From 651d0dba3f05e7e73e4baafc0741316c25b213a4 Mon Sep 17 00:00:00 2001
From: Joseph Atkins-Turkish <spacerat3004@gmail.com>
Date: Wed, 12 May 2021 09:26:22 -0700
Subject: [PATCH 01/11] eslint-config-react-app typo fix (#10317)

This just fixes a shell snippet in the readme file for this plugin
---
 packages/eslint-config-react-app/README.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/packages/eslint-config-react-app/README.md b/packages/eslint-config-react-app/README.md
index 700e92aa777..52c5c390880 100644
--- a/packages/eslint-config-react-app/README.md
+++ b/packages/eslint-config-react-app/README.md
@@ -39,7 +39,7 @@ This config also ships with optional Jest rules for ESLint (based on [`eslint-pl
 You'll first need to add the ESLint plugin for Jest (if you don't already have it installed).
 
 ```sh
-npm install --save-dev eslint-plugin-jest@^24.0.0 eslint-plugin-testing-library&^3.9.0
+npm install --save-dev eslint-plugin-jest@^24.0.0 eslint-plugin-testing-library@^3.9.0
 ```
 
 You can then enable these rules by adding the Jest config to the `extends` array in your ESLint config.

From b680ee7c7a81786fae9a7d3bbe81d12ba19fef3a Mon Sep 17 00:00:00 2001
From: e-w-h <46170930+e-w-h@users.noreply.github.com>
Date: Wed, 12 May 2021 12:30:25 -0400
Subject: [PATCH 02/11] Fix link address (#10907)

Replace the Github home link with a link to the repo's main page or a link to the source (https://github.com/CodeByZach/pace/blob/master/pace.js)
---
 docusaurus/docs/using-the-public-folder.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/docusaurus/docs/using-the-public-folder.md b/docusaurus/docs/using-the-public-folder.md
index 71266db6f81..a33c3a29ec8 100644
--- a/docusaurus/docs/using-the-public-folder.md
+++ b/docusaurus/docs/using-the-public-folder.md
@@ -60,7 +60,7 @@ The `public` folder is useful as a workaround for a number of less common cases:
 
 - You need a file with a specific name in the build output, such as [`manifest.webmanifest`](https://developer.mozilla.org/en-US/docs/Web/Manifest).
 - You have thousands of images and need to dynamically reference their paths.
-- You want to include a small script like [`pace.js`](https://github.hubspot.com/pace/docs/welcome/) outside of the bundled code.
+- You want to include a small script like [`pace.js`](https://github.com/CodeByZach/pace) outside of the bundled code.
 - Some libraries may be incompatible with webpack and you have no other option but to include it as a `<script>` tag.
 
 Note that if you add a `<script>` that declares global variables, you should read the topic [Using Global Variables](using-global-variables.md) in the next section which explains how to reference them.

From 281a868ab8df852a3984ba4a5b0dc972ce2e4acc Mon Sep 17 00:00:00 2001
From: Shamprasad RH <shamprasad.rh@mail.weir>
Date: Wed, 12 May 2021 22:03:28 +0530
Subject: [PATCH 03/11] Bump immer version for fixing security issue (#10791)

Bump immer minor version to fix `Prototype Pollution` Security issue.
---
 packages/react-dev-utils/package.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/packages/react-dev-utils/package.json b/packages/react-dev-utils/package.json
index b9cb6dcb93c..d2c4d330f61 100644
--- a/packages/react-dev-utils/package.json
+++ b/packages/react-dev-utils/package.json
@@ -65,7 +65,7 @@
     "global-modules": "2.0.0",
     "globby": "11.0.1",
     "gzip-size": "5.1.1",
-    "immer": "8.0.1",
+    "immer": "8.0.4",
     "is-root": "2.1.0",
     "loader-utils": "2.0.0",
     "open": "^7.0.2",

From 7bdeced8495370b683c08b86bc84b66af83f2f0a Mon Sep 17 00:00:00 2001
From: James George <jamesgeorge998001@gmail.com>
Date: Wed, 12 May 2021 23:38:17 +0530
Subject: [PATCH 04/11] test(create-react-app): add integration tests (#10381)

---
 .eslintrc.json                                |  3 +-
 .github/workflows/integration.yml             | 36 ++++++++
 package.json                                  |  1 +
 .../create-react-app/index.test.js            | 90 +++++++++++++++++++
 4 files changed, 129 insertions(+), 1 deletion(-)
 create mode 100644 .github/workflows/integration.yml
 create mode 100644 test/integration/create-react-app/index.test.js

diff --git a/.eslintrc.json b/.eslintrc.json
index b642bbc5c14..40029410cce 100644
--- a/.eslintrc.json
+++ b/.eslintrc.json
@@ -4,7 +4,8 @@
     "browser": true,
     "commonjs": true,
     "node": true,
-    "es6": true
+    "es6": true,
+    "jest": true
   },
   "parserOptions": {
     "ecmaVersion": 2018
diff --git a/.github/workflows/integration.yml b/.github/workflows/integration.yml
new file mode 100644
index 00000000000..1249f20532f
--- /dev/null
+++ b/.github/workflows/integration.yml
@@ -0,0 +1,36 @@
+name: Integration Tests
+
+on:
+  push:
+    branches:
+      - master
+  pull_request:
+    branches:
+      - master
+
+jobs:
+  job:
+    runs-on: ${{ matrix.os }}
+    strategy:
+      matrix:
+        os: ['ubuntu-latest', 'macos-latest', 'windows-latest']
+        node: ['10', '12', '14']
+    steps:
+      - uses: actions/checkout@v2
+      - name: Setup node
+        uses: actions/setup-node@v1
+        with:
+          node-version: ${{ matrix.node }}
+      - name: Cache dependencies
+        id: cache
+        uses: actions/cache@v2
+        with:
+          path: |
+            node_modules
+            */*/node_modules
+          key: ${{ runner.os }}-${{ hashFiles('**/yarn.lock', './yarn.lock') }}
+      - name: Install packages
+        if: steps.cache.outputs.cache-hit != 'true'
+        run: yarn --frozen-lockfile --prefer-offline
+      - name: Run integration tests
+        run: yarn test:integration
diff --git a/package.json b/package.json
index e7eaac5d085..a5c093bf32e 100644
--- a/package.json
+++ b/package.json
@@ -15,6 +15,7 @@
     "screencast": "node ./tasks/screencast.js",
     "screencast:error": "svg-term --cast jyu19xGl88FQ3poMY8Hbmfw8y --out screencast-error.svg --window --at 12000 --no-cursor",
     "alex": "alex .",
+    "test:integration": "jest test/integration",
     "test": "cd packages/react-scripts && node bin/react-scripts.js test",
     "format": "prettier --write 'packages/*/*.js' 'packages/*/!(node_modules)/**/*.js'",
     "compile:lockfile": "node tasks/compile-lockfile.js"
diff --git a/test/integration/create-react-app/index.test.js b/test/integration/create-react-app/index.test.js
new file mode 100644
index 00000000000..875fd8ca348
--- /dev/null
+++ b/test/integration/create-react-app/index.test.js
@@ -0,0 +1,90 @@
+'use strict';
+
+const execa = require('execa');
+const { mkdirp, remove, writeFileSync } = require('fs-extra');
+const { join } = require('path');
+
+const cli = require.resolve('create-react-app/index.js');
+
+jest.setTimeout(1000 * 60 * 5);
+
+const projectName = 'test-app';
+const genPath = join(__dirname, projectName);
+
+const generatedFiles = ['.gitignore', 'package.json', 'src', 'yarn.lock'];
+
+beforeEach(() => remove(genPath));
+afterAll(() => remove(genPath));
+
+const run = (args, options) => execa('node', [cli].concat(args), options);
+
+describe('create-react-app', () => {
+  it('asks to supply an argument if none supplied', async () => {
+    const { stderr } = await run([], { reject: false });
+    expect(stderr).toContain('Please specify the project directory');
+  });
+
+  it('creates a project on supplying a name as the argument', async () => {
+    await run([projectName], { cwd: __dirname });
+
+    // Assert for the generated files
+    generatedFiles.forEach(file => expect(join(genPath, file)).toBeTruthy());
+  });
+
+  it('warns about conflicting files in path', async () => {
+    // Create the temporary directory
+    await mkdirp(genPath);
+
+    // Create a package.json file
+    const pkgJson = join(genPath, 'package.json');
+    writeFileSync(pkgJson, '{ "foo": "bar" }');
+
+    const { stdout } = await run([projectName], {
+      cwd: __dirname,
+      reject: false,
+    });
+
+    // Assert for the expected message
+    expect(stdout).toContain(
+      `The directory ${projectName} contains files that could conflict`
+    );
+  });
+
+  it('creates a project in the current directory', async () => {
+    // Create temporary directory
+    await mkdirp(genPath);
+
+    // Create a project in the current directory
+    await run(['.'], { cwd: genPath });
+
+    // Assert for the generated files
+    generatedFiles.forEach(file => expect(join(genPath, file)).toBeTruthy());
+  });
+
+  it('uses npm as the package manager', async () => {
+    await run([projectName, '--use-npm'], {
+      cwd: __dirname,
+    });
+
+    // Assert for the generated files
+    const generatedFilesWithNpm = [
+      ...generatedFiles.filter(file => file !== 'yarn.lock'),
+      'package-lock.json',
+    ];
+
+    generatedFilesWithNpm.forEach(file =>
+      expect(join(genPath, file)).toBeTruthy()
+    );
+  });
+
+  it('creates a project based on the typescript template', async () => {
+    await run([projectName, '--template', 'typescript'], {
+      cwd: __dirname,
+    });
+
+    // Assert for the generated files
+    [...generatedFiles, 'tsconfig.json'].forEach(file =>
+      expect(join(genPath, file)).toBeTruthy()
+    );
+  });
+});

From b172b5ed5eb2951394bb03e54c98c4500bd1903e Mon Sep 17 00:00:00 2001
From: Jason Williams <936006+jasonwilliams@users.noreply.github.com>
Date: Sun, 30 May 2021 13:56:57 +0100
Subject: [PATCH 05/11] Add support for Webpack 5 message objects (#10121)

Co-authored-by: Brody McKee <mrmckeb@gmail.com>
---
 packages/react-dev-utils/formatWebpackMessages.js | 14 +++++++++++++-
 1 file changed, 13 insertions(+), 1 deletion(-)

diff --git a/packages/react-dev-utils/formatWebpackMessages.js b/packages/react-dev-utils/formatWebpackMessages.js
index 30e5614c27a..1d0f7c5cdae 100644
--- a/packages/react-dev-utils/formatWebpackMessages.js
+++ b/packages/react-dev-utils/formatWebpackMessages.js
@@ -15,7 +15,19 @@ function isLikelyASyntaxError(message) {
 
 // Cleans up webpack error messages.
 function formatMessage(message) {
-  let lines = message.split('\n');
+  let lines = [];
+
+  if (typeof message === 'string') {
+    lines = message.split('\n');
+  } else if ('message' in message) {
+    lines = message['message'].split('\n');
+  } else if (Array.isArray(message)) {
+    message.forEach(message => {
+      if ('message' in message) {
+        lines = message['message'].split('\n');
+      }
+    });
+  }
 
   // Strip webpack-added headers off errors/warnings
   // https://github.com/webpack/webpack/blob/master/lib/ModuleError.js

From 93241a061f9a0917604b6183cd38954da720e7b6 Mon Sep 17 00:00:00 2001
From: Mohamed Akram <mohd-akram@users.noreply.github.com>
Date: Sun, 30 May 2021 19:10:23 +0400
Subject: [PATCH 06/11] Unpin babel dependencies (#10797)

---
 packages/babel-preset-react-app/package.json | 30 ++++++++++----------
 packages/react-dev-utils/package.json        |  2 +-
 packages/react-error-overlay/package.json    |  6 ++--
 packages/react-scripts/package.json          |  4 +--
 4 files changed, 21 insertions(+), 21 deletions(-)

diff --git a/packages/babel-preset-react-app/package.json b/packages/babel-preset-react-app/package.json
index 986836e2a9a..cd2dd314ba3 100644
--- a/packages/babel-preset-react-app/package.json
+++ b/packages/babel-preset-react-app/package.json
@@ -21,20 +21,20 @@
     "test.js"
   ],
   "dependencies": {
-    "@babel/core": "7.12.3",
-    "@babel/plugin-proposal-class-properties": "7.12.1",
-    "@babel/plugin-proposal-decorators": "7.12.1",
-    "@babel/plugin-proposal-nullish-coalescing-operator": "7.12.1",
-    "@babel/plugin-proposal-numeric-separator": "7.12.1",
-    "@babel/plugin-proposal-optional-chaining": "7.12.1",
-    "@babel/plugin-transform-flow-strip-types": "7.12.1",
-    "@babel/plugin-transform-react-display-name": "7.12.1",
-    "@babel/plugin-transform-runtime": "7.12.1",
-    "@babel/preset-env": "7.12.1",
-    "@babel/preset-react": "7.12.1",
-    "@babel/preset-typescript": "7.12.1",
-    "@babel/runtime": "7.12.1",
-    "babel-plugin-macros": "2.8.0",
-    "babel-plugin-transform-react-remove-prop-types": "0.4.24"
+    "@babel/core": "^7.12.3",
+    "@babel/plugin-proposal-class-properties": "^7.12.1",
+    "@babel/plugin-proposal-decorators": "^7.12.1",
+    "@babel/plugin-proposal-nullish-coalescing-operator": "^7.12.1",
+    "@babel/plugin-proposal-numeric-separator": "^7.12.1",
+    "@babel/plugin-proposal-optional-chaining": "^7.12.1",
+    "@babel/plugin-transform-flow-strip-types": "^7.12.1",
+    "@babel/plugin-transform-react-display-name": "^7.12.1",
+    "@babel/plugin-transform-runtime": "^7.12.1",
+    "@babel/preset-env": "^7.12.1",
+    "@babel/preset-react": "^7.12.1",
+    "@babel/preset-typescript": "^7.12.1",
+    "@babel/runtime": "^7.12.1",
+    "babel-plugin-macros": "^2.8.0",
+    "babel-plugin-transform-react-remove-prop-types": "^0.4.24"
   }
 }
diff --git a/packages/react-dev-utils/package.json b/packages/react-dev-utils/package.json
index d2c4d330f61..4eb557d20d5 100644
--- a/packages/react-dev-utils/package.json
+++ b/packages/react-dev-utils/package.json
@@ -52,7 +52,7 @@
     "webpackHotDevClient.js"
   ],
   "dependencies": {
-    "@babel/code-frame": "7.10.4",
+    "@babel/code-frame": "^7.10.4",
     "address": "1.1.2",
     "browserslist": "4.14.2",
     "chalk": "2.4.2",
diff --git a/packages/react-error-overlay/package.json b/packages/react-error-overlay/package.json
index 137ceb7f266..50f547915f1 100644
--- a/packages/react-error-overlay/package.json
+++ b/packages/react-error-overlay/package.json
@@ -34,12 +34,12 @@
     "lib/index.js"
   ],
   "devDependencies": {
-    "@babel/code-frame": "7.10.4",
-    "@babel/core": "7.12.3",
+    "@babel/code-frame": "^7.10.4",
+    "@babel/core": "^7.12.3",
     "anser": "1.4.10",
     "babel-eslint": "^10.1.0",
     "babel-jest": "^26.6.0",
-    "babel-loader": "8.1.0",
+    "babel-loader": "^8.1.0",
     "babel-preset-react-app": "^10.0.0",
     "chalk": "2.4.2",
     "chokidar": "^3.4.3",
diff --git a/packages/react-scripts/package.json b/packages/react-scripts/package.json
index 29cfe9b8984..b630e887dbe 100644
--- a/packages/react-scripts/package.json
+++ b/packages/react-scripts/package.json
@@ -28,14 +28,14 @@
   },
   "types": "./lib/react-app.d.ts",
   "dependencies": {
-    "@babel/core": "7.12.3",
+    "@babel/core": "^7.12.3",
     "@pmmmwh/react-refresh-webpack-plugin": "0.4.3",
     "@svgr/webpack": "5.5.0",
     "@typescript-eslint/eslint-plugin": "^4.5.0",
     "@typescript-eslint/parser": "^4.5.0",
     "babel-eslint": "^10.1.0",
     "babel-jest": "^26.6.0",
-    "babel-loader": "8.1.0",
+    "babel-loader": "^8.1.0",
     "babel-plugin-named-asset-import": "^0.3.7",
     "babel-preset-react-app": "^10.0.0",
     "bfj": "^7.0.2",

From 04151891e9e05f82b635d66a1f03cb154929be8e Mon Sep 17 00:00:00 2001
From: Brody McKee <mrmckeb@users.noreply.github.com>
Date: Wed, 2 Jun 2021 20:08:32 +0300
Subject: [PATCH 07/11] Remove ESLint verification when opting-out (#10499)

---
 .../react-scripts/scripts/utils/verifyPackageTree.js     | 9 ++++++---
 1 file changed, 6 insertions(+), 3 deletions(-)

diff --git a/packages/react-scripts/scripts/utils/verifyPackageTree.js b/packages/react-scripts/scripts/utils/verifyPackageTree.js
index 210043ff7c4..d23d8c54265 100644
--- a/packages/react-scripts/scripts/utils/verifyPackageTree.js
+++ b/packages/react-scripts/scripts/utils/verifyPackageTree.js
@@ -13,6 +13,8 @@ const fs = require('fs');
 const semver = require('semver');
 const path = require('path');
 
+const isESLintPluginEnabled = process.env.DISABLE_ESLINT_PLUGIN !== 'true';
+
 // We assume that having wrong versions of these
 // in the tree will likely break your setup.
 // This is a relatively low-effort way to find common issues.
@@ -21,14 +23,15 @@ function verifyPackageTree() {
     // These are packages most likely to break in practice.
     // See https://github.com/facebook/create-react-app/issues/1795 for reasons why.
     // I have not included Babel here because plugins typically don't import Babel (so it's not affected).
-    'babel-eslint',
     'babel-jest',
     'babel-loader',
-    'eslint',
     'jest',
     'webpack',
     'webpack-dev-server',
-  ];
+    isESLintPluginEnabled && 'babel-eslint',
+    isESLintPluginEnabled && 'eslint',
+  ].filter(Boolean);
+
   // Inlined from semver-regex, MIT license.
   // Don't want to make this a dependency after ejecting.
   const getSemverRegex = () =>

From 382ba21052ffd1321f3e7bb1dcb70d442106dff1 Mon Sep 17 00:00:00 2001
From: Justin Grant <justingrant@users.noreply.github.com>
Date: Wed, 2 Jun 2021 10:11:45 -0700
Subject: [PATCH 08/11] Add source-map-loader for debugging into original
 source of node_modules libraries that contain sourcemaps (#8227)

---
 .../react-scripts/config/webpack.config.js     |  9 ++++++++-
 packages/react-scripts/package.json            |  1 +
 packages/react-scripts/scripts/build.js        | 18 +++++++++++-------
 3 files changed, 20 insertions(+), 8 deletions(-)

diff --git a/packages/react-scripts/config/webpack.config.js b/packages/react-scripts/config/webpack.config.js
index 5e5f87f3ce9..c0f66cb1bd4 100644
--- a/packages/react-scripts/config/webpack.config.js
+++ b/packages/react-scripts/config/webpack.config.js
@@ -374,6 +374,13 @@ module.exports = function (webpackEnv) {
       rules: [
         // Disable require.ensure as it's not a standard language feature.
         { parser: { requireEnsure: false } },
+        // Handle node_modules packages that contain sourcemaps
+        shouldUseSourceMap && {
+          enforce: 'pre',
+          exclude: /@babel(?:\/|\\{1,2})runtime/,
+          test: /\.(js|mjs|jsx|ts|tsx|css)$/,
+          use: 'source-map-loader',
+        },
         {
           // "oneOf" will traverse all following loaders until one will
           // match the requirements. When no loader matches it will fall
@@ -605,7 +612,7 @@ module.exports = function (webpackEnv) {
             // Make sure to add the new loader(s) before the "file" loader.
           ],
         },
-      ],
+      ].filter(Boolean),
     },
     plugins: [
       // Generates an `index.html` file with the <script> injected.
diff --git a/packages/react-scripts/package.json b/packages/react-scripts/package.json
index b630e887dbe..5b8235edca1 100644
--- a/packages/react-scripts/package.json
+++ b/packages/react-scripts/package.json
@@ -79,6 +79,7 @@
     "resolve-url-loader": "^3.1.2",
     "sass-loader": "^10.0.5",
     "semver": "7.3.2",
+    "source-map-loader": "^1.1.2",
     "style-loader": "1.3.0",
     "terser-webpack-plugin": "4.2.3",
     "ts-pnp": "1.2.0",
diff --git a/packages/react-scripts/scripts/build.js b/packages/react-scripts/scripts/build.js
index de2ff505eb3..b8190449328 100644
--- a/packages/react-scripts/scripts/build.js
+++ b/packages/react-scripts/scripts/build.js
@@ -193,13 +193,17 @@ function build(previousFileSizes) {
           process.env.CI.toLowerCase() !== 'false') &&
         messages.warnings.length
       ) {
-        console.log(
-          chalk.yellow(
-            '\nTreating warnings as errors because process.env.CI = true.\n' +
-              'Most CI servers set it automatically.\n'
-          )
-        );
-        return reject(new Error(messages.warnings.join('\n\n')));
+        // Ignore sourcemap warnings in CI builds. See #8227 for more info.
+        const filteredWarnings = messages.warnings.filter(w => !/Failed to parse source map/.test(w));
+        if (filteredWarnings.length) {
+          console.log(
+            chalk.yellow(
+              '\nTreating warnings as errors because process.env.CI = true.\n' +
+                'Most CI servers set it automatically.\n'
+            )
+          );
+          return reject(new Error(filteredWarnings.join('\n\n')));
+        }
       }
 
       const resolveArgs = {

From 0ee4765c39f820e5f4820abf4bf2e47b3324da7f Mon Sep 17 00:00:00 2001
From: Brody McKee <mrmckeb@users.noreply.github.com>
Date: Tue, 8 Jun 2021 08:38:49 +0300
Subject: [PATCH 09/11] Coerce Node versions with metadata (#11057)

---
 packages/create-react-app/createReactApp.js | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/packages/create-react-app/createReactApp.js b/packages/create-react-app/createReactApp.js
index f8b7443987d..51df265120b 100755
--- a/packages/create-react-app/createReactApp.js
+++ b/packages/create-react-app/createReactApp.js
@@ -236,7 +236,12 @@ function init() {
 }
 
 function createApp(name, verbose, version, template, useNpm, usePnp) {
-  const unsupportedNodeVersion = !semver.satisfies(process.version, '>=10');
+  const unsupportedNodeVersion = !semver.satisfies(
+    // Coerce strings with metadata (i.e. `15.0.0-nightly`).
+    semver.coerce(process.version),
+    '>=10'
+  );
+
   if (unsupportedNodeVersion) {
     console.log(
       chalk.yellow(

From 64df135c29208f08a175c941a0e94d9a56d9e4af Mon Sep 17 00:00:00 2001
From: Brody McKee <mrmckeb@users.noreply.github.com>
Date: Tue, 22 Jun 2021 16:01:49 +0300
Subject: [PATCH 10/11] Update PostCSS version (#11121)

---
 packages/react-scripts/package.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/packages/react-scripts/package.json b/packages/react-scripts/package.json
index 5b8235edca1..e243728cafa 100644
--- a/packages/react-scripts/package.json
+++ b/packages/react-scripts/package.json
@@ -65,7 +65,7 @@
     "mini-css-extract-plugin": "0.11.3",
     "optimize-css-assets-webpack-plugin": "5.0.4",
     "pnp-webpack-plugin": "1.6.4",
-    "postcss": "8.2.4",
+    "postcss": "8.3.5",
     "postcss-flexbugs-fixes": "5.0.2",
     "postcss-loader": "4.2.0",
     "postcss-normalize": "9.0.0",

From 78d86f62759cbcfefc0714236b63a96be12de321 Mon Sep 17 00:00:00 2001
From: Dan Abramov <dan.abramov@gmail.com>
Date: Sun, 4 Jul 2021 20:43:24 +0100
Subject: [PATCH 11/11] Run npm with --no-audit (#11176)

---
 packages/create-react-app/createReactApp.js | 1 +
 packages/react-scripts/scripts/init.js      | 7 ++++++-
 2 files changed, 7 insertions(+), 1 deletion(-)

diff --git a/packages/create-react-app/createReactApp.js b/packages/create-react-app/createReactApp.js
index 51df265120b..bee58806d95 100755
--- a/packages/create-react-app/createReactApp.js
+++ b/packages/create-react-app/createReactApp.js
@@ -392,6 +392,7 @@ function install(root, useYarn, usePnp, dependencies, verbose, isOnline) {
       command = 'npm';
       args = [
         'install',
+        '--no-audit', // https://github.com/facebook/create-react-app/issues/11174
         '--save',
         '--save-exact',
         '--loglevel',
diff --git a/packages/react-scripts/scripts/init.js b/packages/react-scripts/scripts/init.js
index 7b9958e8148..2292368e9bb 100644
--- a/packages/react-scripts/scripts/init.js
+++ b/packages/react-scripts/scripts/init.js
@@ -297,7 +297,12 @@ module.exports = function (
   } else {
     command = 'npm';
     remove = 'uninstall';
-    args = ['install', '--save', verbose && '--verbose'].filter(e => e);
+    args = [
+      'install',
+      '--no-audit', // https://github.com/facebook/create-react-app/issues/11174
+      '--save',
+      verbose && '--verbose',
+    ].filter(e => e);
   }
 
   // Install additional template dependencies, if present.