search

umijs / plugins

🍣 The one-stop shop for official Umi plugins and presets.
348 stars 238 forks source link

Dependabot on github take 'critical severity' to immer #741

Open elliotmessi opened 2 years ago

elliotmessi commented 2 years ago

When I use umi for project, and upload my code to github, github security panel will alert that immer's version is < 9.0.6, and take critical severity level. It's simple to resolve it by updating immer version in @umijs/plugin-dva package.

mersedsv commented 2 years ago

Same on my side.

npm installation / audit is showing exactly the same thing.

Multiple high and critical vulnerabilities are reported for the immer dependency.