Fix for vulnerability - "Critical Prototype Pollution in immer" Patched >=9.0.6 - reactjs

Question

Here's a fix for the following vulnerability:
Critical Prototype Pollution in immer
Package immer
Patched in >=9.0.6
Dependency of react-scripts
Path react-scripts > react-dev-utils > immer
More info https://github.com/advisories/GHSA-33f9-j839-rf8h
Fix:
Install the patched version of immer, in this case 9.0.6, using the following command:
npm install --save immer#9.0.6
Update the package.json file with npm update.
IMPORTANT NOTE: if at this point the vulnerability is still present, you can do the following ONLY if you know this will not break your code or mess up dependencies for previous versions or other packages of your project. I'm the only person working on my project, so this fix works in my scenario.
In your package-lock.json file, find the outdated package, in my case:
"immer": {
"version": "8.0.1",
"resolved": "https://registry.npmjs.org/immer/-/immer-8.0.1.tgz",
"integrity": "sha512-aqXhGP7//Gui2+UrHtvxZxSquQVXTpZ7KDxfCcKAF3Vysvw0CViVaH9RZ1j1xlIYqaaaipBoqcqeibkc17PNvF=="
},
and straight-up delete it.
This fix seems not very sustainable for all packages/dependencies, but who knows? If there are better ways, let the community know.

Answer 1

Your fix should be good enough to patch that critical vulnerability, though as you've identified it tends to be fragile and easy to undo.
If possible, update to react-scripts#^5.0.0 or later. It has already upgraded transitively via react-dev-utils to immer#^9.0.7.
If for whatever reason (e.g. removed polyfills or otherwise) you cannot upgrade react-scripts, I'd suggest after reviewing immer's breaking changes:
npm-force-resolutions, add the following to package.json, then npm install:
"resolutions": {
"immer": "9.0.12"
},
"scripts": {
"preinstall": "npx npm-force-resolutions"
},
OR yarn resolutions add the following to package.json, then yarn install:
"resolutions": {
"immer": "9.0.12"
},
Of course, if someone else finds another vulnerability in immer in future, you'll need to repeat this with a later version.
P.S. Sorry for answering what I'm sure is a duplicate question, though no obvious one to link to jumps out at me right now.