fix: vulnerability in immer

[i1skn]

https://www.npmjs.com/advisories/1603

[netlify]

Deploy preview for redux-starter-kit-docs ready!

Built with commit 3b09ed5

https://deploy-preview-909--redux-starter-kit-docs.netlify.app

[markerikson]

Strictly speaking, we don't need to do anything on our end. Our own dependency says "anything 8.0.0 or newer", and 8.0.1 is already newer (ref: #871, #874, #879 , #890 ).

It's up to users to update the transitive dependencies locally, because their lockfiles have already settled on 8.0.0. And, any fresh installs of RTK will pick up 8.0.1 automatically.

But, I suppose it doesn't hurt to bump this here too.

[markerikson]

So this PR is actually bugged, because it didn't update our own lockfile too. Can you update the lockfile as well?

[codesandbox-ci]

This pull request is automatically built and testable in CodeSandbox.

To see build info of the built libraries, click here or the icon next to each commit SHA.

Latest deployment of this branch, based on commit 3b09ed5:

Sandbox	Source
Vanilla	Configuration
Vanilla Typescript	Configuration
rsk-github-issues-example	Configuration

[markerikson]

Thanks. Will try to publish 1.5.1 later today or tomorrow, but as mentioned, you can resolve this on your end as well by just updating the transitive dependency yourself.

(Also, looking at the PR you linked: note that we recommend using createSlice as the default in most situations, rather than calling createAction directly, unless you really need to define standalone action types.)

[sleric1024]

Hi @markerikson , May I know that when will the 1.5.1 version be published ?
Thanks.

[markerikson]

Sorry, been busy and this has been a low priority.

As mentioned, strictly speaking we didn't even need to make this change - we already depended on anything in the 8.x range, so you just need to update your own installed packages to pick up the newer Immer version.