fix(deps): update dependency immer to v9 [security]

[renovate]

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
immer	8.0.4 -> 9.0.6

GitHub Vulnerability Alerts

CVE-2021-3757

immer is vulnerable to Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution').

CVE-2021-23436

This affects the package immer before 9.0.6. A type confusion vulnerability can lead to a bypass of CVE-2020-28477 when the user-provided keys used in the path parameter are arrays. In particular, this bypass is possible because the condition (p === "__proto__" || p === "constructor") in applyPatches_ returns false if p is ['__proto__'] (or ['constructor']). The === operator (strict equality operator) returns false if the operands have different type.

---

Release Notes

immerjs/immer (immer)

v9.0.6

Compare Source

Bug Fixes

• security: Follow up on CVE-2020-28477 where path: [["__proto__"], "x"] could still pollute the prototype (fa671e5)

v9.0.5

Compare Source

Bug Fixes

• release missing dist/ folder (bfb8dec)

v9.0.4

Compare Source

Bug Fixes

• #​791 return 'nothing' should produce undefined patch (5412c9f)
• #​807 new undefined properties should end up in result object (dc3f66c)
• Better applyPatches type (#​810) (09ac097), closes #​809

v9.0.3

Compare Source

Bug Fixes

• isPlainObject: add quick comparison between input and Object to short-circuit taxing Function.toString invocations (#​805) (07575f3)

v9.0.2

Compare Source

Bug Fixes

• #​785 fix type inference for produce incorrectly inferring promise (#​786) (6555173)

v9.0.1

Compare Source

Bug Fixes

• #​768 immerable field being lost during patch value cloning (#​771) (e0b7c01)

v9.0.0

Compare Source

feature

• Improved typescript types (2c2f30e), closes #​720

BREAKING CHANGES

• It is no longer allowed to return nothing from a recipe if the target state doesn't accept undefined.
• It is no longer allowed to return arbitrary things from a recipe. Recipes should either return nothing, or something that is assignable to the original state type. This will catch mistakes with accidental returns earlier.

---

Configuration

📅 Schedule: Branch creation - "" in timezone Asia/Singapore, Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate. View repository job log here.

[vercel]

The latest updates on your projects. Learn more about Vercel for Git ↗︎

Name	Status	Preview	Comments	Updated (UTC)
nusmods-export	✅ Ready (Inspect)	Visit Preview	💬 Add feedback	May 19, 2024 1:36am
nusmods-website	✅ Ready (Inspect)	Visit Preview	💬 Add feedback	May 19, 2024 1:36am

[codecov]

Codecov Report

All modified and coverable lines are covered by tests ✅

Project coverage is 53.59%. Comparing base (c26ef0b) to head (73269ca).

Additional details and impacted files

@@           Coverage Diff           @@
##           master    #3724   +/-   ##
=======================================
  Coverage   53.59%   53.59%           
=======================================
  Files         272      272           
  Lines        5988     5988           
  Branches     1434     1434           
=======================================
  Hits         3209     3209           
  Misses       2779     2779           

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.