# Contributor handoff — react/create-react-app

> Canonical page: https://codevetter.com/unpack/create-react-app/agent-handoff

# Contributor handoff — react/create-react-app

Scanned commit 6254386531d263688ccfa542d0e628fbc0de0b28 (2025-02-14). Generated by codevetter codevetter 1.12.0 on 2026-09-22.

Edit the package that owns the behavior, not the docs site, unless the task is documentation. The CLI is packages/create-react-app; compiler behavior is packages/react-scripts/config and scripts; shared helpers are packages/react-dev-utils. Keep Node >=14 assumptions. Do not add a webpack-override API. Verify with the package's Jest tests first, then tasks/e2e-simple.sh for scaffold or config changes. Avoid npm install at the repo root unless the user asked — Yarn workspaces and tasks/build.js are the intended install/pack path. Generated template files are copied verbatim, so a template bug ships to every new app.
- Read order for any behavior change: packages/react-scripts/bin/react-scripts.js, the relevant scripts/*.js, config/paths.js, config/env.js, config/webpack.config.js, then the matching helper in packages/react-dev-utils. For scaffold bugs read createReactApp.js then scripts/init.js. — [packages/react-scripts/bin/react-scripts.js#L1-40](https://github.com/react/create-react-app/blob/6254386531d263688ccfa542d0e628fbc0de0b28/packages/react-scripts/bin/react-scripts.js#L1-L40) [packages/react-scripts/scripts/init.js#L1-40](https://github.com/react/create-react-app/blob/6254386531d263688ccfa542d0e628fbc0de0b28/packages/react-scripts/scripts/init.js#L1-L40) [packages/create-react-app/createReactApp.js#L1-40](https://github.com/react/create-react-app/blob/6254386531d263688ccfa542d0e628fbc0de0b28/packages/create-react-app/createReactApp.js#L1-L40)
- CONTRIBUTING.md is the contributor contract: issues and PRs, how to run tests, and the expectation that changes stay focused. README.md states the user-facing quick start (npx create-react-app my-app) and points documentation at create-react-app.dev. Prefer updating both the code and the matching docusaurus/docs page when behavior changes. — [CONTRIBUTING.md#L1-50](https://github.com/react/create-react-app/blob/6254386531d263688ccfa542d0e628fbc0de0b28/CONTRIBUTING.md#L1-L50) [README.md#L1-50](https://github.com/react/create-react-app/blob/6254386531d263688ccfa542d0e628fbc0de0b28/README.md#L1-L50)
- Safe, low-blast edits: a single fixture under test/fixtures, a doc page, template copy in packages/cra-template/template (remember the TS twin), or a unit test in __tests__. High-blast edits: webpack.config.js, env.js, createJestConfig.js, eslint-config-react-app/index.js, init.js merge logic, and package.json dependency bumps in react-scripts. — [packages/react-scripts/config/webpack.config.js#L1-40](https://github.com/react/create-react-app/blob/6254386531d263688ccfa542d0e628fbc0de0b28/packages/react-scripts/config/webpack.config.js#L1-L40) [packages/eslint-config-react-app/index.js#L1-30](https://github.com/react/create-react-app/blob/6254386531d263688ccfa542d0e628fbc0de0b28/packages/eslint-config-react-app/index.js#L1-L30) [packages/cra-template/template.json#L1-20](https://github.com/react/create-react-app/blob/6254386531d263688ccfa542d0e628fbc0de0b28/packages/cra-template/template.json#L1-L20)
- Template edits must be applied to both packages/cra-template and packages/cra-template-typescript when the change is not JS-only. template.json dependency versions should stay aligned (react-scripts version field, testing-library, web-vitals). Forgetting the TS template is a known footgun. — [packages/cra-template/template.json#L1-40](https://github.com/react/create-react-app/blob/6254386531d263688ccfa542d0e628fbc0de0b28/packages/cra-template/template.json#L1-L40) [packages/cra-template-typescript/template.json#L1-45](https://github.com/react/create-react-app/blob/6254386531d263688ccfa542d0e628fbc0de0b28/packages/cra-template-typescript/template.json#L1-L45)
- Tests to run: for react-dev-utils, npm test inside that package. For CLI parsing, npm test inside packages/create-react-app. For scaffold or webpack behavior, yarn test (tasks/e2e-simple.sh) from the root after tasks/build.js has packed local tarballs. Full matrix is yarn e2e. ESLint via yarn eslint. Prettier via the format script; do not reformat unrelated files. — [package.json#L40-80](https://github.com/react/create-react-app/blob/6254386531d263688ccfa542d0e628fbc0de0b28/package.json#L40-L80) [packages/create-react-app/package.json#L1-25](https://github.com/react/create-react-app/blob/6254386531d263688ccfa542d0e628fbc0de0b28/packages/create-react-app/package.json#L1-L25) [packages/react-dev-utils/package.json#L1-25](https://github.com/react/create-react-app/blob/6254386531d263688ccfa542d0e628fbc0de0b28/packages/react-dev-utils/package.json#L1-L25)
- Node version gate is duplicated: create-react-app/index.js semver check and root package.json engines.node >=14. CI Node version must satisfy both. Do not use newer Node-only APIs (e.g. native fetch assumptions, import assertions) without updating the engines field and the runtime check. — [packages/create-react-app/index.js#L20-50](https://github.com/react/create-react-app/blob/6254386531d263688ccfa542d0e628fbc0de0b28/packages/create-react-app/index.js#L20-L50) [package.json#L1-30](https://github.com/react/create-react-app/blob/6254386531d263688ccfa542d0e628fbc0de0b28/package.json#L1-L30)
- Do not hand-edit Yarn/npm lockfiles except as the result of an install the user requested. Do not bump webpack, Jest, or Babel majors casually: the e2e fixtures and babel-preset-react-app are tightly coupled to Jest 27 and Babel 7 APIs. Lerna version in lerna.json must stay consistent with published package versions. — [lerna.json#L1-15](https://github.com/react/create-react-app/blob/6254386531d263688ccfa542d0e628fbc0de0b28/lerna.json#L1-L15) [packages/react-scripts/package.json#L30-90](https://github.com/react/create-react-app/blob/6254386531d263688ccfa542d0e628fbc0de0b28/packages/react-scripts/package.json#L30-L90) [packages/babel-preset-react-app/package.json#L1-30](https://github.com/react/create-react-app/blob/6254386531d263688ccfa542d0e628fbc0de0b28/packages/babel-preset-react-app/package.json#L1-L30)
- Trap: PUBLIC_URL vs homepage vs paths.publicUrlOrPath. Changing one without reading paths.js and InterpolateHtmlPlugin and the build.js hosting instructions will break asset URLs for apps hosted on a subpath. Trap: .env.local is ignored when NODE_ENV=test, so a test that depends on a local secret-looking var will pass locally in start and fail in Jest. — [packages/react-scripts/config/paths.js#L90-150](https://github.com/react/create-react-app/blob/6254386531d263688ccfa542d0e628fbc0de0b28/packages/react-scripts/config/paths.js#L90-L150) [packages/react-scripts/config/env.js#L30-90](https://github.com/react/create-react-app/blob/6254386531d263688ccfa542d0e628fbc0de0b28/packages/react-scripts/config/env.js#L30-L90) [packages/react-scripts/scripts/build.js#L180-240](https://github.com/react/create-react-app/blob/6254386531d263688ccfa542d0e628fbc0de0b28/packages/react-scripts/scripts/build.js#L180-L240)
- Trap: DISABLE_ESLINT_PLUGIN, ESLINT_NO_DEV_ERRORS, TSC_COMPILE_ON_ERROR, and DISABLE_NEW_JSX_TRANSFORM are user escape hatches. A change that ignores them will break apps that opted out. Search for process.env consumers before refactoring start.js or webpack.config.js. — [packages/react-scripts/config/webpack.config.js#L150-250](https://github.com/react/create-react-app/blob/6254386531d263688ccfa542d0e628fbc0de0b28/packages/react-scripts/config/webpack.config.js#L150-L250) [packages/react-scripts/scripts/start.js#L100-180](https://github.com/react/create-react-app/blob/6254386531d263688ccfa542d0e628fbc0de0b28/packages/react-scripts/scripts/start.js#L100-L180)
- Trap: init.js merge is a shallow Object.assign of dependency maps. A template that needs to remove a default dependency cannot do it by omission if the CLI preinstalls react-scripts. Read the install list in createReactApp.js and the merge in init.js together before changing the default dependency set. — [packages/create-react-app/createReactApp.js#L400-550](https://github.com/react/create-react-app/blob/6254386531d263688ccfa542d0e628fbc0de0b28/packages/create-react-app/createReactApp.js#L400-L550) [packages/react-scripts/scripts/init.js#L100-180](https://github.com/react/create-react-app/blob/6254386531d263688ccfa542d0e628fbc0de0b28/packages/react-scripts/scripts/init.js#L100-L180)
- Coding style: Prettier is configured in .prettierrc and ESLint in .eslintrc.json. Existing files use CommonJS require, not ESM. react-error-overlay still has a build step — editing its src without running its build script leaves stale published assets. Flow annotations, if touched, should not be spread into CommonJS packages that do not run Flow. — [.prettierrc#L1-20](https://github.com/react/create-react-app/blob/6254386531d263688ccfa542d0e628fbc0de0b28/.prettierrc#L1-L20) [.eslintrc.json#L1-30](https://github.com/react/create-react-app/blob/6254386531d263688ccfa542d0e628fbc0de0b28/.eslintrc.json#L1-L30) [packages/react-error-overlay/package.json#L1-35](https://github.com/react/create-react-app/blob/6254386531d263688ccfa542d0e628fbc0de0b28/packages/react-error-overlay/package.json#L1-L35)
- The repo is the upstream of a widely installed generator (create-react-app 5.1.0, react-scripts consumers in the millions historically). Prefer bug-fix diffs over API additions. Any new env var needs a docusaurus advanced-configuration entry or users will not find it. Do not deploy the docs site from a feature branch; Netlify publishes the configured site build. — [packages/create-react-app/package.json#L1-20](https://github.com/react/create-react-app/blob/6254386531d263688ccfa542d0e628fbc0de0b28/packages/create-react-app/package.json#L1-L20) [docusaurus/docs/advanced-configuration.md#L1-20](https://github.com/react/create-react-app/blob/6254386531d263688ccfa542d0e628fbc0de0b28/docusaurus/docs/advanced-configuration.md#L1-L20) [netlify.toml#L1-20](https://github.com/react/create-react-app/blob/6254386531d263688ccfa542d0e628fbc0de0b28/netlify.toml#L1-L20)

Every claim links to its cited files at the pinned commit. Citations identify source evidence; they do not establish runtime correctness. Independent CodeVetter scan — not reviewed by upstream maintainers.

## Public product links

- [CodeVetter](https://codevetter.com/)
- [Download](https://codevetter.com/download)
- [Documentation](https://codevetter.com/docs/)
- [Source](https://github.com/Codevetter/codevetter)