Prototype Pollution vulnerability

[romain-guillot-symphony]

🐛 Bug Report

A Prototype Pollution vulnerability has been raised by Snyk and it is affecting all versions of immer.
The vulnerability seems to be on the following line
Find more details here

Environment

All immer versions

[mweststrate]

Solved and released in 8.0.1

[dimaqq]

Were only applyPatches affected, or regular, recommended use of immer too, transitively affected?
(just wondering how urgent it is to push new version of depending software into production)

[mweststrate]

Just patches, and only if you can't trust the source of the patches. E.g. someone could construct / alter patches in his browser session, send them to the server, and then they can potentially be used later to break another client that receives those patches if they are passed along unvalidated.

…

On Thu, Jan 21, 2021 at 4:38 AM Dima Tisnek ***@***.***> wrote: Were only applyPatches affected, or regular, recommended use of immer too, transitively affected? (just wondering how urgent it is to push new version of depending software into production) — You are receiving this because you modified the open/close state. Reply to this email directly, view it on GitHub <#738 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AAN4NBBKYMLCFJ77S67DQ3LS26VUJANCNFSM4WJEPJAQ> .