Latest version of react-dev-utils using immer v8.0.1

[nikhithabaker]

when I used react-dev-utils , the version of immer which I got is v8.0.1 instead of v9.0.6, immer of version 8.0.1 which has type confusion vulnerability , it is effecting my work kindly resolve this issue.

[vejandla]

ran into the same issue and reported by security scan. Can we fix this?

immer 8.0.6 has a vulnerability.

[Pjohnsonator]

This looks like it was addressed 2 months ago and merged into the main branch but without publishing it to npm since react-dev-utils@11.0.4 from 9 months ago.

[nikhithabaker]

when are they planning to publish the newer version to npm ?

[mheob]

immer < 9.0.6 has been classified as critical severity. A timely release would be good.

Btw. the used browserslist 4.14.2 is also vulnerable: GHSA-w8qv-6jwh-64r5

[vejandla]

This has been reported 13 days ago and it is still labeled as needs triage. The bad thing about this is, it was fixed, but not yet released to npm. Appreciate it if it can get some attention from the release team.

[ewertonsilveira]

Same for me, dependabot is telling me to upgrade to immer > 9.0.6

[joekarasek]

Would also love to see this get published soon, please and thank you!

[victorfgs]

Having the same immer alert here. Any news about the release?