From 665a94d980d4b73f6874c6abcdaffdce950dd4e9 Mon Sep 17 00:00:00 2001 From: prabhakar Date: Fri, 24 Apr 2026 13:23:28 +0530 Subject: [PATCH] OCPBUGS-79460: immutable bump Bump immutable from 3.8.2 to 3.8.3 to address prototype pollution vulnerability via mergeDeep, merge, toJS, toObject (CVE-2026-29063). --- web/package-lock.json | 8 ++++---- web/package.json | 2 +- 2 files changed, 5 insertions(+), 5 deletions(-) diff --git a/web/package-lock.json b/web/package-lock.json index ac4812db..59ed3721 100644 --- a/web/package-lock.json +++ b/web/package-lock.json @@ -67,7 +67,7 @@ "i18next": "^21.8.14", "i18next-http-backend": "^2.2.0", "immer": "^10.1.3", - "immutable": "3.x", + "immutable": "^3.8.3", "js-yaml": "^4.1.0", "lodash-es": "^4.17.21", "lru-cache": "^6.0.0", @@ -16071,9 +16071,9 @@ } }, "node_modules/immutable": { - "version": "3.8.2", - "resolved": "https://registry.npmjs.org/immutable/-/immutable-3.8.2.tgz", - "integrity": "sha512-15gZoQ38eYjEjxkorfbcgBKBL6R7T459OuK+CpcWt7O3KF4uPCx2tD0uFETlUDIyo+1789crbMhTvQBSR5yBMg==", + "version": "3.8.3", + "resolved": "https://registry.npmjs.org/immutable/-/immutable-3.8.3.tgz", + "integrity": "sha512-AUY/VyX0E5XlibOmWt10uabJzam1zlYjwiEgQSDc5+UIkFNaF9WM0JxXKaNMGf+F/ffUF+7kRKXM9A7C0xXqMg==", "license": "MIT", "engines": { "node": ">=0.10.0" diff --git a/web/package.json b/web/package.json index 7893f276..57b548b9 100644 --- a/web/package.json +++ b/web/package.json @@ -103,7 +103,7 @@ "i18next": "^21.8.14", "i18next-http-backend": "^2.2.0", "immer": "^10.1.3", - "immutable": "3.x", + "immutable": "^3.8.3", "js-yaml": "^4.1.0", "lodash-es": "^4.17.21", "lru-cache": "^6.0.0",