Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

update immer to 8.0.1 to address vulnerability #10412

Merged
merged 1 commit into from Feb 22, 2021
Merged

update immer to 8.0.1 to address vulnerability #10412

merged 1 commit into from Feb 22, 2021

Conversation

wclem4
Copy link
Contributor

@wclem4 wclem4 commented Jan 20, 2021

Resolves #10411

Bumps immer version to 8.0.1 to address the prototype pollution
vulnerability with the current 7.0.9 version.

@wclem4
update immer to 8.0.1 to address vulnerability
dfe2a09 
Resolves facebook#10411

Bumps immer version to 8.0.1 to address the prototype pollution
vulnerability with the current 7.0.9 version.
@facebook-github-bot
Copy link

Hi @wclem4!

Thank you for your pull request and welcome to our community.

Action Required

In order to merge any pull request (code, docs, etc.), we require contributors to sign our Contributor License Agreement, and we don't seem to have one on file for you.

Process

In order for us to review and merge your suggested changes, please sign at https://code.facebook.com/cla. If you are contributing on behalf of someone else (eg your employer), the individual CLA may not be sufficient and your employer may need to sign the corporate CLA.

Once the CLA is signed, our tooling will perform checks and validations. Afterwards, the pull request will be tagged with CLA signed. The tagging process may take up to 1 hour after signing. Please give it that time before contacting us about it.

If you have received this in error or have any questions, please contact us at cla@fb.com. Thanks!

@facebook-github-bot
Copy link

Thank you for signing our Contributor License Agreement. We can now accept your code for this (and any) Facebook open source project. Thanks!

@fernandopasik
Copy link

The error in the pipeline seems unrelated to this
You cannot require a package ("eslint-config-react-app") that is not declared in your dependencies (via "/home/vsts/work/_temp/tmp.FmWC8HKQqL/test-app-pnp/package.json")

@toddsiegel toddsiegel mentioned this pull request Jan 21, 2021
Closed
@cloud-matt cloud-matt mentioned this pull request Jan 26, 2021
Closed
alangpierce added a commit to alangpierce/sucrase that referenced this pull request Jan 31, 2021
@alangpierce
Update immer dependency for website
228189a 
CRA is still in the process of updating with the immer fix
( facebook/create-react-app#10412 ), so this uses a
resolution override to use the newest immer. To reduce chance of compatibility
issues, I also updated `react-dev-utils` to latest and confirmed that dev and
prod builds both still work.
@alangpierce alangpierce mentioned this pull request Jan 31, 2021
Merged
alangpierce added a commit to alangpierce/sucrase that referenced this pull request Jan 31, 2021
@alangpierce
Update immer dependency for website (#595)
cef50b4 
CRA is still in the process of updating with the immer fix
( facebook/create-react-app#10412 ), so this uses a
resolution override to use the newest immer. To reduce chance of compatibility
issues, I also updated `react-dev-utils` to latest and confirmed that dev and
prod builds both still work.
@trivikr trivikr mentioned this pull request Feb 2, 2021
Closed
@sachinmour
Copy link

is there an update on this?

@jieru-hu jieru-hu mentioned this pull request Feb 4, 2021
Closed
@yangshun
Copy link
Contributor

yangshun commented Feb 7, 2021

@iansu what do you think about this PR? Merging this PR + releasing a new version would help address many security vulnerability alerts for FB OSS projects because they use Docusaurus which uses this.

@lex111 lex111 mentioned this pull request Feb 7, 2021
Closed
@RDIL RDIL mentioned this pull request Feb 8, 2021
Closed
@stasvas
Copy link

stasvas commented Feb 13, 2021

Friendly ping for @ianschmitz, @iansu and @mrmckeb. Please upgrade immer, we really need it!

@RianTavares
Copy link

Can someone please take a look at this?

@RDIL
Copy link
Contributor

RDIL commented Feb 18, 2021

@iansu @mrmckeb @ianschmitz @gaearon

@gaearon
Copy link
Contributor

gaearon commented Feb 18, 2021

Just to be clear, there is (and never was) a real vulnerability here. It's a false positive, as it usually happens with build tools.

@wclem4 Did you test this change and verify that the function that uses Immer still works? In particular, the TypeScript integration. This is a major version bump.

@iansu
Copy link
Contributor

iansu commented Feb 18, 2021

We will be releasing 4.0.3 this weekend with this package upgrade and some other small fixes.

@devoto13 devoto13 mentioned this pull request Feb 19, 2021
Closed
@joshkel joshkel mentioned this pull request Feb 20, 2021
Closed
@idaons idaons mentioned this pull request Feb 22, 2021
Merged
@martigan
Copy link

hi there any news about the upcoming version?

@aruniverse
Copy link

We will be releasing 4.0.3 this weekend with this package upgrade and some other small fixes.

Could this be backported to 3.x?

@JVThomas JVThomas mentioned this pull request Feb 22, 2021
Merged
8 tasks
This was referenced Mar 12, 2021
Open
Closed
Open
Open
Open
Open
Open
Open
Open
Open
Open
Open
Open
Open
Open
Closed
Open
Open
Open
Merged
Open
Merged
Closed
Closed
Merged
blackarctic added a commit to blackarctic/create-react-app that referenced this pull request Apr 29, 2021
@blackarctic @ryota-murakami
@KonstantinSimeonov @iansu @sho-t @anyulled @ianschmitz @jeffposnick @EvanBacon @trainto @sheepsteak @jasonwilliams @jabranr @jrr @raix @maxsbelt @ehsankhfr @merceyz @Avivhdr @tobiasbueschel @josezone @mad-jose @ajhyndman @mrmckeb @jamesgeorge007 @Awarua- @wclem4
Align with react-scripts 4.0.3 (#17)
109f05d 
* Fix noFallthroughCasesInSwitch/jsx object is not extensible (facebook#9921)

Co-authored-by: Konstantin Simeonov <kon.simeonov@protonmail.com>

* Add logo license to README

* Remove trailing space in reportWebVitals.ts (facebook#10040)

* docs: add React Testing Library as a library requiring jsdom (facebook#10052)

Co-authored-by: Ian Schmitz <ianschmitz@gmail.com>

* Increase Workbox's maximumFileSizeToCacheInBytes (facebook#10048)

* Create FUNDING.yml

* replace inquirer with prompts (facebook#10083)

- remove `react-dev-utils/inquirer` public import

* Prepare 4.0.1 release

* Prepare 4.0.1 release

* Publish

 - cra-template-typescript@1.1.1
 - cra-template@1.1.1
 - create-react-app@4.0.1
 - react-dev-utils@11.0.1
 - react-scripts@4.0.1

* chore: bump web-vital dependency version (facebook#10143)

* chore: bump typescript version (facebook#10141)

Co-authored-by: Ian Schmitz <ianschmitz@gmail.com>

* Add TypeScript 4.x as peerDependency to react-scripts(facebook#9964)

* remove chalk from formatWebpackMessages (facebook#10198)

* Upgrade @svgr/webpack to fix build error (facebook#10213)

Co-authored-by: Ian Schmitz <ianschmitz@gmail.com>

* Improve vendor chunk names in development (facebook#9569)

* Update postcss packages (facebook#10003)

Co-authored-by: Ian Schmitz <ianschmitz@gmail.com>

* Recovered some integration tests (facebook#10091)

* Upgrade sass-loader (facebook#9988)

* Move ESLint cache file into node_modules (facebook#9977)

Co-authored-by: Ian Schmitz <ianschmitz@gmail.com>

* Revert "Update postcss packages" (facebook#10216)

This reverts commit 580ed5d.

* Remove references to Node 8 (facebook#10214)

* fix(react-scripts): add missing peer dependency react and update react-refresh-webpack-plugin (facebook#9872)

* Update using-the-public-folder.md (facebook#10314)

Some library --> Some libraries

* docs: add missing override options for Jest config (facebook#9473)

* Fix CI tests (facebook#10217)

* appTsConfig immutability handling by immer (facebook#10027)

Co-authored-by: mad-jose <joset@yeswearemad.com>

* Add support for new BUILD_PATH advanced configuration variable (facebook#8986)

* Add opt-out for eslint-webpack-plugin (facebook#10170)

* Prepare 4.0.2 release

* Publish

 - cra-template-typescript@1.1.2
 - cra-template@1.1.2
 - create-react-app@4.0.2
 - react-dev-utils@11.0.2
 - react-error-overlay@6.0.9
 - react-scripts@4.0.2

* tests: update test case to match the description (facebook#10384)

* Bump webpack-dev-server 3.11.0 -> 3.11.1 (facebook#10312)

Resolves facebook#10084 security vulnerability in websocket-driver library version 0.5.6, imported transitively by sockjs

* Upgrade eslint-webpack-plugin to fix opt-out flag (facebook#10590)

* update immer to 8.0.1 to address vulnerability (facebook#10412)

Resolves facebook#10411

Bumps immer version to 8.0.1 to address the prototype pollution
vulnerability with the current 7.0.9 version.

* Prepare 4.0.3 release

* Update CHANGELOG

* Publish

 - create-react-app@4.0.3
 - react-dev-utils@11.0.3
 - react-scripts@4.0.3

Co-authored-by: Ryota Murakami <dojce1048@gmail.com>
Co-authored-by: Konstantin Simeonov <kon.simeonov@protonmail.com>
Co-authored-by: Ian Sutherland <ian@iansutherland.ca>
Co-authored-by: sho90 <aznecosann@gmail.com>
Co-authored-by: Anyul Rivas <anyulled@gmail.com>
Co-authored-by: Ian Schmitz <ianschmitz@gmail.com>
Co-authored-by: Jeffrey Posnick <jeffy@google.com>
Co-authored-by: Evan Bacon <baconbrix@gmail.com>
Co-authored-by: Sahil Purav <sahil5684@gmail.com>
Co-authored-by: Hakjoon Sim <trainto@gmail.com>
Co-authored-by: Chris Shepherd <chris@chrisshepherd.me>
Co-authored-by: Jason Williams <936006+jasonwilliams@users.noreply.github.com>
Co-authored-by: Jabran Rafique⚡️ <jabranr@users.noreply.github.com>
Co-authored-by: John Ruble <johnruble@gmail.com>
Co-authored-by: Morten N.O. Nørgaard Henriksen <morten.n.o.henriksen@icloud.com>
Co-authored-by: Sergey Makarov <serega.s.makar@gmail.com>
Co-authored-by: EhsanKhaki <ehsankhfr@gmail.com>
Co-authored-by: Kristoffer K <merceyz@users.noreply.github.com>
Co-authored-by: Aviv Hadar <Avivhdr@gmail.com>
Co-authored-by: Tobias Büschel <13087421+tobiasbueschel@users.noreply.github.com>
Co-authored-by: mad-jose <44253495+josezone@users.noreply.github.com>
Co-authored-by: mad-jose <joset@yeswearemad.com>
Co-authored-by: Andrew Hyndman <ajhyndman@hotmail.com>
Co-authored-by: Brody McKee <mrmckeb@users.noreply.github.com>
Co-authored-by: James George <jamesgeorge998001@gmail.com>
Co-authored-by: Dion Woolley <woolley.dion@gmail.com>
Co-authored-by: Walker Clem <51654951+wclem4@users.noreply.github.com>
wombleton pushed a commit to AurorNZ/create-react-app that referenced this pull request Jun 1, 2021
@wclem4 @wombleton
update immer to 8.0.1 to address vulnerability (facebook#10412)
95bb9f4 
Resolves facebook#10411

Bumps immer version to 8.0.1 to address the prototype pollution
vulnerability with the current 7.0.9 version.
@smile-eh smile-eh mentioned this pull request Dec 9, 2021
Merged
abhiisheek pushed a commit to abhiisheek/create-react-app that referenced this pull request May 19, 2023
@wclem4 @abhiisheek
update immer to 8.0.1 to address vulnerability (facebook#10412)
f6978ce 
Resolves facebook#10411

Bumps immer version to 8.0.1 to address the prototype pollution
vulnerability with the current 7.0.9 version.
abhiisheek pushed a commit to abhiisheek/create-react-app that referenced this pull request May 24, 2023
@wclem4 @abhiisheek
update immer to 8.0.1 to address vulnerability (facebook#10412)
8bc48b7 
Resolves facebook#10411

Bumps immer version to 8.0.1 to address the prototype pollution
vulnerability with the current 7.0.9 version.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@ianschmitz ianschmitz Awaiting requested review from ianschmitz

@iansu iansu Awaiting requested review from iansu

@mrmckeb mrmckeb Awaiting requested review from mrmckeb

Assignees
No one assigned
Labels
CLA Signed tag: internal
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.

react-dev-utils uses a vulnerable version of immer as a dependency