immerjs / immer

46%

LAST BUILD ON BRANCH main

branch: main

CHANGE BRANCH

x

Reset

Sync Branches

• main
• add-deno-install
• agent/add-zh-cn-array-methods-docs
• defer-type-inference
• dependabot/npm_and_yarn/babel/core-7.29.6
• dependabot/npm_and_yarn/baseline-browser-mapping-2.11.22
• dependabot/npm_and_yarn/handlebars-4.7.9
• dependabot/npm_and_yarn/immutable-3.8.3
• dependabot/npm_and_yarn/immutable-4.3.8
• dependabot/npm_and_yarn/immutable-4.3.9
• dependabot/npm_and_yarn/ip-address-10.4.0
• dependabot/npm_and_yarn/ip-address-10.7.2
• dependabot/npm_and_yarn/lodash-4.18.1
• dependabot/npm_and_yarn/nanoid-3.3.18
• dependabot/npm_and_yarn/picomatch-2.3.2
• dependabot/npm_and_yarn/shell-quote-1.10.0
• dependabot/npm_and_yarn/shell-quote-1.8.4
• dependabot/npm_and_yarn/sigstore-4.1.1
• dependabot/npm_and_yarn/sigstore/core-3.2.1
• dependabot/npm_and_yarn/sigstore/verify-3.1.1
• dependabot/npm_and_yarn/tar-7.5.16
• dependabot/npm_and_yarn/tar-7.5.22
• dependabot/npm_and_yarn/vite-6.4.2
• dependabot/npm_and_yarn/vite-6.4.3
• dependabot/npm_and_yarn/vitest-3.2.6
• dependabot/npm_and_yarn/website/babel/plugin-transform-modules-systemjs-7.29.4
• dependabot/npm_and_yarn/website/baseline-browser-mapping-2.11.21
• dependabot/npm_and_yarn/website/brace-expansion-1.1.14
• dependabot/npm_and_yarn/website/brace-expansion-1.1.18
• dependabot/npm_and_yarn/website/browserslist-4.28.8
• dependabot/npm_and_yarn/website/colord-2.10.0
• dependabot/npm_and_yarn/website/fast-uri-3.1.2
• dependabot/npm_and_yarn/website/fast-uri-3.1.4
• dependabot/npm_and_yarn/website/fast-uri-3.1.5
• dependabot/npm_and_yarn/website/fast-uri-3.1.7
• dependabot/npm_and_yarn/website/fast-uri-3.1.8
• dependabot/npm_and_yarn/website/follow-redirects-1.16.0
• dependabot/npm_and_yarn/website/http-proxy-middleware-2.0.10
• dependabot/npm_and_yarn/website/joi-17.13.4
• dependabot/npm_and_yarn/website/joi-17.13.7
• dependabot/npm_and_yarn/website/lodash-4.18.1
• dependabot/npm_and_yarn/website/nanoid-3.3.18
• dependabot/npm_and_yarn/website/node-forge-1.4.0
• dependabot/npm_and_yarn/website/picomatch-2.3.2
• dependabot/npm_and_yarn/website/postcss-8.5.13
• dependabot/npm_and_yarn/website/postcss-8.5.25
• dependabot/npm_and_yarn/website/shell-quote-1.8.4
• dependabot/npm_and_yarn/website/svgo-2.8.2
• dependabot/npm_and_yarn/website/svgo-2.8.3
• dependabot/npm_and_yarn/website/svgo-2.8.4
• dependabot/npm_and_yarn/website/websocket-driver-0.7.5
• dependabot/npm_and_yarn/website/yaml-1.10.3
• docs/custom-produce-function
• feature/harden-publishing-2026-05
• fix-inherited-value-assignment
• fix-prototype-vulnerability
• fix/858-reassign-to-same-non-primitive
• fix/896-typings-current-draft
• fix/apply-patches-null-path-traversal
• fix/array-methods-assigned-index-key
• fix/array-methods-noop-structural-sharing
• fix/array-methods-splice-start-index
• fix/array-methods-thisarg
• fix/array-reorder-base-mutation
• fix/assert-unrevoked-on-map-set-draft-reads
• fix/circular-refs-stack-1106
• fix/docs-useimmer-todo-done-1011
• fix/preserve-map-keys
• fix/prototype-undefined-not-stored-as-own-prop
• fix/rfc6902-patch-path-docs
• fix/spurious-remove-patch-on-base-value-writeback
• fix/ts2403-global-iterator-decl
• patch-1
• prototype-inspection-tests
• refs/pull/1239/merge
• refs/pull/1279/merge
• refs/pull/1281/merge
• revert-prototype-fix
• zh-cn-api-overview-sync
• zh-cn-installation-sync

Build # 37046988754

Build Type

push

github

Committed by web-flow

Commit Message

fix: throw on reads of a revoked Map or Set draft (#1298)

Once produce or finishDraft returns, the draft is revoked and any further
use is meant to fail loudly. Object and array drafts get that from
Proxy.revocable, but Map and Set drafts are subclasses guarded by a manual
revoked_ flag, and several read paths never checked it:

  const map = new Map([["a", 1]])
  let draft
  produce({map}, d => {
    draft = d.map
  })
  draft.has("a")      // true, should throw
  draft.size          // 1, should throw
  [...draft.keys()]   // ["a"], should throw
  draft.get("a")      // throws, as expected

DraftSet.has already calls assertUnrevoked, so the same read on a Set draft
throws while the Map one silently returns stale data. This is the exact
async-leak case error 3 is meant to catch, so it should not depend on which
accessor the caller happens to use.

Add assertUnrevoked to DraftMap.has, DraftMap.size, DraftMap.keys,
DraftMap.forEach and DraftSet.size. DraftMap.values and DraftMap.entries
build on keys, so they now fail when they are called rather than on the
first next(). Nothing outside the plugin reads these accessors after
revocation, and the full suite is unchanged.

Coverage Stats

673 of 723 branches covered (93.08%)

Branch coverage included in aggregate %.

13 of 13 new or added lines in 1 file covered. (100.0%)

1756 of 4529 relevant lines covered (38.77%)

1892.46 hits per line