or swc.
Install dependencies:
npm i --save-dev @babel/core @babel/preset-env @babel/preset-react babel-loader
Create babel.config.json (or other formats)
{
"presets": [
["@babel/preset-env"],
["@babel/preset-react", { "runtime": "automatic" }]
]
}
Install dependencies:
npm i --save-dev @swc/core swc-loader
Create .swcrc:
{
"jsc": {
"parser": {
"syntax": "ecmascript",
"jsx": true
},
"transform": {
"react": {
"runtime": "automatic"
}
}
}
}
Aiming to be simple, this does not include configs that are helpful to development. The following shows how to re-enable them.
module.exports = async (env, argv) => {
const isEnvProduction = argv.mode === "production" || env.production;
const webpackConfig = await createConfig(isEnvProduction);
return merge(webpackConfig, {
devtool: isEnvProduction ? "source-map" : "eval-source-map",
module: {
rules: [
{
test: /\.(js|mjs|jsx|ts|tsx|css)$/,
exclude: /@babel(?:\/|\\{1,2})runtime/,
enforce: "pre",
use: ["source-map-loader"],
},
],
},
});
};
An options param can passed as the second argument to createConfig.
createConfig(isEnvProduction, options);
moduleFileExtensions: A list of module file extension to resolve. Default: ["web.mjs","mjs","web.js","js","web.ts","ts","web.tsx","tsx","json","web.jsx","jsx"].pathEntry: Path to entry file. Default: ./src/index.js.pathSrc: Path to src directory (will be proccessed by babel-loader/swc-loader). Default: ./src.pathHtml: Path to HTML file. Default: ./public/index.html.pathBuild: Path to build output directory. Default: ./build.pathPublic: Path to "public" folder (will be copied to build directory). Default: ./public.FAQs
A bare, modern Webpack 5 config to create a react app without create-react-app. Not battery included!
The npm package webpack-config-react receives a total of 0 weekly downloads. As such, webpack-config-react popularity was classified as not popular.
We found that webpack-config-react demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.