Stuck on an issue?

Lightrun Answers was designed to reduce the constant googling that comes with debugging 3rd party libraries. It collects links to all the places you might be looking at while hunting down a tough bug.

And, if you’re still stuck at the end, we’re happy to hop on a call to see how we can help out.

react-dev-utils: Security vulnerability with immer 7.0.9

See original GitHub issue

Describe the bug

Security vulnerability with immer 7.0.9

https://www.npmjs.com/advisories/1603

Actual behavior

┌───────────────┬──────────────────────────────────────────────────────────────┐
│ high          │ Prototype Pollution                                          │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Package       │ immer                                                        │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Patched in    │ >=8.0.1                                                      │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Dependency of │ @storybook/react                                             │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Path          │ @storybook/react > react-dev-utils > immer                   │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ More info     │ https://www.npmjs.com/advisories/1603                        │
└───────────────┴──────────────────────────────────────────────────────────────┘

Reproducible demo

yarn install @storybook/react && yarn audit

Issue Analytics

State:
Created 3 years ago
Reactions:46
Comments:8 (1 by maintainers)

Top GitHub Comments

5reactions

joshkelcommented, Feb 20, 2021

@Aleksei-Pankratev-EPAM , from what I understand, it’s create-react-app’s general policy to pin all dependencies to exact versions. That helps make sure that everything keeps working, but (as you said), it has the disadvantage of making it harder to get minor package upgrades for security fixes. In this case, a caret range wouldn’t have helped; create-react-app uses Immer 7.0.9, and the Immer bug was fixed in 8.0.1, which a caret range wouldn’t match (due to potential backward-incompatible changes).

@Pistaco , create-react-app isn’t affected by this particular security issue. So, although there are big advantages to keeping any automated security scanners happy, it’s not an issue if you’re not using Immer yourself.

0reactions

gaearoncommented, Feb 22, 2021

This is a duplicate of https://github.com/facebook/create-react-app/issues/10411.

Please see the discussion there. In particular, https://github.com/facebook/create-react-app/issues/10411#issuecomment-781399779.