Update dependency immutable to v4

[dev-mend-for-github-com]

This PR contains the following updates:

Package	Type	Update	Change
immutable (source)	dependencies	major	~3.7.4 → ~4.3.9

By merging this PR, the below vulnerabilities will be automatically resolved:

Severity	CVSS Score	Vulnerability
High	8.7	CVE-2026-29063
High	8.7	CVE-2026-59879
High	8.7	CVE-2026-59880

---

Release Notes

immutable-js/immutable-js (immutable)

v4.3.9

Compare Source

• fix(List): guard oversized bounds in setListBounds. Fixes CVE GHSA-v56q-mh7h-f735
• perf(Map): index large hash-collision buckets for faster lookups. Fixes CVE GHSA-xvcm-6775-5m9r

v4.3.8

Compare Source

Fix Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') in immutable

v4.3.7

Compare Source

• Fix issue with slice negative of filtered sequence #​2006 by @​jdeniau

v4.3.6

Compare Source

• Fix Repeat(<value>).equals(undefined) incorrectly returning true #​1994 by @​butchler

v4.3.5

Compare Source

• Upgrade to TS 5.1 #​1972 by @​jdeniau
• Fix Set.fromKeys types with Map constructor in TS 5.0 #​1971 by @​jdeniau
• Fix Read the Docs link on readme #​1970 by @​joshding

v4.3.4

Compare Source

• Rollback toJS type due to circular reference error #​1958 by @​jdeniau

v4.3.3

Compare Source

• [typescript] manage to handle toJS circular reference. #​1932 by @​jdeniau
• [doc] Add install instructions for pnpm and Bun #​1952 by @​colinhacks and #​1953 by @​menglingyu659

v4.3.2

Compare Source

• [TypeScript] Fix isOrderedSet type #​1948

v4.3.1

Compare Source

• Faster and implementation of some #​1944
• [internal] remove unused exports #​1928

v4.3.0

Compare Source

• Introduce Comparator and PairSorting #​1937 by @​https://github.com/giancosta86
• [TypeScript] Fix fromJS declaration for greater compatibility #​1936

v4.2.4

Compare Source

• [TypeScript] Improve type infererence for from JS by KSXGitHub #​1927

v4.2.3

Compare Source

• [TypeScript] groupBy return either a Map or an OrderedMap: make the type more precise than base Collection #​1924

v4.2.2

Compare Source

• [Flow] Add type for partition method #​1920 by Dagur

v4.2.1

Compare Source

• [Typescript] rollback some of the change on toJS to avoir circular reference

v4.2.0

Compare Source

• [TypeScript] Better type for toJS #​1917 by jdeniau
  • [TS Minor Break] tests are ran with TS > 4.5 only. It was tested with TS > 2.1 previously, but we want to level up TS types with recent features. TS 4.5 has been released more than one year before this release. If it does break your implementation (it might not), you should probably consider upgrading to the latest TS version.
• Added a partition method to all containers #​1916 by johnw42

v4.1.0

Compare Source

• Accept Symbol as Map key. #​1859 by jdeniau
• Optimize contructors without arguments #​1887 by marianoguerra
• Fix Flow removeIn types #​1902 by nifgraup
• Fix bug in Record.equals when comparing against Map #​1903 by jmtoung

v4.0.0

Compare Source

This release brings new functionality and many fixes.

1. Key changes
2. Note for users of v4.0.0-rc.12
3. Breaking changes
4. New
5. Fixed

Key changes

• New members have joined the team
• The project has been relicensed as MIT
• Better TypeScript and Flow type definitions
• A brand-new documentation lives at immutable-js.com and can show multiple versions
• Behavior of merge and mergeDeep has changed
• Iterable is renamed to Collection
• Records no longer extend from Collections
• All collection types now implement the ES6 iterable protocol
• New methods:
  • toJSON()
  • wasAltered()
  • Collection.Indexed.zipAll()
  • Map.deleteAll()

   Diff of changed API (click to expand)

+  Collection.[Symbol.iterator]
+  Collection.toJSON
+  Collection.update
+  Collection.Indexed.[Symbol.iterator]
+  Collection.Indexed.toJSON
+  Collection.Indexed.update
+  Collection.Indexed.zipAll
+  Collection.Keyed.[Symbol.iterator]
+  Collection.Keyed.toJSON
+  Collection.Keyed.update
+  Collection.Set.[Symbol.iterator]
+  Collection.Set.toJSON
+  Collection.Set.update
-  Collection.size
-  Collection.Indexed.size
-  Collection.Keyed.size
-  Collection.Set.size

+  List.[Symbol.iterator]
+  List.toJSON
+  List.wasAltered
+  List.zipAll
-  List.mergeDeep
-  List.mergeDeepWith
-  List.mergeWith

+  Map.[Symbol.iterator]
+  Map.deleteAll
+  Map.toJSON
+  Map.wasAltered

+  OrderedMap.[Symbol.iterator]
+  OrderedMap.deleteAll
+  OrderedMap.toJSON
+  OrderedMap.wasAltered
+  OrderedSet.[Symbol.iterator]
+  OrderedSet.toJSON
+  OrderedSet.update
+  OrderedSet.wasAltered
+  OrderedSet.zip
+  OrderedSet.zipAll
+  OrderedSet.zipWith

+  Record.[Symbol.iterator]
+  Record.asImmutable
+  Record.asMutable
+  Record.clear
+  Record.delete
+  Record.deleteIn
+  Record.merge
+  Record.mergeDeep
+  Record.mergeDeepIn
+  Record.mergeDeepWith
+  Record.mergeIn
+  Record.mergeWith
+  Record.set
+  Record.setIn
+  Record.toJSON
+  Record.update
+  Record.updateIn
+  Record.wasAltered
+  Record.withMutations
+  Record.Factory.displayName
-  Record.butLast
-  Record.concat
-  Record.count
-  Record.countBy
-  Record.entries
-  Record.entrySeq
-  Record.every
-  Record.filter
-  Record.filterNot
-  Record.find
-  Record.findEntry
-  Record.findKey
-  Record.findLast
-  Record.findLastEntry
-  Record.findLastKey
-  Record.first
-  Record.flatMap
-  Record.flatten
-  Record.flip
-  Record.forEach
-  Record.groupBy
-  Record.includes
-  Record.isEmpty
-  Record.isSubset
-  Record.isSuperset
-  Record.join
-  Record.keyOf
-  Record.keySeq
-  Record.keys
-  Record.last
-  Record.lastKeyOf
-  Record.map
-  Record.mapEntries
-  Record.mapKeys
-  Record.max
-  Record.maxBy
-  Record.min
-  Record.minBy
-  Record.reduce
-  Record.reduceRight
-  Record.rest
-  Record.reverse
-  Record.skip
-  Record.skipLast
-  Record.skipUntil
-  Record.skipWhile
-  Record.slice
-  Record.some
-  Record.sort
-  Record.sortBy
-  Record.take
-  Record.takeLast
-  Record.takeUntil
-  Record.takeWhile
-  Record.toArray
-  Record.toIndexedSeq
-  Record.toKeyedSeq
-  Record.toList
-  Record.toMap
-  Record.toOrderedMap
-  Record.toOrderedSet
-  Record.toSet
-  Record.toSetSeq
-  Record.toStack
-  Record.valueSeq
-  Record.values

+  Seq.[Symbol.iterator]
+  Seq.toJSON
+  Seq.update
+  Seq.Indexed.[Symbol.iterator]
+  Seq.Indexed.toJSON
+  Seq.Indexed.update
+  Seq.Indexed.zipAll
+  Seq.Keyed.[Symbol.iterator]
+  Seq.Keyed.toJSON
+  Seq.Keyed.update
+  Seq.Set.[Symbol.iterator]
+  Seq.Set.toJSON
+  Seq.Set.update

+  Set.[Symbol.iterator]
+  Set.toJSON
+  Set.update
+  Set.wasAltered

+  Stack.[Symbol.iterator]
+  Stack.toJSON
+  Stack.update
+  Stack.wasAltered
+  Stack.zipAll

+  ValueObject.equals
+  ValueObject.hashCode

-  Iterable.*
-  Iterable.Indexed.*
-  Iterable.Keyed.*
-  Iterable.Set.*

Note for users of v4.0.0-rc.12

There were mostly bugfixes and improvements since RC 12. Upgrading should be painless for most users.
However, there is one breaking change: The behavior of merge and mergeDeep has changed. See below for details.

BREAKING

merge()

• No longer use value-equality within merge() (#​1391)

  This rectifies an inconsistent behavior between x.merge(y) and x.mergeDeep(y) where merge would
  use === on leaf values to determine return-self optimizations, while mergeDeep would use is().
  This improves consistency across the library and avoids a possible performance pitfall.

• No longer deeply coerce argument to merge() (#​1339)

  Previously, the argument provided to merge() was deeply converted to Immutable collections via fromJS().
  This was the only function in the library which calls fromJS() indirectly,
  and it was surprising and made it difficult to understand what the result of merge() would be.
  Now, the value provided to merge() is only shallowly converted to an Immutable collection, similar to
  related methods in the library. This may change the behavior of your calls to merge().

mergeDeep()

• Replace incompatible collections when merging nested data (#​1840)

  It will no longer merge lists of tuples into maps. For more information see
  #​1840 and the updated mergeDeep() documentation.

• Concat Lists when merging deeply (#​1344)

  Previously, calling map.mergeDeep() with a value containing a List would replace the values in the
  original List. This has always been confusing, and does not properly treat List as a monoid.
  Now, List.merge is simply an alias for List.concat, and map.mergeDeep() will concatenate deeply-found lists
  instead of replacing them.

Seq

• Remove IteratorSequence. Do not attempt to detect iterators in Seq(). (#​1589)

  Iterables can still be provided to Seq(), and most Iterators are also
  Iterables, so this change should not affect the vast majority of uses.
  For more information, see PR #​1589

• Remove Seq.of() (#​1311, #​1310)

  This method has been removed since it cannot be correctly typed. It's recommended to convert
  Seq.of(1, 2, 3) to Seq([1, 2, 3]).

isImmutable()

• isImmutable() now returns true for collections currently within a withMutations() call. (#​1374)

  Previously, isImmutable() did double-duty of both determining if a value was a Collection or Record
  from this library as well as if it was outside a withMutations() call.
  This latter case caused confusion and was rarely used.

toArray()

• KeyedCollection.toArray() returns array of tuples. (#​1340)

  Previously, calling toArray() on a keyed collection (incl Map and OrderedMap) would
  discard keys and return an Array of values. This has always been confusing, and differs from Array.from().
  Now, calling toArray() on a keyed collection will return an Array of [key, value] tuples, matching
  the behavior of Array.from().

concat()

• list.concat() now has a slightly more efficient implementation and map.concat() is an alias for map.merge(). (#​1373)

  In rare cases, this may affect use of map.concat() which expected slightly different behavior from map.merge().

Collection, formerly Iterable

• The Iterable class has been renamed to Collection, and isIterable() has been renamed to isCollection().
  Aliases with the existing names exist to make transitioning code easier.

Record

• Record is no longer an Immutable Collection type.
  • Now isCollection(myRecord) returns false instead of true.
  • The sequence API (such as map, filter, forEach) no longer exist on Records.
  • delete() and clear() no longer exist on Records.

Other breaking changes

• Potentially Breaking: Improve hash speed and avoid collision for common values (#​1629)

  Causes some hash values to change, which could impact the order of iteration of values in some Maps
  (which are already advertised as unordered, but highlighting just to be safe)

• Node buffers no longer considered value-equal (#​1437)

• Plain Objects and Arrays are no longer considered opaque values (#​1369)

  This changes the behavior of a few common methods with respect to plain Objects and Arrays where these were
  previously considered opaque to merge() and setIn(), they now are treated as collections and can be merged
  into and updated (persistently). This offers an exciting alternative to small Lists and Records.

• The "predicate" functions, isCollection, isKeyed, isIndexed, isAssociative have been moved from Iterable. to the top level exports.

• The toJSON() method performs a shallow conversion (previously it was an alias for toJS(), which remains a deep conversion).

• Some minor implementation details have changed, which may require updates to libraries which deeply integrate with Immutable.js's private APIs.

• The Cursor API is officially deprecated. Use immutable-cursor instead.

• Potentially Breaking: [TypeScript] Remove Iterable<T> as tuple from Map constructor types (#​1626)

  Typescript allowed constructing a Map with a list of List instances, assuming each was a key, value pair.
  While this runtime behavior still works, this type led to more issues than it solved, so it has been removed.
  (Note, this may break previous v4 rcs, but is not a change against v3)

New

• Update TypeScript and Flow definitions:
  • The Flowtype and TypeScript type definitions have been completely rewritten with much higher quality and accuracy,
    taking advantage of the latest features from both tools.
  • Simplified TypeScript definition files to support all UMD use cases (#​1854)
  • Support Typescript 3 (#​1593)
  • Support Typescript strictNullChecks (#​1168)
  • Flow types to be compatible with the latest version 0.160.0
  • Enable flow strict (#​1580)

• Add "sideEffects: false" to package.json (#​1661)

• Use ES standard for iterator method reuse (#​1867)

• Generalize fromJS() and Seq() to support Sets (#​1865)

• Top level predicate functions (#​1600)

  New functions are exported from the immutable module:
  isSeq(), isList(), isMap(), isOrderedMap(), isStack(), isSet(), isOrderedSet(), and isRecord().

• Improve performance of toJS (#​1581)

  Cursory test is >10% faster than both v3.8.2 and v4.0.0-rc.7,
  and corrects the regression since v4.0.0-rc.9.

• Added optional notSetValue in first() and last() (#​1556)

• Make isArrayLike check more precise to avoid false positives (#​1520)

• map() for List, Map, and Set returns itself for no-ops (#​1455) (5726bd1)

• Hash functions as objects, allowing functions as values in collections (#​1485)

• Functional API for get(), set(), and more which support both Immutable.js collections and plain Objects and Arrays (#​1369)

• Relicensed as MIT (#​1320)

• Support for Transducers! (ee9c68f1)

• Add new method, zipAll() (#​1195)

• Bundle and distribute an "es module" so Webpack and Rollup can use tree-shaking for smaller builds (#​1204)

• Warn instead of throw when getIn() has a bad path (668f2236)

• A new predicate function isValueObject() helps to detect objects which implement equals() and hashCode(),
  and type definitions now define the interface ValueObject which you can implement in your own code to create objects which
  behave as values and can be keys in Maps or entries in Sets.

• Using fromJS() with a "reviver" function now provides access to the key path to each translated value. (#​1118)

Fixed

• Fix issue with IE11 and missing Symbol.iterator (#​1850)

• Fix ordered set with map (#​1663)

• Do not modify iter during List.map and Map.map (#​1649)

• Fix ordered map delete all (#​1777)

• Hash symbols as objects (#​1753)

• Fix returning a Record in merge() when Record is empty (#​1785)

• Fix for RC~12: Records from different factories aren't equal (#​1734)

• "too much recursion" error when creating a Record type from an instance of another Record (#​1690)

• Fix glob for npm format script on Windows (#​18)

• Remove deprecated cursor API (#​13)

• Add missing es exports (#​1740)

• Support nulls in genTypeDefData.js (#​185)

• Support isPlainObj in IE11 and other esoteric parameters f3a6d5ce

• Set.map produces valid underlying map (#​1606)

• Support isPlainObj with constructor key (#​1627)

• groupBy no longer returns a mutable Map instance (#​1602)

• Fix issue where refs can recursively collide, corrupting .size (#​1598)

• Throw error in mergeWith() method if missing the required merger function (#​1543)

• Update isPlainObj() to workaround Safari bug and allow cross-realm values (#​1557)

• Fix missing "& T" to some methods in RecordInstance (#​1464)

• Make notSetValue optional for typed Records (#​1461) (a1029bb)

• Export type of RecordInstance (#​1434)

• Fix Record size check in merge() (#​1521)

• Fix Map#concat being not defined (#​1402)

• getIn() no longer throws when encountering a missing path (#​1361)

• Do not throw when printing value that cannot be coerced to primitive (#​1334)

• Do not throw from hasIn (#​1319)

• Long hash codes no longer cause an infinite loop (#​1175)

• slice() which should return an empty set could return a full set or vice versa (#​1245, #​1287)

• Ensure empty slices do not throw when iterated (#​1220)

• Error during equals check on Record with undefined or null (#​1208)

• Fix size of count() after filtering or flattening (#​1171)

v3.8.3

Compare Source

Fix Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') in immutable

v3.8.2

Compare Source

Released in 2017, still the most commonly used release.

v3.8.1

Compare Source

Minor touch ups discovered after the last release, plus a few more bug fixes! Plus, you can now contribute to immutable-js using the latest version of node.

New:

• The methods keyOf, findKey, lastKeyOf, and findLastKey were moved from KeyedIterable to Iterable, so they may be also used on Lists and Sets. (#​740)

Fixes:

• Some issues with the flow definitions have been polished out thanks to @​marudor. (#​840, #​841, #​845)
• Collections which contain Symbol keys or values can now be stringified. (#​620)
• Negative indexing into the keySeq of an IndexedIterable returns correct results. (#​811)
• Can use the value Infinity as a key in a Collection without crashing. (#​797)

v3.8.0

Compare Source

Whoa, a new version of Immutable! The big news is that we now export types for both Flow and TypeScript in the npm module! Also that pesky length warning has finally been fully removed. There are also a good amount of small bug fixes and performance improvements. Finally, the API docs have been improved greatly! Check it out http://facebook.github.io/immutable-js/docs/.

A huge huge thanks to everyone in the community for contributing these improvements. The large majority of work cited below is community contributions.

New:

• Now exports Flow types (#​805)
• Now exports typings for TypeScript use. (#​808)
• Cursor TypeScript definitions (#​765)
• No longer warns when accessing length property of a collection. (88f880f)
• Map.of() takes key, value interleaved pairs (#​727)
• findEntry and findLastEntry now respect notSetValue argument (#​822)

Fixes:

• Iterable::take(Infinity) takes infinitely instead of 0 (#​834)
• Proper toOrderedMap and toOrderedSet method definitions (#​761)
• Records return themselves for no-op Record#set calls for better performance (#​795)
• Range#toString propertly reports step (#​759)
• Add missing Set#contains (96b0946)

v3.7.6

Compare Source

A few minor bug fixes:

• Fixed issue where lastIndexOf did not always return the correct value #​703
• mergeDeep now has more opportunities to for the "return self" optimization, saving memory #​690
• The TypeScript .d.ts file now aligns with the outputted file for the variations of Immutable Iterables. #​647
• Ensure behavior for slice(0, NaN) is equivalent to that of JS Array #​623
• Ensure ES6 Symbol can be properly hashed #​579

And a new API method:

• myList.insert() #​402

v3.7.5

Compare Source

Many stability improvements thanks to excellent community submitted fixes.

New:

• Cursor can now set(value) #​516 to replace the value at the cursor.

Fixes:

• Ensure all tests pass in node v0.12
• All operations that accept indicies now use ECMA's algorithm for converting input to integers when possible. #​545 #​598
• Fix issue where slice/splice with non-number arguments could result in infinite recursion. #​511
• Clearer documentation regarding creating Map from JS Obj #​589
• Immutable now exported as a TypeScript module #​567
• Trailing commas causing issues in IE8 #​510
• Fix memory leak from setSize() and slice() #​540
• Union and Merge of Map or Set always favors the type of the left hand side #​515

---

• If you want to rebase/retry this PR, check this box