npm audit reports vulnerability - immer in react-dev-utils

[ccaspers]

Current behavior

Running npm audit produces an error caused by a transitive dependency of vue styleguidist

┌───────────────┬──────────────────────────────────────────────────────────────┐
│ High          │ Prototype Pollution                                          │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Package       │ immer                                                        │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Patched in    │ >=8.0.1                                                      │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Dependency of │ vue-cli-plugin-styleguidist [dev]                            │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Path          │ vue-cli-plugin-styleguidist > vue-styleguidist >             │
│               │ react-dev-utils > immer                                      │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ More info     │ https://npmjs.com/advisories/1603                            │
└───────────────┴──────────────────────────────────────────────────────────────┘

To reproduce

https://github.com/ccaspers/vue-styleguidist-vulnerability

git clone https://github.com/ccaspers/vue-styleguidist-vulnerability.git
cd vue-styleguidist-vulnerability
npm i && npm audit

Expected behavior
Audit doesn't report a security warning.

[elevatebart]

thank you @ccaspers

[mswertz]

I am facing same dependabot alert issue.

Cause seems to be fixed in underlying react-dev-utils ^11.0.2 see facebook/create-react-app#10411
React styleguidist has package ^11.0.0 as dependency see https://github.com/styleguidist/react-styleguidist/blob/master/package.json
So in theory this could be solved by simply rebuild pushing deps to latest, right?

[elevatebart]

@mswertz I think you are right. Thank you for tracking it down.
I need to check first what the breaking changes are in react-styleguidist 11.
Would you mind creating a PR updating rsg. This would trigger a minimum of automated tests and probably give us a clearer idea of the work to be done.

[elevatebart]

I fixed it !!!

[ccaspers]

Thank you very much :)