Immer is a popular JavaScript library that simplifies working with immutable data structures by allowing developers to use mutable syntax while ensuring immutability under the hood. Comparing versions 8.0.0 and 8.0.1 reveals subtle but potentially impactful differences. Both versions share the same core functionality, description, development dependencies, license (MIT), repository, author, and funding information. The key distinction lies in the dist section, specifically the unpackedSize. Version 8.0.1 has an unpacked size of 832151 bytes, slightly larger than version 8.0.0's 826906 bytes, an increase of around 5KB. While seemingly minimal, this size increase could indicate minor bug fixes, performance tweaks, or internal changes. Developers should consider this difference, especially in performance-sensitive applications or when minimizing bundle sizes is crucial. Furthermore, the releaseDate differs significantly: version 8.0.1 was released on January 20, 2021, while version 8.0.0 was released on November 17, 2020. The gap of over two months suggests that 8.0.1 likely addresses issues discovered after the initial 8.0.0 release. Therefore, it is generally advantageous to use the newer version (8.0.1) to benefit from potential bug fixes and improvements, unless specific compatibility issues or regressions are encountered. For new projects, version 8.0.1 is the recommended starting point, ensuring the most up-to-date and potentially stable experience.
All the vulnerabilities related to the version 8.0.1 of the package
Prototype Pollution in immer
This affects the package immer before 9.0.6. A type confusion vulnerability can lead to a bypass of CVE-2020-28477 when the user-provided keys used in the path parameter are arrays. In particular, this bypass is possible because the condition (p === "__proto__" || p === "constructor")
in applyPatches_
returns false if p
is ['__proto__']
(or ['constructor']
). The ===
operator (strict equality operator) returns false if the operands have different type.
Prototype Pollution in immer
immer is vulnerable to Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution').