[Snyk] Security upgrade immer from 8.0.1 to 9.0.6

[snyk-bot]

Snyk has created this PR to fix one or more vulnerable packages in the `npm` dependencies of this project.

Changes included in this PR

• Changes to the following files to upgrade the vulnerable dependencies to a fixed version:
  • superset-frontend/package.json
  • superset-frontend/package-lock.json

Vulnerabilities that will be fixed

With an upgrade:

Severity	Priority Score (*)	Issue	Breaking Change	Exploit Maturity
	673/1000 Why? Proof of Concept exploit, Recently disclosed, Has a fix available, CVSS 5.6	Prototype Pollution SNYK-JS-IMMER-1540542	Yes	Proof of Concept

(*) Note that the real score may have changed since the PR was raised.

Commit messages

Package name: immer

The new version differs by 68 commits.

• fa671e5 fix(security): Follow up on CVE-2020-28477 where `path: [["__proto__"], "x"]` could still pollute the prototype
• 2e0aa95 Create SECURITY.md
• 050522d chore: fix CI. maybe.
• 1195510 docs: Update example-setstate.mdx ([pull] master from apache:master #833)
• 648d39b docs: fixing link to RFC-6902 & fixing typo ([pull] master from apache:master #830)
• bc890f7 docs: Update example-setstate.mdx ([pull] master from apache:master #829)
• 16a3d0f chore(deps): bump prismjs from 1.23.0 to 1.24.0 in /website ([pull] master from apache:master #822)
• 847492c docs: Extended / updated documenation ([pull] master from apache:master #824)
• 7f41483 chore: [workflows] don't release from forks
• 3f9a94e chore: let's test before publish
• bfb8dec fix: release missing dist/ folder
• b314b19 chore: fix cpx usage
• a607d6c chore: Remove old shizzle
• 6fd5329 chore: fixes for deploy preview
• 144f886 chore: fix docs deployment attempt 3
• 38964fa chore: semantic-release + GH actions
• 06c6741 chore: fix docs deploy
• ad23da9 chore: fix test job
• b6d92f4 chore: publish docs automatically
• c59576a chore: setup GH action for test
• dc3f66c fix: [pull] master from apache:master #807 new undefined properties should end up in result object
• 5412c9f fix: [pull] master from apache:master #791 return 'nothing' should produce undefined patch
• 58b74a6 chore(deps): bump ssri from 6.0.1 to 6.0.2 in /website ([pull] master from apache:master #818)
• c9deb48 chore(deps): bump color-string from 1.5.4 to 1.5.5 in /website ([pull] master from apache:master #817)

See the full diff

Check the changes in this PR to ensure they won't cause issues with your project.

---

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report

🛠 Adjust project settings

📚 Read more about Snyk's upgrade and patch logic

[codecov-commenter]

Codecov Report

Merging #580 (2e8f512) into master (6c3bfe8) will decrease coverage by 0.06%.
The diff coverage is n/a.

@@            Coverage Diff             @@
##           master     #580      +/-   ##
==========================================
- Coverage   77.39%   77.32%   -0.07%     
==========================================
  Files         928      928              
  Lines       47024    47024              
  Branches     5561     5418     -143     
==========================================
- Hits        36393    36363      -30     
- Misses      10498    10528      +30     
  Partials      133      133              

Flag	Coverage Δ
cypress	56.46% <ø> (+0.02%)	⬆️
hive	80.25% <ø> (ø)
javascript	63.14% <ø> (ø)
mysql	80.56% <ø> (ø)
postgres	80.59% <ø> (ø)
presto	?
python	80.97% <ø> (-0.14%)	⬇️
sqlite	80.15% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

Impacted Files	Coverage Δ
superset/db_engine_specs/presto.py	82.84% <0.00%> (-5.86%)	⬇️
superset/connectors/sqla/models.py	89.87% <0.00%> (-0.61%)	⬇️
superset/models/core.py	89.10% <0.00%> (-0.28%)	⬇️
...set-frontend/src/dashboard/util/getDropPosition.js	92.42% <0.00%> (+1.51%)	⬆️
...ents/controls/FilterControl/AdhocFilterControl.jsx	62.30% <0.00%> (+2.30%)	⬆️

---

Continue to review full report at Codecov.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update 6c3bfe8...2e8f512. Read the comment docs.