Razzle: Dependancy "immer" high vulnerability risk

[matt-catellier]

Current Behavior
It seems like one of your nested dependencies is introducing a security issue.
image

Expected behavior
There are no high-security issues in the repo or any underlying dependency.

Suggested solution(s)
Would it be possible to upgrade that dependency as they have already fixed that? Or should it be addressed inside the "user's" repo with some npm resolution?

[matt-catellier]

Any action on this?

[GLObus303]

https://github.com/immerjs/immer/releases/tag/v8.0.0, there is one breaking change, that has some fallback. Not sure that any environment logic is applicable for a library.

Would be amazing if somebody could have a look at that before Razzle v.4. Not sure how many breaking changes it will introduce. But for bigger codebases, it could be quite difficult to update major versions.

[esimons]

Just to unwind the action that would be required to address this, react-dev-utils updated their dependency to [email protected] in their 11.0.3 release, which would be a major version bump in that dependency for razzle-dev-utils and for razzle.

[fivethreeo]

Fixed in v4

[EvanCoh]

Fixed in v4

Thank you. Any plans on fixing this on v3 as well?

[fivethreeo]

No plans on fixing this in 3.x since 3.x is prone to break on dep updates. It is only a dev dependency aswell that is only used in dev. So will not affect any production code.