Packages

immer

11.2.9 · 22 Oct 2026MIT89.4M / weekRepositoryHomepagenpmAtom feed

Upgrading immer From 9.0.1 to 11.2.9

65 releases in betweenevery note read

Other targets from 9.0.1Newest 9.x9.0.21Clears its 2 advisories9.0.6
  1. 9.0.1yours
  2. 4 releases
  3. 9.0.6security
  4. 15 releases
  5. 10.0.0major
  6. 9 releases
  7. 11.0.0major
  8. 9 releases
  9. 11.1.9security
  10. 23 releases
  11. 11.2.9target
26
changes to make
2
advisories fixed
8
new
65
fixes

Before you upgrade

Tick each one off as you go
  • breaking11.0.0
  • breaking11.0.0
  • breaking11.0.0
  • breaking11.0.0
  • breaking11.0.0
  • breaking11.0.0
  • breaking11.0.0
  • breaking11.0.0
  • breaking11.0.0
  • breaking11.0.0

Security

Fixes 2 advisories affecting 9.0.1

  • Prevent prototype pollution via constructor.prototype access (CVE-2026-XXXX)

    11.1.9

  • security: Follow up on CVE-2020-28477 where path: [["__proto__"], "x"] could still pollute the prototype

    9.0.6

Release by release

  1. 11.2.9

    22 Oct 20261 fix
    • fixed

      Export WritableNonArrayDraft from immer.ts so it gets picked up by type generation in builds

  2. 11.2.8

    22 Oct 20261 fix
    • fixed

      Skip patches of a draft discarded by writing its base value back

  3. 11.2.7

    21 Oct 20261 fix
    • fixed

      Snapshot array length before optimized filter callbacks

  4. 11.2.6

    21 Oct 20261 fix
    • fixed

      Avoid excessive Draft recursion for readonly arrays in recursive types

  5. 11.2.5

    21 Oct 20261 fix
    • fixed

      Draft relocated base objects at previously assigned indices in array-methods plugin (#1314) (4d37e43), closes #1255

  6. 11.2.4

    21 Oct 20261 fix
    • fixed

      Resolve the splice start index against the pre-splice length in array-methods plugin

  7. 11.2.3

    20 Oct 20261 fix
    • fixed

      Skip nested patches for children of shifted or reordered arrays

  8. 11.2.2

    20 Oct 20261 fix
    • fixed

      Export WritableNonArrayDraft type.

8 other lines we could not sort, mostly version bumps

  • Revert "prevent prototype pollution via constructor.prototype access (CVE-2026-XXXX) (#1259)" (#1271) (4d3d6ff), closes #1266 #1268 #1265

    11.1.12

  • Override array methods to avoid proxy creation while iterating and updating

    11.1.0

  • Immer is now an ESM package that can be directly imported into the browser. CJS should still work, UMD support has been removed.

    10.0.0

  • If you have any enableES5() call, don't migrate

    10.0.0

  • When using getters/ setters icmw plain objects, call useStrictShallowCopy(true) at startup

    10.0.0

  • Replace all default imports: Replace import produce from "immer" with import {produce} from "immer"

    10.0.0

  • Replace all calls to enableAllPlugins() with enablePatches(); enableMapSet(); to be more specific and smoothen future migrations.

    10.0.0

  • If any producer returned a Promise, refactor it to leverage createDraft instead. Roughly:

    10.0.0