Skip to content

Bump immutable to ^4.3.8 - #2113

Open
shakyShane wants to merge 8 commits into
masterfrom
chore/immutable-4.3.8
Open

Bump immutable to ^4.3.8#2113
shakyShane wants to merge 8 commits into
masterfrom
chore/immutable-4.3.8

Conversation

@shakyShane

@shakyShane shakyShane commented May 9, 2026

Copy link
Copy Markdown
Contributor

Fixes #2111

Immutable 4 + mergeDeep/plain collection handling; TLS opts avoid fromJS on Buffers.

shakyShane and others added 8 commits May 9, 2026 08:22
Co-authored-by: Cursor <cursoragent@cursor.com>
Co-authored-by: Cursor <cursoragent@cursor.com>
Co-authored-by: Cursor <cursoragent@cursor.com>
…Deep)

Coerce proxy config through Map/fromJS like other transforms.

Co-authored-by: Cursor <cursoragent@cursor.com>
Co-authored-by: Cursor <cursoragent@cursor.com>
Co-authored-by: Cursor <cursoragent@cursor.com>
Node 26 loads yargs as ESM; yargs 16 shim used require() and broke lerna bootstrap.

Co-authored-by: Cursor <cursoragent@cursor.com>
Co-authored-by: Cursor <cursoragent@cursor.com>
@FeBe95

FeBe95 commented Jul 22, 2026

Copy link
Copy Markdown

FYI, there are two new unpatched CVEs with "high" severity in immutable version 3.x, which this PR would solve.

  • Immutable.js List 32-bit trie overflow → unrecoverable DoS - GHSA-v56q-mh7h-f735
  • Immutabl: Hash-collision algorithmic complexity denial of service in Immutable.Map/Set - GHSA-xvcm-6775-5m9r

@Levdbas

Levdbas commented Jul 31, 2026

Copy link
Copy Markdown

Hey @shakyShane , any idea on when we can expect this to be merged and have a new release, hopefully with the vulnerabilities fixed that @FeBe95 mentioned as well?

@tstackhouse

Copy link
Copy Markdown

This PR has been open for 4 months, any chance of it landing soon?

@36degrees

Copy link
Copy Markdown

Note that Immutable have since backported fixes for both of these CVEs to v3.8.4, which means they can be resolved without needing to update browser-sync. However for reasons the advisory database isn't up to date and still shows there as being no fix for 3.x.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Immutable used by browser-sync is vulnerable to Prototype Pollution

5 participants