chore(deps): update dependency immutable to v5

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
immutable (source)	>=4.3.9 <5 → <6

---

Release Notes

immutable-js/immutable-js (immutable)

v5.1.9

Compare Source

• fix(List): a List grown past 32 elements while all its values are undefined no longer reads those values back as null (affected get, iteration, toArray, equals and hashCode)

v5.1.8

Compare Source

• fix(List): guard oversized bounds in setListBounds. Fixes CVE GHSA-v56q-mh7h-f735
• perf(Map): index large hash-collision buckets for faster lookups. Fixes CVE GHSA-xvcm-6775-5m9r

v5.1.7

Compare Source

• fix(Repeat): lastIndexOf returned size instead of size - 1 by @​chatman-media in #​2227. Fixes CVE CVE-2026-29063

v5.1.6

Compare Source

• fix(reverseFactory): read reversedSequence.size in __iterator instead of this #​2196

v5.1.5

Compare Source

• Fix Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') in immutable

v5.1.4

Compare Source

• Migrate some files to TS by @​jdeniau in #​2125
  • Iterator.ts
  • PairSorting.ts
  • toJS.ts
  • Math.ts
  • Hash.ts
• Extract CollectionHelperMethods and convert to TS by @​jdeniau in #​2131
• Use npm trusted publishing only to avoid token stealing.

Documentation

• Fix/a11y issues by @​lyannel in #​2136
• Doc add Map.get signature update by @​borracciaBlu in #​2138
• fix(doc):minor-issues#2132 by @​JayMeDotDot in #​2133
• Fix algolia search by @​jdeniau in #​2135
• Typo in OrderedMap by @​jdeniau in #​2144

Internal

• chore: Sort all imports and activate eslint import rule by @​jdeniau in #​2119

v5.1.3

Compare Source

TypeScript

• fix: allow readonly map entry constructor by @​septs in #​2123

Documentation

There has been a huge amount of changes in the documentation, mainly migrate from an autogenerated documentation from .d.ts file, to a proper documentation in markdown.
The playground has been included on nearly all method examples.
We added a page about browser extensions too: https://immutable-js.com/browser-extension/

Internal

• replace rimraf by a node script by @​jdeniau in #​2113
• remove warning for tseslint config by @​jdeniau in #​2114
• Use default tsconfig for tests by @​jdeniau in #​2055
• add tests for arrCopy by @​jdeniau in #​2120

v5.1.2

Compare Source

• Revert previous assertion as it introduced a regression #​2102 by @​giggo1604
• Merge should work with empty record #​2103 by @​jdeniau

v5.1.1

Compare Source

• Fix type copying

v5.1.0

Compare Source

• Add shuffle to list #​2066 by @​mazerty
• TypeScript: Better getIn RetrievePath #​2070 by @​jdeniau
• Fix #​1915 "Converting a Seq to a list causes RangeError (max call size exceeded)" by @​alexvictoor in #​2038
• TypeScript: Fix proper typings for Seq.concat() #​2040 by @​alexvictoor
• Fix Uncaught "TypeError: keyPath.slice is not a function" for ArrayLike method #​2065 by @​jdeniau

Internal

• Upgrade typescript and typescript-eslint #​2046 by @​jdeniau
• Upgrade to rollup 4 #​2049 by @​jdeniau
• Start migrating codebase to TypeScript without any runtime change nor .d.ts change:
  • allow TS files to be compiled in src dir #​2054 by @​jdeniau
• add exception for code that should not happen in updateIn #​2074 by @​jdeniau
• Reformat Range.toString for readability #​2075 by @​Ustin.Vaskin

v5.0.3

Compare Source

• Fix List.VNode.removeAfter() / removeBefore() issue on some particular case #​2030 by @​alexvictoor

v5.0.2

Compare Source

• Fix wrong path for esm module after fix in 5.0.1

v5.0.1

Compare Source

• Fix circular dependency issue with ESM build by @​iambumblehead in #​2035 by @​iambumblehead

v5.0.0

Compare Source

Breaking changes

To sum up, the big change in 5.0 is a Typescript change related to Map that is typed closer to the JS object. This is a huge change for TS users, but do not impact the runtime behavior. (see Improve TypeScript definition for Map for more details)

Other breaking changes are:

[BREAKING] Remove deprecated methods:

Released in 5.0.0-rc.1

• Map.of('k', 'v'): use Map([ [ 'k', 'v' ] ]) or Map({ k: 'v' })
• Collection.isIterable: use isIterable directly
• Collection.isKeyed: use isKeyed directly
• Collection.isIndexed: use isIndexed directly
• Collection.isAssociative: use isAssociative directly
• Collection.isOrdered: use isOrdered directly

[BREAKING] OrdererMap and OrderedSet hashCode implementation has been fixed

Released in 5.0.0-rc.1

Fix issue implementation of hashCode for OrdererMap and OrderedSet where equal objects might not return the same hashCode.

Changed in #​2005

[BREAKING] Range function needs at least two defined parameters

Released in 5.0.0-beta.5

Range with undefined would end in an infinite loop. Now, you need to define at least the start and end values.

If you need an infinite range, you can use Range(0, Infinity).

Changed in #​1967 by @​jdeniau

[Minor BC break] Remove default export

Released in 5.0.0-beta.1

Immutable does not export a default object containing all it's API anymore.
As a drawback, you can not immport Immutable directly:

- import Immutable from 'immutable';
+ import { List, Map } from 'immutable';

- const l = Immutable.List([Immutable.Map({ a: 'A' })]);
+ const l = List([Map({ a: 'A' })]);

If you want the non-recommanded, but shorter migration path, you can do this:

- import Immutable from 'immutable';
+ import * as Immutable from 'immutable';

  const l = Immutable.List([Immutable.Map({ a: 'A' })]);

[TypeScript Break] Improve TypeScript definition for Map

Released in 5.0.0-beta.1

If you do use TypeScript, then this change does not impact you : no runtime change here.
But if you use Map with TypeScript, this is a HUGE change !
Imagine the following code

const m = Map({ length: 3, 1: 'one' });

This was previously typed as Map<string, string | number>

and return type of m.get('length') or m.get('inexistant') was typed as string | number | undefined.

This made Map really unusable with TypeScript.

Now the Map is typed like this:

MapOf<{
  length: number;
  1: string;
}>;

and the return type of m.get('length') is typed as number.

The return of m.get('inexistant') throw the TypeScript error:

Argument of type '"inexistant"' is not assignable to parameter of type '1 | "length"

If you want to keep the old definition

This is a minor BC for TS users, so if you want to keep the old definition, you can declare you Map like this:

const m = Map<string, string | number>({ length: 3, 1: 'one' });

If you need to type the Map with a larger definition

You might want to declare a wider definition, you can type your Map like this:

type MyMapType = {
  length: number;
  1: string | null;
  optionalProperty?: string;
};
const m = Map<MyMapType>({ length: 3, 1: 'one' });

Keep in mind that the MapOf will try to be consistant with the simple TypeScript object, so you can not do this:

Map({ a: 'a' }).set('b', 'b');
Map({ a: 'a' }).delete('a');

Like a simple object, it will only work if the type is forced:

Map<{ a: string; b?: string }>({ a: 'a' }).set('b', 'b'); // b is forced in type and optional
Map<{ a?: string }>({ a: 'a' }).delete('a'); // you can only delete an optional key

Are all Map methods implemented ?

For now, only get, getIn, set, update, delete, remove, toJS, toJSON methods are implemented. All other methods will fallback to the basic Map definition. Other method definition will be added later, but as some might be really complex, we prefer the progressive enhancement on the most used functions.

Fixes

• Fix type inference for first() and last() #​2001 by @​butchler
• Fix issue with empty list that is a singleton #​2004 by @​jdeniau
• Map and Set sort and sortBy return type #​2013 by @​jdeniau

Internal

• [Internal] Migrating TS type tests from dtslint to TSTyche #​1988 and #​1991 by @​mrazauskas.
  Special thanks to @​arnfaldur that migrated every type tests to tsd just before that.
• [internal] Upgrade to rollup 3.x #​1965 by @​jdeniau
• [internal] upgrade tooling (TS, eslint) and documentation packages: #​1971, #​1972, #​1973, #​1974, #​1975, #​1976, #​1977, #​1978, #​1979, #​1980, #​1981

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At 12:00 AM through 04:59 AM and 10:00 PM through 11:59 PM, Monday through Friday (* 0-4,22-23 * * 1-5)
  • Only on Sunday and Saturday (* * * * 0,6)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[changeset-bot]

⚠️ No Changeset found

Latest commit: 5c3feb8

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
nimbus-documentation	Ready	Preview	Aug 17, 2026 7:45am
nimbus-storybook	Ready	Preview	Aug 17, 2026 7:45am

[github-actions]

Bundle Size Report

_{Last updated: 2026-08-17 07:44:24 UTC}

Package	Format	Current	Baseline	Delta	Status
@commercetools/nimbus	dist	18950.9 KB	18950.9 KB	+0.0%	✅ ok
@commercetools/nimbus-icons	dist	4787.6 KB	4787.6 KB	+0.0%	✅ ok
@commercetools/nimbus-tokens	dist	408.9 KB	408.9 KB	+0.0%	✅ ok

Baseline source: comment-chain

[chromatic-com]

Tip

All tests passed and all changes approved!

🟢 UI Tests: 1207 tests unchanged
🟢 UI Review: 1207 stories published -- no changes
Storybook Publish: 1207 stories published

[misama-ct]

Closing — two problems.

1. It drops the security floor. ">=4.3.9 <5" → "<6". The >=4.3.9 is the entire reason this override exists (GHSA-xvcm-6775-5m9r / GHSA-v56q-mh7h-f735 — hash-collision algorithmic-complexity DoS in Immutable.Map/Set). The replacement only caps the ceiling; it no longer encodes a patched floor.

2. The <5 cap is deliberate, and green CI is not evidence here. immutable's only consumers in this tree are @commercetools-uikit/localized-rich-text-input@20.6.7 and @commercetools-uikit/rich-text-input@20.6.7 — neither is exercised by our unit or Storybook suites. This is the same blind spot that let the minimatch v10 break ship in #1904 and get reverted in #1913.

Alternative if we do want immutable 5: make it a deliberate change that keeps the floor —

immutable: ">=5.0.0 <6"

— after verifying UI Kit rich-text-input against v5. Renovate can't make that call for us, which is why #1928 suppresses majors on override bands rather than letting this land automatically.

[renovate]

Renovate Ignore Notification

Because you closed this PR without merging, Renovate will ignore this update. You will not get PRs for any future 5.x releases. But if you manually upgrade to 5.x then Renovate will re-enable minor and patch updates automatically.

If you accidentally closed this PR, or if you changed your mind: rename this PR to get a fresh replacement PR.