Bump immutable from 4.0.0-rc.12 to 4.3.8

[everettbu]

Mirror of facebook/react#35959
Original author: app/dependabot

---

Bumps immutable from 4.0.0-rc.12 to 4.3.8.

Release notes

Sourced from immutable's releases.

v4.3.8

Fix Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') in immutable

v4.3.7

What's Changed

• Fix issue with slice negative of filtered sequence by @​jdeniau in immutable-js/immutable-js#2006

Full Changelog: immutable-js/immutable-js@v4.3.6...v4.3.7

v4.3.6

What's Changed

• Fix Repeat().equals(undefined) incorrectly returning true by @​butchler in immutable-js/immutable-js#1994

Internals

• change youtube image by @​jdeniau in immutable-js/immutable-js#1973
• Upgrade eslint and ignore no-constructor-return rule for actual constructors by @​jdeniau in immutable-js/immutable-js#1974
• upgrate documentation website to next 14 by @​jdeniau in immutable-js/immutable-js#1975
• start migrating to nextjs app router by @​jdeniau in immutable-js/immutable-js#1976
• upgrade next sitemap by @​jdeniau in immutable-js/immutable-js#1978

New Contributors

• @​butchler made their first contribution in immutable-js/immutable-js#1994

Full Changelog: immutable-js/immutable-js@v4.3.5...v4.3.6

v4.3.5

What's Changed

• Fix Set.fromKeys types with Map constructor in TS 5.0 by @​jdeniau in immutable-js/immutable-js#1971
• upgrade to TS 5.1 by @​jdeniau in immutable-js/immutable-js#1972
• fix dist-stats command by @​jdeniau in immutable-js/immutable-js#1964
• fix Read the Docs link on readme by @​joshding in immutable-js/immutable-js#1970

New Contributors

• @​joshding made their first contribution in immutable-js/immutable-js#1970

Full Changelog: immutable-js/immutable-js@v4.3.4...v4.3.5

4.3.4

What's Changed

• Rollback toJS type due to circular reference error by @​jdeniau in immutable-js/immutable-js#1958

Full Changelog: immutable-js/immutable-js@v4.3.3...v4.3.4

v4.3.3

What's Changed

• [typescript] manage to handle toJS circular reference. #1932 by @​jdeniau

... (truncated)

Changelog

Sourced from immutable's changelog.

Changelog

All notable changes to this project will be documented in this file.

The format is based on Keep a Changelog, and this project adheres to Semantic Versioning. Dates are formatted as YYYY-MM-DD.

Unreleased

5.1.5

• Fix Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') in immutable

5.1.4

• Migrate some files to TS by @​jdeniau in immutable-js/immutable-js#2125
  • Iterator.ts
  • PairSorting.ts
  • toJS.ts
  • Math.ts
  • Hash.ts
• Extract CollectionHelperMethods and convert to TS by @​jdeniau in immutable-js/immutable-js#2131
• Use npm trusted publishing only to avoid token stealing.

Documentation

• Fix/a11y issues by @​lyannel in immutable-js/immutable-js#2136
• Doc add Map.get signature update by @​borracciaBlu in immutable-js/immutable-js#2138
• fix(doc):minor-issues#2132 by @​JayMeDotDot in immutable-js/immutable-js#2133
• Fix algolia search by @​jdeniau in immutable-js/immutable-js#2135
• Typo in OrderedMap by @​jdeniau in immutable-js/immutable-js#2144

Internal

• chore: Sort all imports and activate eslint import rule by @​jdeniau in immutable-js/immutable-js#2119

5.1.3

TypeScript

• fix: allow readonly map entry constructor by @​septs in immutable-js/immutable-js#2123

Documentation

There has been a huge amount of changes in the documentation, mainly migrate from an autogenerated documentation from .d.ts file, to a proper documentation in markdown. The playground has been included on nearly all method examples. We added a page about browser extensions too: https://immutable-js.com/browser-extension/

Internal

... (truncated)

Commits

• 485cbe0 4.3.8
• 6ed4eb6 Merge commit from fork
• 94bcd3c fix new proto key injection
• faeb58b fix Prototype Pollution in mergeDeep, toJS, etc.
• 37ca417 release 4.3.7 (#2007)
• 23daf26 Fix issue with slice negative of filtered sequence (#2006)
• 493afba release 4.3.6 (#1997)
• be3cb9a Fix Repeat(<value>).equals(undefined) incorrectly returning true (#1994)
• d7664bf generate sitemap in path that will be deployed
• f8327b1 upgrade next sitemap (#1978)
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by [GitHub Actions](https://www.npmjs.com/~GitHub Actions), a new releaser for immutable since your current version.

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting ``@dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• ``@dependabot rebase will rebase this PR
• ``@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• ``@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• ``@dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• ``@dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• ``@dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.

[greptile-apps]

Greptile Summary

Dependabot security update bumping immutable from 4.0.0-rc.12 to 4.3.8 in react-devtools-shell. The update fixes a Prototype Pollution vulnerability in mergeDeep, toJS, and related functions, along with several bug fixes (negative slice on filtered sequences, Repeat().equals(undefined) returning true incorrectly).

• The codebase only uses Immutable.fromJS() — a stable API unchanged across these versions — so no breaking changes are expected
• The yarn.lock refresh also bumps several transitive dependencies (react-is 18→19, parse5, nwsapi, decimal.js, entities), which is typical for lockfile regeneration
• The immutable package is scoped to react-devtools-shell (a development/testing shell), limiting blast radius

Confidence Score: 4/5

• This PR is safe to merge — it's a targeted security dependency bump with no API-breaking changes for the codebase's usage patterns.
• Score of 4 reflects that this is a straightforward Dependabot security fix for a prototype pollution vulnerability. The codebase's usage of immutable is minimal (only fromJS()), and the package is scoped to the devtools shell. Docked one point because the lockfile refresh pulls in several unrelated transitive dependency bumps (notably react-is 18→19) which slightly increases risk surface, though these follow existing resolution patterns.
• No files require special attention. The yarn.lock transitive dependency bumps follow existing resolution patterns.

Important Files Changed

Filename	Overview
packages/react-devtools-shell/package.json	Bumps immutable dependency from ^4.0.0-rc.12 to ^4.3.8. The codebase only uses Immutable.fromJS(), which is a stable API unchanged across these versions. No compatibility issues.
yarn.lock	Lockfile updated for immutable 4.3.8 with several transitive dependency version bumps (decimal.js, nwsapi, parse5, react-is, entities). The react-is jump from 18.3.1 to 19.2.4 is a major version bump but follows the repo's existing resolution pattern.

_{Last reviewed commit: 0a9f764}