This is an automated email from the ASF dual-hosted git repository.
github-merge-queue[bot] pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/texera.git
The following commit(s) were added to refs/heads/main by this push:
new b6abb0790d fix(deps, frontend): bump immutable from 4.3.8 to 4.3.9 in
/frontend (#6843)
b6abb0790d is described below
commit b6abb0790dca9dcf729f4d958c22ebc52fdd8f51
Author: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
AuthorDate: Thu Jul 23 21:28:20 2026 -0700
fix(deps, frontend): bump immutable from 4.3.8 to 4.3.9 in /frontend (#6843)
Bumps [immutable](https://github.com/immutable-js/immutable-js) from
4.3.8 to 4.3.9.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/immutable-js/immutable-js/releases";>immutable's
releases</a>.</em></p>
<blockquote>
<h2>v4.3.9</h2>
<h1>What's changed</h1>
<ul>
<li>fix(List): guard oversized bounds in setListBounds. Fixes CVE <a
href="https://github.com/immutable-js/immutable-js/security/advisories/GHSA-v56q-mh7h-f735";>https://github.com/immutable-js/immutable-js/security/advisories/GHSA-v56q-mh7h-f735</a></li>
<li>perf(Map): index large hash-collision buckets for faster lookups.
Fixes CVE <a
href="https://github.com/immutable-js/immutable-js/security/advisories/GHSA-xvcm-6775-5m9r";>https://github.com/immutable-js/immutable-js/security/advisories/GHSA-xvcm-6775-5m9r</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/immutable-js/immutable-js/compare/v4.3.8...v4.3.9";>https://github.com/immutable-js/immutable-js/compare/v4.3.8...v4.3.9</a></p>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/immutable-js/immutable-js/blob/main/CHANGELOG.md";>immutable's
changelog</a>.</em></p>
<blockquote>
<h2>4.3.9</h2>
<ul>
<li>fix(List): guard oversized bounds in setListBounds. Fixes CVE <a
href="https://github.com/immutable-js/immutable-js/security/advisories/GHSA-v56q-mh7h-f735";>https://github.com/immutable-js/immutable-js/security/advisories/GHSA-v56q-mh7h-f735</a></li>
<li>perf(Map): index large hash-collision buckets for faster lookups.
Fixes CVE <a
href="https://github.com/immutable-js/immutable-js/security/advisories/GHSA-xvcm-6775-5m9r";>https://github.com/immutable-js/immutable-js/security/advisories/GHSA-xvcm-6775-5m9r</a></li>
</ul>
<h2>5.1.7</h2>
<ul>
<li>fix(Repeat): lastIndexOf returned size instead of size - 1 by <a
href="https://github.com/chatman-media";><code>@chatman-media</code></a>
in <a
href="https://redirect.github.com/immutable-js/immutable-js/pull/2227";>immutable-js/immutable-js#2227</a>.
Fixes CVE <a
href="https://github.com/immutable-js/immutable-js/security/advisories/GHSA-wf6x-7x77-mvgw";>CVE-2026-29063
</a></li>
<li>fix(IndexedCollection): <code>has(index)</code> on a lazy
<code>Seq</code> of unknown size now checks index existence instead of
searching for a value equal to the index <a
href="https://redirect.github.com/immutable-js/immutable-js/pull/2203";>#2203</a></li>
<li>[TypeScript]: <code>reduce</code>/<code>reduceRight</code> without
an initial value now infer the result type from the collection's values
when the reducer returns a value (e.g. <code>list.reduce((a, b) => a
+ b)</code> infers <code>number</code>), matching
<code>Array#reduce</code>. Previously an explicit type argument was
required. <a
href="https://redirect.github.com/immutable-js/immutable-js/pull/2205";>#2205</a></li>
</ul>
<h2>5.1.6</h2>
<ul>
<li>fix(reverseFactory): read <code>reversedSequence.size</code> in
<code>__iterator</code> instead of this <a
href="https://redirect.github.com/immutable-js/immutable-js/pull/2196";>#2196</a></li>
</ul>
<h2>5.1.5</h2>
<ul>
<li>Fix Improperly Controlled Modification of Object Prototype
Attributes ('Prototype Pollution') in immutable</li>
</ul>
<h2>5.1.4</h2>
<ul>
<li>Migrate some files to TS by <a
href="https://github.com/jdeniau";><code>@jdeniau</code></a> in <a
href="https://redirect.github.com/immutable-js/immutable-js/pull/2125";>immutable-js/immutable-js#2125</a>
<ul>
<li>Iterator.ts</li>
<li>PairSorting.ts</li>
<li>toJS.ts</li>
<li>Math.ts</li>
<li>Hash.ts</li>
</ul>
</li>
<li>Extract CollectionHelperMethods and convert to TS by <a
href="https://github.com/jdeniau";><code>@jdeniau</code></a> in <a
href="https://redirect.github.com/immutable-js/immutable-js/pull/2131";>immutable-js/immutable-js#2131</a></li>
<li>Use npm <a href="https://docs.npmjs.com/trusted-publishers";>trusted
publishing only</a> to avoid token stealing.</li>
</ul>
<h3>Documentation</h3>
<ul>
<li>Fix/a11y issues by <a
href="https://github.com/lyannel";><code>@lyannel</code></a> in <a
href="https://redirect.github.com/immutable-js/immutable-js/pull/2136";>immutable-js/immutable-js#2136</a></li>
<li>Doc add Map.get signature update by <a
href="https://github.com/borracciaBlu";><code>@borracciaBlu</code></a>
in <a
href="https://redirect.github.com/immutable-js/immutable-js/pull/2138";>immutable-js/immutable-js#2138</a></li>
<li>fix(doc):minor-issues#2132 by <a
href="https://github.com/JayMeDotDot";><code>@JayMeDotDot</code></a> in
<a
href="https://redirect.github.com/immutable-js/immutable-js/pull/2133";>immutable-js/immutable-js#2133</a></li>
<li>Fix algolia search by <a
href="https://github.com/jdeniau";><code>@jdeniau</code></a> in <a
href="https://redirect.github.com/immutable-js/immutable-js/pull/2135";>immutable-js/immutable-js#2135</a></li>
<li>Typo in OrderedMap by <a
href="https://github.com/jdeniau";><code>@jdeniau</code></a> in <a
href="https://redirect.github.com/immutable-js/immutable-js/pull/2144";>immutable-js/immutable-js#2144</a></li>
</ul>
<h3>Internal</h3>
<ul>
<li>chore: Sort all imports and activate eslint import rule by <a
href="https://github.com/jdeniau";><code>@jdeniau</code></a> in <a
href="https://redirect.github.com/immutable-js/immutable-js/pull/2119";>immutable-js/immutable-js#2119</a></li>
</ul>
<h2>5.1.3</h2>
<h3>TypeScript</h3>
<ul>
<li>fix: allow readonly map entry constructor by <a
href="https://github.com/septs";><code>@septs</code></a> in <a
href="https://redirect.github.com/immutable-js/immutable-js/pull/2123";>immutable-js/immutable-js#2123</a></li>
</ul>
<h3>Documentation</h3>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/immutable-js/immutable-js/commit/5da7919616a015cc03173f8f0bd3ee7101ab27f2";><code>5da7919</code></a>
4.3.9</li>
<li><a
href="https://github.com/immutable-js/immutable-js/commit/794a1a9148e2af3b4d282047917e1e0c11b774bc";><code>794a1a9</code></a>
Merge commit from fork</li>
<li><a
href="https://github.com/immutable-js/immutable-js/commit/3dd7e5655012597a41873e328bf9142a8901527b";><code>3dd7e56</code></a>
perf(Map): index large hash-collision buckets for faster lookups</li>
<li><a
href="https://github.com/immutable-js/immutable-js/commit/62d0b58553813d86987009bd106aa56e0c4459c5";><code>62d0b58</code></a>
fix ts in tests</li>
<li><a
href="https://github.com/immutable-js/immutable-js/commit/8c0e5f806494cebb4fd75bcbf5846963c866ef5b";><code>8c0e5f8</code></a>
Merge commit from fork</li>
<li><a
href="https://github.com/immutable-js/immutable-js/commit/f0bc997d8eb9886aff2236635aa210a95a04304a";><code>f0bc997</code></a>
Merge commit from fork</li>
<li><a
href="https://github.com/immutable-js/immutable-js/commit/8ac83f4eba62469e284881728aa636a1e786f87e";><code>8ac83f4</code></a>
change tag</li>
<li><a
href="https://github.com/immutable-js/immutable-js/commit/f7373e5e9e04aa7049b5991d5623eec272e3c06a";><code>f7373e5</code></a>
use id-token to deploy 4.x version</li>
<li><a
href="https://github.com/immutable-js/immutable-js/commit/2f545ad3f3eecae40c1f732c8cb8b7faab22493a";><code>2f545ad</code></a>
changelog</li>
<li>See full diff in <a
href="https://github.com/immutable-js/immutable-js/compare/v4.3.8...v4.3.9";>compare
view</a></li>
</ul>
</details>
<br />
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
You can disable automated security fix PRs for this repo from the
[Security Alerts page](https://github.com/apache/texera/network/alerts).
</details>
Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: dependabot[bot]
<49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Xinyuan Lin <[email protected]>
---
frontend/yarn.lock | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
diff --git a/frontend/yarn.lock b/frontend/yarn.lock
index a2c28abd34..5f0d316839 100644
--- a/frontend/yarn.lock
+++ b/frontend/yarn.lock
@@ -11448,9 +11448,9 @@ __metadata:
linkType: hard
"immutable@npm:^4.0.0":
- version: 4.3.8
- resolution: "immutable@npm:4.3.8"
- checksum:
10c0/3de58996305a0faf6ef3fc0685f996c42653ad757760214f5aec7d4a6b59ea7abb882522c5f9a61776fae88c0b45e08eb77cbded5a4f57745ec7c63f9642e44b
+ version: 4.3.9
+ resolution: "immutable@npm:4.3.9"
+ checksum:
10c0/394faa90ac8f2f62824e6c639705efdb8313787d6bc7864e28a48ee36aa2ba4b724eaf54a701ad991c278967a412b09143dd24fd19e3e2b0204eb481a5afa6ef
languageName: node
linkType: hard
