Upgrade immer to 8.0.1

[twekel]

Do you want to request a feature or report a bug?

Security patch for dependency

Can the immer package be upgraded to 8.0.1 as per #4050?

The immer project recently fixed a Prototype Pollution vulnerability.

immerjs/immer#738

What's the current behavior?

packages/slate/package.json
packages/slate-history/package.json
both reference "immer": "^7.0.0"

Slate: 0.60.2
Browser: All
OS: All

What's the expected behavior?

packages/slate/package.json
packages/slate-history/package.json
both reference "immer": "^8.0.1"

as per #4050

[ryanj11]

Has there been any movement on this security patch? Are there plans for an update?

[OrionSeven]

Would like to see this get updated as well.

[netsgnut]

Linking to related issue #4050. There are also some discussions regarding the immer dependency.

[hugbubby]

@ianstormtaylor How has this not been fixed? This is an RCE issue

[netsgnut]

@hugbubby I think the #4050 PR has been merged (since May) and immer has been bumped since 0.63.0. We should close this.

See

slate/yarn.lock

Line 6568 in 39b0254

immer@^8.0.1:

[hanshs]

Hello! I am still receiving the vulnerability notice with "slate-history": "^0.62.0"

npm audit
                                                                                
                       === npm audit security report ===                        
                                                                                
┌──────────────────────────────────────────────────────────────────────────────┐
│                                Manual Review                                 │
│            Some vulnerabilities require your attention to resolve            │
│                                                                              │
│         Visit https://go.npm.me/audit-guide for additional guidance          │
└──────────────────────────────────────────────────────────────────────────────┘
┌───────────────┬──────────────────────────────────────────────────────────────┐
│ High          │ Prototype Pollution                                          │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Package       │ immer                                                        │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Patched in    │ >=8.0.1                                                      │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Dependency of │ slate-history                                                │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Path          │ slate-history > immer                                        │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ More info     │ https://npmjs.com/advisories/1603                            │
└───────────────┴──────────────────────────────────────────────────────────────┘

[kenziebottoms]

Any updates on patching slate-history?

[jungRoit]

Any Updates on this?

[JulesPatry]

Any update on this? :)