Latest version of react-dev-utils using immer v8.0.1

[nikhithabaker]

when I used react-dev-utils , the version of immer which I got is v8.0.1 instead of v9.0.6, immer of version 8.0.1 which has type confusion vulnerability , it is effecting my work kindly resolve this issue.

[vejandla]

ran into the same issue and reported by security scan. Can we fix this?

immer 8.0.6 has a vulnerability.

[Pjohnsonator]

This looks like it was addressed 2 months ago and merged into the main branch but without publishing it to npm since react-dev-utils@11.0.4 from 9 months ago.

[nikhithabaker]

when are they planning to publish the newer version to npm ?

[mheob]

immer < 9.0.6 has been classified as critical severity. A timely release would be good.

Btw. the used browserslist 4.14.2 is also vulnerable: GHSA-w8qv-6jwh-64r5

[vejandla]

This has been reported 13 days ago and it is still labeled as needs triage. The bad thing about this is, it was fixed, but not yet released to npm. Appreciate it if it can get some attention from the release team.

[ewertonsilveira]

Same for me, dependabot is telling me to upgrade to immer > 9.0.6

[joekarasek]

Would also love to see this get published soon, please and thank you!

[victorfgs]

Having the same immer alert here. Any news about the release?

[apeiniger]

Same here

[ayoubelasryRoot]

same issue here

[dannyskoog]

same

[jonsalvas]

same, but got it fixed with npm and this workaround for now (package.json):

 "scripts": {
    ..
    "preinstall": "npx npm-force-resolutions"
    ..
  },
  
  ..
  
  "devDependencies": {
    "npm-force-resolutions": "0.0.10"
  }

  ..

  "resolutions": {
    "immer": "9.0.6"
  },

  ..

it is bad I know but it is saving me some of my precious time :-)

[ayoubelasryRoot]

same, but got it fixed with npm and this workaround for now (package.json):

 "scripts": {
    ..
    "preinstall": "npx npm-force-resolutions"
    ..
  },
  
  ..
  
  "devDependencies": {
    "npm-force-resolutions": "0.0.10"
  }

  ..

  "resolutions": {
    "immer": "9.0.6"
  },

  ..

it is bad I know but it is saving me some of my precious time :-)

Thank you was facing issues trying to use this fix with npm but with yarn it was working fine not sure why.

[ab-smith]

same

[iiLearner]

is there any ETA?

[MZOG]

Any update?

[mheob]

CRA was updated to v5 yesterday (github.com/facebook/create-react-app/releases/tag/v5.0.0).
With it v12 of the react-dev-utils was also released (www.npmjs.com/package/react-dev-utils).

So it should be fixed now.