Dependabot alerts

Describe the bug

After installing a new instance of the studio and pushing the code to a GitHub repository, got a few dependabot alerts. As follows:

• https://github.com/advisories/GHSA-9qmh-276g-x5pj
• https://github.com/advisories/GHSA-p9pc-299p-vxgp
• https://github.com/advisories/GHSA-4xcv-9jjx-gfj3

To Reproduce

Steps to reproduce the behavior:

1. Install the latest version of Studio (currently v2.10.2) with sanity init
2. Push the code to an empty GitHub repository with dependabot alerts enabled
3. Get the alerts related to the 3 mentioned vulnerabilities

Expected behavior

I’d expect to see no vulnerabilities.

Screenshots

N/A

Which versions of Sanity are you using?

@sanity/cli             2.10.0 (up to date)
@sanity/base            2.10.2 (up to date)
@sanity/components       2.2.6 (up to date)
@sanity/core            2.10.2 (up to date)
@sanity/default-layout  2.10.2 (up to date)
@sanity/default-login    2.8.0 (up to date)
@sanity/desk-tool       2.10.2 (up to date)
@sanity/vision          2.10.0 (up to date)

What operating system are you using?

macOS 11.3 (20E232)

Which versions of Node.js / npm are you running?

6.14.11
v12.18.3

Additional context

Here is the audit output:

┌───────────────┬──────────────────────────────────────────────────────────────┐
│ low           │ Denial of Service                                            │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Package       │ mem                                                          │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Patched in    │ >=4.0.0                                                      │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Dependency of │ @sanity/core                                                 │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Path          │ @sanity/core > @sanity/server > webpack > yargs > os-locale  │
│               │ > mem                                                        │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ More info     │ https://www.npmjs.com/advisories/1084                        │
└───────────────┴──────────────────────────────────────────────────────────────┘
┌───────────────┬──────────────────────────────────────────────────────────────┐
│ low           │ Prototype Pollution                                          │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Package       │ yargs-parser                                                 │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Patched in    │ >=13.1.2 <14.0.0 || >=15.0.1 <16.0.0 || >=18.1.2             │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Dependency of │ @sanity/core                                                 │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Path          │ @sanity/core > @sanity/server > webpack > yargs >            │
│               │ yargs-parser                                                 │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ More info     │ https://www.npmjs.com/advisories/1500                        │
└───────────────┴──────────────────────────────────────────────────────────────┘
┌───────────────┬──────────────────────────────────────────────────────────────┐
│ high          │ Prototype Pollution                                          │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Package       │ immer                                                        │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Patched in    │ >=8.0.1                                                      │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Dependency of │ @sanity/desk-tool                                            │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Path          │ @sanity/desk-tool > @sanity/form-builder >                   │
│               │ @sanity/portable-text-editor > slate > immer                 │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ More info     │ https://www.npmjs.com/advisories/1603                        │
└───────────────┴──────────────────────────────────────────────────────────────┘
3 vulnerabilities found - Packages audited: 1480
Severity: 2 Low | 1 High

Security issue?

This is not a security issue directly related to Sanity but to third-party packages on which Sanity depends.

[skogsmaskin]

The immer.js dependency is now gone 🎉

[tomasz-io]

19 vulnerabilities as of today. Is fixing this on the roadmap?