⬆️ Update dependency immer to v8 [SECURITY]

[renovate]

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
immer	7.0.9 -> 8.0.1

⚠️ MAJOR MAJOR MAJOR ⚠️

GitHub Vulnerability Alerts

CVE-2020-28477

Overview

Affected versions of immer are vulnerable to Prototype Pollution.

Proof of exploit

const {applyPatches, enablePatches} = require("immer");
enablePatches();
let obj = {};
console.log("Before : " + obj.polluted);
applyPatches({}, [ { op: 'add', path: [ "__proto__", "polluted" ], value: "yes" } ]);
// applyPatches({}, [ { op: 'replace', path: [ "__proto__", "polluted" ], value: "yes" } ]);
console.log("After : " + obj.polluted);

Remediation

Version 8.0.1 contains a fix for this vulnerability, updating is recommended.

---

Release Notes

immerjs/immer

v8.0.1

Compare Source

Bug Fixes

• Fixed security issue #​738: prototype pollution possible when applying patches CVE-2020-28477 (da2bd4f)

v8.0.0

Compare Source

feature

• Always freeze by default (#​702) (a406c8f)

BREAKING CHANGES

• always freeze by default, even in production mode. Use setAutoFreeze(process.env.NODE_ENV !== 'production') for the old behavior. See #​687 (comment) for the rationale. Fixes #​649, #​681, #​687

v7.0.15

Compare Source

Bug Fixes

• make plugin loading idempotent, fixes #​692 (754331b)

v7.0.14

Compare Source

Bug Fixes

• build issue. Fixes #​685 (?) (9007be0)

v7.0.13

Compare Source

Bug Fixes

• reconcile if the original value is assigned after creating a draft. Fixes #​659 (c0e6749)

v7.0.12

Compare Source

Bug Fixes

• undraftable values should not be cloned for patches, fixes #​676 (1b70ad5)

v7.0.11

Compare Source

Bug Fixes

• skip ReadonlyMap and ReadonlySet types when not available (#​653). Fixes #​624 (12f4cf8)

v7.0.10

Compare Source

Bug Fixes

• Clearing empty Set&Map should be noop (#​682). Fixes #​680 (33a305b)

---

Renovate configuration

📅 Schedule: "" (UTC).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻️ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by WhiteSource Renovate. View repository job log here.