react-dev-utils uses a vulnerable version of immer as a dependency

Describe the bug

react-dev-utils package uses a vulnerable version (7.0.9) of immer as a dependency.

Here is the GitHub CVE (High Severity) notification for the vulnerability, and here is the commit that has fixed it in the Immer 8.0.1 release earlier today.

react-dev-utils should be updated to use version 8.0.1 of Immer.

[mrwensveen]

Thanks for looking at this, I really appreciate the hard work you people are doing!

Note: this will NOT make anybody’s apps vulnerable. This is a development-time only dependency.

Is there a reason it’s not a devDependency?

What I meant is that it is essentially its only used during the build phase of your app, not at runtime. Sorry for phrasing it wrong.

But doesn’t that mean it should be a devDependency?

IMHO there is something seriously wrong with the security audit notifications. I’ve seen it dozens of times:

1. npm warns about a vulnerability.
2. developers want to be good citizens and submit a bug.
3. package maintainers tell them there’s nothing to worry about and leave the end users with alarms going off for weeks.

I think telling users to ignore security warnings is harmful. So either npm shouldn’t warn about irrelevant vulnerabilities, or package maintainers should prioritize security vulnerabilities even if they are irrelevant.

[gaearon]

Update: the maintainers are planning to release a patch at some point before next week to address this.