[specter-flq]

Description

Fixing Fast-uri and immutable Vulns

Motivation and Context

Resolves BED-9036

How Has This Been Tested?

Tests Pass

Screenshots (optional):

Types of changes

• Chore (a change that does not modify the application functionality)

Checklist:

• I have met the contributing prerequisites
  • Assigned myself to this PR
  • Added the appropriate labels
  • Associated an issue: Issues and Pull Requests README #672
  • Read the Contributing guide: https://github.com/SpecterOps/BloodHound/wiki/Contributing
• I have ensured that related documentation is up-to-date
  • Open API docs
  • Code comments (GoDocs / JSDocs)
• I have followed proper test practices
  • Added/updated tests to cover my changes
  • All new and existing tests passed

Summary by CodeRabbit

• Chores
  • Updated the Immutable.js package resolution to allow compatible 4.3.9+ releases.
  • Preserved existing package identity, workspace settings, and command scripts.

[coderabbitai]

📝 Walkthrough

Walkthrough

The root package.json updates the immutable resolution from 4.3.8 to ^4.3.9. Package identity, workspaces, scripts, and other dependency settings remain unchanged.

Changes

Dependency Resolution Update

Layer / File(s)	Summary
Immutable resolution configuration package.json	Updates resolutions.immutable from the exact 4.3.8 version to the ^4.3.9 caret range while preserving the remaining package configuration.

Estimated code review effort: 1 (Trivial) | ~5 minutes

Suggested labels: javascript

Suggested reviewers: thenando

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Title check	✅ Passed	The title identifies the dependency vulnerability fix and BED-9036, matching the PR's main change.
Description check	✅ Passed	The description covers the change, linked ticket, test status, change type, and checklist, though testing details are brief.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch BED-9036--vuln-fix-main

---

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

🧹 Nitpick comments (1)

package.json (1)

43-43: 🔒 Security & Privacy | 🔵 Trivial | ⚡ Quick win

Keep the security resolution pinned to 4.3.9.

Using ^4.3.9 permits future 4.x versions to enter through later installs or lockfile refreshes. Since downstream consumers depend on Immutable’s v4 APIs, keep this remediation deterministic and review future upgrades separately. Yarn documents resolutions as a mechanism for enforcing a specific package version or backporting a fix. (yarnpkg.com)

Proposed fix

-        "immutable": "^4.3.9",
+        "immutable": "4.3.9",

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@package.json` at line 43, Update the immutable entry in the package
resolutions configuration from the caret range to the exact pinned version
4.3.9, preserving the v4 API dependency and preventing future 4.x upgrades
through installs or lockfile refreshes.

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Nitpick comments:
In `@package.json`:
- Line 43: Update the immutable entry in the package resolutions configuration
from the caret range to the exact pinned version 4.3.9, preserving the v4 API
dependency and preventing future 4.x upgrades through installs or lockfile
refreshes.

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Repository YAML (base), Organization UI (inherited)

Review profile: CHILL

Plan: Pro

Run ID: 56360766-67ab-4d84-866c-03f2c0a9105c

📥 Commits

Reviewing files that changed from the base of the PR and between 8bbfd3d and 4355172.

⛔ Files ignored due to path filters (4)

• .yarn/cache/fast-uri-npm-3.1.3-90ca1925ff-7969a50a32.zip is excluded by !**/.yarn/**, !**/*.zip
• .yarn/cache/immutable-npm-4.3.8-9db2d34fb7-27a134cec0.zip is excluded by !**/.yarn/**, !**/*.zip
• .yarn/cache/immutable-npm-4.3.9-04378617c7-bb951f0b69.zip is excluded by !**/.yarn/**, !**/*.zip
• yarn.lock is excluded by !**/yarn.lock, !**/*.lock

📒 Files selected for processing (1)

• package.json