Hacker News Reader

A comment above said CRA is unmaintained and there were unfixed vulnerabilities. Is that not the case?

Last I checked the "unfixed vulnerabilities" where regex Denial Of Service at build time, see https://github.com/facebook/create-react-app/issues/11174

CRA is no longer recommended. Official recs are Next, Remix, and Gatsby.