Another critical vulnerability with immer

[Brycetastic]

react-dev-utils is using immer 8.0.1 I am receiving critical vulnerability with immer 8.0.1 that is fixed in 9.0.6

[rosbel]

This is also affecting our current deployments

[zeina1990]

Same here, we are also impacted by this

[petetnt]

Thanks for the report!

PR already pending in #11364, (duplicated in #11444, #11454),

• related to Help, npm audit says I have a vulnerability in react-scripts! #11174
• duplicate of react-dev-utils: Prototype Pollution in Immer  #11443

[cmacdonnacha]

Hey @petetnt - is there a way to force update this dependency as it's causing dependabot alerts for us.

[angusmccloud]

@cmacdonnacha - You can use npm-force-resolutions (https://www.npmjs.com/package/npm-force-resolutions) to force a dependency version to change. It can obviously break things, but for situations like this is works well.

[cmacdonnacha]

@cmacdonnacha - You can use npm-force-resolutions (https://www.npmjs.com/package/npm-force-resolutions) to force a dependency version to change. It can obviously break things, but for situations like this is works well.

Thanks but ansi-html is no longer maintained so people have switched to ansi-html-community. Do you know if there's a way to tell npm-force-resolutions to use a different package when installed ansi-html? That's the biggest issue I think.

[angusmccloud]

@cmacdonnacha - You can use npm-force-resolutions (https://www.npmjs.com/package/npm-force-resolutions) to force a dependency version to change. It can obviously break things, but for situations like this is works well.

Thanks but ansi-html is no longer maintained so people have switched to ansi-html-community. Do you know if there's a way to tell npm-force-resolutions to use a different package when installed ansi-html? That's the biggest issue I think.

Unfortunately, I don't think so... I think you'd have to create a branch on the repo that uses ansi-html and install that branch.

[cmacdonnacha]

@cmacdonnacha - You can use npm-force-resolutions (https://www.npmjs.com/package/npm-force-resolutions) to force a dependency version to change. It can obviously break things, but for situations like this is works well.

Thanks but ansi-html is no longer maintained so people have switched to ansi-html-community. Do you know if there's a way to tell npm-force-resolutions to use a different package when installed ansi-html? That's the biggest issue I think.

Unfortunately, I don't think so... I think you'd have to create a branch on the repo that uses ansi-html and install that branch.

Yea I don't think it's worth the risk. No getting around the dependabot alerts so I think I'm just going to have to move to Vite.