What NPM CLI command can be used to update a dependency of a dependency?

Part 1

Consider this part an academic answer only. Do not use in real life projects.

To strictly answer your question:

What is the CLI command to update the older immer dependency?

You can use npm shrinkwrap to manage nested dependencies manually:

npm shrinkwrap

This will rename package-lock.json to npm-shrinkwrap.json. They are the same, except npm-shrinkwrap.json can be manually edited to set the dependency version. In this case, find "immer": "8.0.1" in the shrinkwrap file and update it to your desired version:

  "node_modules/react-dev-utils": {
  "version": "11.0.4",
  "resolved": "https://registry.npmjs.org/react-dev-utils/-/react-dev-utils-11.0.4.tgz",
  "integrity": "sha512-...",
  "dependencies": {
    ...
    "immer": "8.0.1", <== Change this to "9.0.6"

then remove this block to allow npm to use the updated version:

  "node_modules/react-dev-utils/node_modules/immer": {
    "version": "8.0.1",
    "resolved": "https://registry.npmjs.org/immer/-/immer-8.0.1.tgz",
    "integrity": "sha512-...",
    "funding": {
      "type": "opencollective",
      "url": "https://opencollective.com/immer"
    }
  },

Afterwards you can run npm i and then check your dependencies:

$ npm i
$ npm list immer

playground@1.0.0 /private/tmp/playground
├─┬ aws-amplify@4.3.2
│ └─┬ @aws-amplify/datastore@3.4.8
│   └── immer@9.0.6
└─┬ react-scripts@4.0.3
  └─┬ react-dev-utils@11.0.4
    └── immer@9.0.6 deduped

Keep in mind that upgrading nested dependencies manually may result in undesirable effects. In this case upgrading immer that is used by react-dev-utils to 9.0.6 could break part of react-dev-utils functionality because immer@9.0.9 is a major version ahead of 8.0.1. Major versions can include backwards incompatible changes.

You might end up breaking part of your tools due to a vulnerability that does not impact you at all; and checking for the exact usage of immer in react-dev-utils and making sure the usage is compatible with 9.0.6 could be quite time consuming.

Part 2

This is an attempt to solve the problem without answering your question

To address the problem:

The older version of immer has a critical vulnerability.

Not all vulnerabilities impact your end users. This particular vulnerability was reported on create-react-app and was classified as a "development only" issue which does not impact the users because it will not be in the code that runs on their browsers.

More info on this is available on another issue on create-react-app.

My usual steps to address vulnerabilities:

1. Upgrade all dependencies to latest stable versions if possible
2. If the vulnerability persists, read the advisory page to understand if it impacts me. npm audit provides the details. Keep in mind that vulnerabilities in development tools are not necessarily a problem for users.
3. Visit the npm page of the top-level dependency, go to its issue tracker and report it if it hasn't been reported
4. If the project accepts contributions and the fix is fairly simple, open a pull request and offer to help.
5. Last resort: downgrade, upgrade nested dependency to a breaking version, replace the package if it is not maintained

In this case, maintainers of create-react-app have seen and advised this is a false positive in the context of a build tool.

I think you can use npm i. If this doesn't work you could delete the node modules folder and type npm i