Dependency vulnerablity in react-scripts

[MattRC7]

                                                                                
                       === npm audit security report ===                        
                                                                                
┌──────────────────────────────────────────────────────────────────────────────┐
│                                Manual Review                                 │
│            Some vulnerabilities require your attention to resolve            │
│                                                                              │
│         Visit https://go.npm.me/audit-guide for additional guidance          │
└──────────────────────────────────────────────────────────────────────────────┘
┌───────────────┬──────────────────────────────────────────────────────────────┐
│ High          │ Prototype Pollution                                          │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Package       │ immer                                                        │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Patched in    │ >=8.0.1                                                      │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Dependency of │ react-scripts                                                │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Path          │ react-scripts > react-dev-utils > immer                      │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ More info     │ https://npmjs.com/advisories/1603                            │
└───────────────┴──────────────────────────────────────────────────────────────┘
found 1 high severity vulnerability in 2000 scanned packages
  1 vulnerability requires manual review. See the full report for details.

npm audit fix could not resolve the issue, as the dependency is nested. Looks like the react-scripts repo is aware, so we should track that issue and bump the version once it is resolved: facebook/create-react-app#10578

[MattRC7]

Do we want to add a security label?

[j256]

Added security label @MattRC7 .

[dldereklee]

Seems to be resolved in 4.0.3
https://github.com/facebook/create-react-app/releases/tag/v4.0.3