chore(deps): update dependency immer to v9.0.6 [security]

[renovate]

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
immer	9.0.3 -> 9.0.6

GitHub Vulnerability Alerts

CVE-2021-23436

This affects the package immer before 9.0.6. A type confusion vulnerability can lead to a bypass of CVE-2020-28477 when the user-provided keys used in the path parameter are arrays. In particular, this bypass is possible because the condition (p === "proto" || p === "constructor") in applyPatches_ returns false if p is ['proto'] (or ['constructor']). The === operator (strict equality operator) returns false if the operands have different type.

CVE-2021-3757

immer is vulnerable to Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')

---

Release Notes

immerjs/immer

v9.0.6

Compare Source

Bug Fixes

• security: Follow up on CVE-2020-28477 where path: [["__proto__"], "x"] could still pollute the prototype (fa671e5)

v9.0.5

Compare Source

Bug Fixes

• release missing dist/ folder (bfb8dec)

v9.0.4

Compare Source

Bug Fixes

• #​791 return 'nothing' should produce undefined patch (5412c9f)
• #​807 new undefined properties should end up in result object (dc3f66c)
• Better applyPatches type (#​810) (09ac097), closes #​809

---

Configuration

📅 Schedule: "" in timezone UTC.

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, click this checkbox.

---

This PR has been generated by WhiteSource Renovate. View repository job log here.