fix: Bump immutable from 5.1.5 to 5.1.9

[mtrezza]

Pull Request

• Report security issues confidentially.
• Any contribution is under this license.

Issue

Closes #3425

Fixes the high-severity Dependabot alerts for immutable (vulnerable >= 5.0.0-beta.1, < 5.1.8, patched in 5.1.8):

• GHSA-v56q-mh7h-f735: Immutable.js List 32-bit trie overflow causing an unrecoverable DoS
• GHSA-xvcm-6775-5m9r: Hash-collision algorithmic complexity DoS in Immutable.Map/Set

immutable is a direct production dependency of the dashboard.

Approach

Bumps immutable from 5.1.5 to 5.1.9, pinned exactly in package.json. The lock file has a single node_modules/immutable entry, which the dev dependency sass (^5.1.5) also resolves to.

Changes

• 5.1.6: Fixed reverse() iteration reading the wrong size (fix(reverseFactory): read reversedSequence.size in __iterator instead of this immutable-js/immutable-js#2196)
• 5.1.7: Repeat.lastIndexOf now returns size - 1 instead of size (fix(Repeat): lastIndexOf returned size instead of size - 1 immutable-js/immutable-js#2227); has(index) on a lazy Seq of unknown size now checks index existence instead of searching for a value equal to the index (fix(IndexedCollection): has(index) on a lazy Seq of unknown size now checks index existence instead of searching for a value equal to the index immutable-js/immutable-js#2203)
• 5.1.8: Security fixes. List now throws a RangeError when bounds exceed 2^30 values instead of overflowing the 32-bit trie (GHSA-v56q-mh7h-f735). Map builds a seeded secondary index for large hash-collision buckets (16 or more colliding keys) for faster lookups (GHSA-xvcm-6775-5m9r)
• 5.1.9: List preserves undefined values when grown past 32 elements (fix(List): preserve undefined values when grown past 32 elements immutable-js/immutable-js#2235)

Breaking Changes

None

Code Changes Required

None. The upgrade is a drop-in replacement. The dashboard uses Map, List and fromJS with standard operations, and registers immutable-devtools, which only reads Record internals. It does not use Repeat, Seq or reverse() on Immutable collections. The new List size limit and the Map collision index only affect pathological inputs.

Tasks

None. This PR changes the manifest and lock file only. Existing tests already exercise immutable: Config.tableData.test.js uses a real Map, BrowserCell.test.js loads a component that uses List/Map, and the e2e tests boot the full dashboard bundle.

Summary by CodeRabbit

• Chores
  • Updated the immutable package from version 5.1.5 to 5.1.9.

[parse-github-assistant]

🚀 Thanks for opening this pull request! We appreciate your effort in improving the project. Please let us know once your pull request is ready for review.

Tip

• Keep pull requests small. Large PRs will be rejected. Break complex features into smaller, incremental PRs.
• Use Test Driven Development. Write failing tests before implementing functionality. Ensure tests pass.
• Group code into logical blocks. Add a short comment before each block to explain its purpose.
• We offer conceptual guidance. Coding is up to you. PRs must be merge-ready for human review.
• Our review focuses on concept, not quality. PRs with code issues will be rejected. Use an AI agent.
• Human review time is precious. Avoid review ping-pong. Inspect and test your AI-generated code.

Note

Please respond to review comments from AI agents just like you would to comments from a human reviewer. Let the reviewer resolve their own comments, unless they have reviewed and accepted your commit, or agreed with your explanation for why the feedback was incorrect.

Caution

Pull requests must be written using an AI agent with human supervision. Pull requests written entirely by a human will likely be rejected, because of lower code quality, higher review effort and the higher risk of introducing bugs. Please note that AI review comments on this pull request alone do not satisfy this requirement. Our CI and AI review are safeguards, not development tools. If many issues are flagged, rethink your development approach. Invest more effort in planning and design rather than using review cycles to fix low-quality code.

[coderabbitai]

Navigate logical layers of code changes, visualize relationships, and explore their blast radius.

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Essentials

Run ID: f54041f8-4cf1-455b-aa95-c24494949676

📥 Commits

Reviewing files that changed from the base of the PR and between 5e9f4b4 and 2b5cf44.

📒 Files selected for processing (2)

• package-lock.json
• package.json

Included review availability: Your plan provides up to 8 included reviews per hour; 7 remain after this review.

---

📝 Walkthrough

Walkthrough

The project updates its immutable dependency from version 5.1.5 to 5.1.9. The lockfile records the corresponding package URL and integrity hash.

Changes

Immutable dependency update

Layer / File(s)	Summary
Update immutable version package.json, package-lock.json	The dependency declaration and lockfile entry update immutable to version 5.1.9. The lockfile also updates the resolved URL and integrity hash.

Priority: ⬆️ High

Estimated code review effort: 1 (Trivial) | ~4 minutes

Merge Risk: ⚪ Minimal · up to 2b5cf

The dependency declaration and lockfile agree on version 5.1.9, with no identified merge-blocking issue.

---

Important

Pre-merge checks failed

Please resolve all errors before merging. Addressing warnings is optional.

❌ Failed checks (1 inconclusive)

Check name	Status	Explanation	Resolution
Engage In Review Feedback	❓ Inconclusive	The supplied review result reports zero actionable findings for the current review. The reviewed range contains only the immutable version and lockfile update. However, the supplied result explicitl…	Provide the complete history of review feedback for this pull request. For every earlier feedback comment, show prior discussion and either the implementing commit or the reviewer’s retraction/acceptance of the author’s position.

✅ Passed checks (6 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title begins with the required fix: prefix and uses an uppercase first letter in the change description. It accurately describes the dependency update.
Description check	✅ Passed	The description includes all required template sections. It clearly explains the issue, approach, dependency changes, security fixes, breaking changes, and testing context.
Linked Issues check	✅ Passed	Issue #3425 requires immutable 5.1.5 to 5.1.9 and the listed upstream fixes. package.json now pins immutable to 5.1.9. package-lock.json records version 5.1.9, its registry URL, and its in…
Out of Scope Changes check	✅ Passed	The whole pull request changes only the immutable declaration in package.json and the matching lockfile entry in package-lock.json. These changes directly implement issue #3425. No unrelated sou…
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Security Check	✅ Passed	PASS: The pull request changes only dependency metadata. It upgrades the direct immutable dependency from 5.1.5 to the patched 5.1.9, and the lockfile contains one matching `node_modules/immutab…

Full details: Engage In Review Feedback

Explanation

The supplied review result reports zero actionable findings for the current review. The reviewed range contains only the immutable version and lockfile update. However, the supplied result explicitly does not establish whether earlier review comments exist or whether those comments were addressed through discussion, implementation, or retraction. The repository contains no review-comment record that resolves this gap.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create a new PR

---

_{Comment @coderabbitai help to get the list of available commands.}

[parseplatformorg]

🎉 This change has been released in version 9.3.0-alpha.7