Skip to content

fix(deps): update dependency immer to v11#851

Open
ZxBot wants to merge 1 commit into
develfrom
renovate/immer-11.x
Open

fix(deps): update dependency immer to v11#851
ZxBot wants to merge 1 commit into
develfrom
renovate/immer-11.x

Conversation

@ZxBot

@ZxBot ZxBot commented Jun 16, 2026

Copy link
Copy Markdown
Contributor

This PR contains the following updates:

Package Change Age Confidence
immer 10.2.011.1.9 age confidence

Release Notes

immerjs/immer (immer)

v11.1.9

Compare Source

Bug Fixes
  • prevent prototype pollution via constructor.prototype access (CVE-2026-XXXX) (#​1259) (48fc378)

v11.1.8

Compare Source

Bug Fixes
  • update current and original typings to assert draft value is unwrapped (#​1236) (bf2d154)

v11.1.7

Compare Source

Bug Fixes
  • improve higher order type inference for WritableDraft (#​1205) (7390d6c)

v11.1.6

Compare Source

Bug Fixes

v11.1.5

Compare Source

Bug Fixes
  • handle nested proxies after spreading and inserting into an array (d3bc436)

v11.1.4

Compare Source

Bug Fixes
  • handle nested proxies after spreading and inserting into an array (90a7765)

v11.1.3

Compare Source

Bug Fixes

v11.1.2

Compare Source

Bug Fixes
  • bogus commit to retest release (c329ddb)

v11.1.0

Compare Source

This feature release adds a new optional "array method overrides" plugin that significantly speeds up array methods when accessing drafts.

Changelog

Performance Improvements

As part of the recent performance optimization work, our benchmarks showed that all Proxy-based immutable update libraries were drastically slower than vanilla JS when calling both mutating and non-mutating array methods. After investigation, it turns out that an array method like arr.filter() causes the Proxy's get trap to trigger for every single item in the array. This in turn forces creation of a new Proxy and internal Immer metadata for every item, even though this was just a read operation and no items were being updated.

This release adds a new enableArrayMethods plugin that will override draft array methods to bypass the draft and directly operate on the underlying wrapped array instance. This significantly speeds up array operations.

When enabled, the plugin overrides these array methods:

  • Mutating: push, pop, shift, unshift, splice, reverse, sort
  • Non-mutating: filter, slice, concat, flat, find, findIndex, findLast, findLastIndex, some, every, indexOf, lastIndexOf, includes, join, toString, toLocaleString

Our benchmarks show that the overridden methods (plus the other perf changes in Immer 10.2 and 11.0) are 50-80% faster than the baseline behavior of Immer 10.1.

The plugin adds about 1.5-2K minified to Immer's bundle size.

It's important to note that the plugin does change the "safe to mutate a draft" semantics of Immer. Any of these methods that receives an array item as a callback argument will not automatically wrap that item in a Proxy!. That means that if you try to mutate an argument in a method such as filter, it will actually mutate the real underlying object, which will cause bugs in your app. This is an intentional design tradeoff. Semantically, all of these methods imply read-only access to array values, so if your code tries to mutate an array item in a callback, that is a bug in your code.

Note that this does not override map, flatMap, forEach, or reduce / reduceRight. Those methods do imply either side effects and potential mutations, or returning arbitrary values. Given that, we determined it was both safest and simplest to keep their behavior as-is.

See the Array Methods Plugin docs page for further details on the behavior of the overridden methods.

What's Changed

v11.0.1

Compare Source

Bug Fixes

v11.0.0

Compare Source

Performance Improvements
  • Rewrite finalization system to use a callback approach instead of tree traversal (#​1183) (d6c1202)
BREAKING CHANGES
  • enable loose iteration by default

  • Simplify some iteration checks

  • Allow passing type to get/set utils to skip archetype lookup

  • Convert assigned_ to Map

  • Enable loose iteration

  • Replace recursive tree finalization with targeted callbacks

Ported Mutative's "finalization callback" approach as a more targeted and performant implementation for finalization compared to the existing recursive tree traversal approach:

  • Added cleanup callbacks for each draft that's created
  • Added callbacks to handle root drafts, assigned values, and recursing
    inside of plain values
  • Updated state creation to return [draft, state] to avoid a lookup
  • Rewrote patch generation system to work with callbacks instead of
    during tree traversal
  • Update self-reference test with new behavior
  • Apply code review suggestions
  • Byte-shave scopes and patch plugin usage
  • Inline finalizeAssigned
  • Move fixPotentialSetContents to plugin
  • Byte-shave typeof utils
  • Byte-shave Object references
  • Byte-shave field names and arrow functions

Configuration

📅 Schedule: (in timezone Europe/Rome)

  • Branch creation
    • "after 9am and before 6pm every weekday except after 12pm and before 2pm"
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.


  • If you want to rebase/retry this PR, check this box

This PR has been generated by Mend Renovate.

@ZxBot ZxBot added dependencies Pull requests that update a dependency file renovate labels Jun 16, 2026
@ZxBot ZxBot force-pushed the renovate/immer-11.x branch 5 times, most recently from 7d5dc21 to fb652d9 Compare June 23, 2026 01:46
@ZxBot ZxBot force-pushed the renovate/immer-11.x branch 2 times, most recently from ecbb315 to 4617d12 Compare June 26, 2026 01:05
@sonarqube-zextras

Copy link
Copy Markdown

@ZxBot ZxBot force-pushed the renovate/immer-11.x branch from 4617d12 to 47b9d2c Compare July 2, 2026 00:47
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file renovate

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant