build(deps): bump immutable and @graphql-tools/relay-operation-optimizer in /catalog by dependabot[bot] · Pull Request #4755 · quiltdata/quilt

dependabot · 2026-03-05T00:16:43Z

Bumps immutable to 5.1.5 and updates ancestor dependency @graphql-tools/relay-operation-optimizer. These dependencies need to be updated together.

Updates immutable from 3.8.2 to 5.1.5

Release notes

Sourced from immutable's releases.

v5.1.5

What's Changed

Fix Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') in immutable

Upgrade devtools and use immutable version by @jdeniau in immutable-js/immutable-js#2158

Full Changelog: immutable-js/immutable-js@v5.1.4...v5.1.5

v5.1.4

What's Changed

Migrate some files to TS by @jdeniau in immutable-js/immutable-js#2125

Iterator.ts

PairSorting.ts

toJS.ts

Math.ts

Hash.ts

Extract CollectionHelperMethods and convert to TS by @jdeniau in immutable-js/immutable-js#2131

Use npm trusted publishing only to avoid token stealing.

Documentation

Fix/a11y issues by @lyannel in immutable-js/immutable-js#2136

Doc add Map.get signature update by @borracciaBlu in immutable-js/immutable-js#2138

fix(doc):minor-issues#2132 by @JayMeDotDot in immutable-js/immutable-js#2133

Fix algolia search by @jdeniau in immutable-js/immutable-js#2135

Typo in OrderedMap by @jdeniau in immutable-js/immutable-js#2144

Internal

chore: Sort all imports and activate eslint import rule by @jdeniau in immutable-js/immutable-js#2119

New Contributors

@JayMeDotDot made their first contribution in immutable-js/immutable-js#2133

@lyannel made their first contribution in immutable-js/immutable-js#2136

@borracciaBlu made their first contribution in immutable-js/immutable-js#2138

Full Changelog: immutable-js/immutable-js@v5.1.3...v5.1.4

v5.1.3

What's Changed

TypeScript

fix: allow readonly map entry constructor by @septs in immutable-js/immutable-js#2123

Documentation

There has been a huge amount of changes in the documentation, mainly migrate from an autogenerated documentation from .d.ts file, to a proper documentation in markdown. The playground has been included on nearly all method examples.

... (truncated)

Changelog

Sourced from immutable's changelog.

5.1.5

Fix Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') in immutable

5.1.4

Migrate some files to TS by @jdeniau in immutable-js/immutable-js#2125

Iterator.ts

PairSorting.ts

toJS.ts

Math.ts

Hash.ts

Extract CollectionHelperMethods and convert to TS by @jdeniau in immutable-js/immutable-js#2131

Use npm trusted publishing only to avoid token stealing.

Documentation

Fix/a11y issues by @lyannel in immutable-js/immutable-js#2136

Doc add Map.get signature update by @borracciaBlu in immutable-js/immutable-js#2138

fix(doc):minor-issues#2132 by @JayMeDotDot in immutable-js/immutable-js#2133

Fix algolia search by @jdeniau in immutable-js/immutable-js#2135

Typo in OrderedMap by @jdeniau in immutable-js/immutable-js#2144

Internal

chore: Sort all imports and activate eslint import rule by @jdeniau in immutable-js/immutable-js#2119

5.1.3

TypeScript

fix: allow readonly map entry constructor by @septs in immutable-js/immutable-js#2123

Documentation

There has been a huge amount of changes in the documentation, mainly migrate from an autogenerated documentation from .d.ts file, to a proper documentation in markdown. The playground has been included on nearly all method examples. We added a page about browser extensions too: https://immutable-js.com/browser-extension/

Internal

replace rimraf by a node script by @jdeniau in immutable-js/immutable-js#2113

remove warning for tseslint config by @jdeniau in immutable-js/immutable-js#2114

Use default tsconfig for tests by @jdeniau in immutable-js/immutable-js#2055

add tests for arrCopy by @jdeniau in immutable-js/immutable-js#2120

5.1.2

Revert previous assertion as it introduced a regression #2102 by @giggo1604

Merge should work with empty record #2103 by @jdeniau

... (truncated)

Commits

b37b855 5.1.5
16b3313 Merge commit from fork
fd2ef49 fix new proto key injection
6734b7b fix Prototype Pollution in mergeDeep, toJS, etc.
6f772de Merge pull request #2175 from immutable-js/dependabot/npm_and_yarn/rollup-4.59.0
5f3dc61 Bump rollup from 4.34.8 to 4.59.0
049a594 Merge pull request #2173 from immutable-js/dependabot/npm_and_yarn/lodash-4.1...
2481a77 Merge pull request #2172 from mrazauskas/update-tstyche
eb04779 Bump lodash from 4.17.21 to 4.17.23
b973bf3 format
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by [GitHub Actions](https://www.npmjs.com/~GitHub Actions), a new releaser for immutable since your current version.

Updates @graphql-tools/relay-operation-optimizer from 6.3.0 to 6.5.18

Changelog

Sourced from @graphql-tools/relay-operation-optimizer's changelog.

6.5.18

Patch Changes

1c95368a Thanks @ardatan! - Use ranged versions for dependencies

6.5.17

Patch Changes

Updated dependencies [b5c8f640]:

@graphql-tools/utils@9.2.1

6.5.16

Patch Changes

Updated dependencies [a94217e9, 62d074be]:

@graphql-tools/utils@9.2.0

6.5.15

Patch Changes

Updated dependencies [e3ec35ed]:

@graphql-tools/utils@9.1.4

6.5.14

Patch Changes

Updated dependencies [904fe770]:

@graphql-tools/utils@9.1.3

6.5.13

Patch Changes

Updated dependencies [13c24883]:

@graphql-tools/utils@9.1.2

6.5.12

... (truncated)

Commits

921abae chore(release): update monorepo packages versions (#5167)
1c95368 Use ranged versions for dependencies
79afd0b chore(release): update monorepo packages versions (#5024)
1094ed9 chore(release): update monorepo packages versions (#5018)
6a7068e chore(release): update monorepo packages versions (#4962)
9436db0 chore(release): update monorepo packages versions (#4888)
90011f0 chore(release): update monorepo packages versions (#4884)
353be6e Upcoming Release Changes (#4843)
79b126b chore(release): update monorepo packages versions (#4826)
74e28b6 chore(release): update monorepo packages versions (#4815)
Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
You can disable automated security fix PRs for this repo from the Security Alerts page.

Greptile Summary

This Dependabot PR bumps immutable from v3.8.2 to v5.1.5 (addressing a Prototype Pollution security vulnerability) and updates its co-dependent @graphql-tools/relay-operation-optimizer from 6.3.0 to 6.5.18.

However, the upgrade spans two major versions (v3 → v5) and introduces a breaking API change that will cause a runtime crash: the Iterable named export was removed in immutable-js v4 and replaced with Collection. The code in catalog/app/utils/Store.jsx imports and uses Iterable.isIterable(), which will throw a TypeError on every Redux dispatch, breaking both Redux DevTools and the Sentry error enhancer across the entire application.

Other immutable-js usages (fromJS, Map, List, .get(), .getIn(), etc.) are compatible with v5. The fix is a single-line rename in Store.jsx: replace Iterable with Collection and update the call to Collection.isCollection().

Not safe to merge without fixing the Store.jsx breaking change.

Confidence Score: 1/5

Not safe to merge — contains a breaking API change that will crash the application on every Redux dispatch.
The immutable upgrade from v3 → v5 removes the Iterable API that is actively used in Store.jsx. When the stateTransformer function executes (which happens on every Redux action), it will throw TypeError: Cannot read properties of undefined (reading 'isIterable'), crashing Redux DevTools and the Sentry error enhancer. This is a critical, app-wide runtime error. The fix is a one-line change in Store.jsx, but the PR cannot be merged without it.
catalog/app/utils/Store.jsx — must replace Iterable with Collection before merge

Flowchart

%%{init: {'theme': 'neutral'}}%%
flowchart TD
    A["immutable v3.8.2 → v5.1.5 bump"] --> B["Security fix\n(Prototype Pollution)"]
    A --> C["Breaking API changes\n(v3 → v4 → v5)"]
    C --> D["Iterable renamed to Collection\n(removed in v4+)"]
    D --> E["Store.jsx imports Iterable\nfrom immutable"]
    E --> F["Iterable is undefined at runtime"]
    F --> G["TypeError: Cannot read properties\nof undefined 'isIterable'\n⚠️ Crash on every Redux dispatch"]
    A --> H["Other usages (fromJS, Map, List,\nget, getIn, toJS) — compatible ✅"]
    A --> I["@ardatan/relay-compiler\ngets isolated immutable@3.7.6 ✅"]

_{Last reviewed commit: 92c5d59}

greptile-apps · 2026-03-05T00:20:12Z

Additional Comments (1)

catalog/app/utils/Store.jsx, line 14
Iterable removed in immutable-js v4+

Iterable was renamed to Collection in immutable-js v4 and the Iterable named export no longer exists in v5. Importing it here will yield undefined, and calling Iterable.isIterable(state) on line 14 will throw:

TypeError: Cannot read properties of undefined (reading 'isIterable')

This will break the Redux DevTools state transformer and the Sentry enhancer's stateTransformer on every Redux action dispatch.

The fix is to replace Iterable with Collection (which is its v4+ equivalent) and use Collection.isCollection():

import { fromJS, Collection } from 'immutable'
import * as React from 'react'
import { Provider as ReduxProvider } from 'react-redux'
import { createStore, applyMiddleware, compose } from 'redux'
import { composeWithDevTools } from 'redux-devtools-extension'
import { combineReducers } from 'redux-immutable'
import * as Sentry from '@sentry/react'

import { withInjectableReducers } from 'utils/ReducerInjector'
import { withSaga } from 'utils/SagaInjector'

const stateTransformer = (state) =>
  // pure JS is easier to read than Immutable objects
  Collection.isCollection(state) ? state.toJS() : state

Bumps [immutable](https://github.com/immutable-js/immutable-js) to 5.1.5 and updates ancestor dependency [@graphql-tools/relay-operation-optimizer](https://github.com/ardatan/graphql-tools/tree/HEAD/packages/relay-operation-optimizer). These dependencies need to be updated together. Updates `immutable` from 3.8.2 to 5.1.5 - [Release notes](https://github.com/immutable-js/immutable-js/releases) - [Changelog](https://github.com/immutable-js/immutable-js/blob/main/CHANGELOG.md) - [Commits](immutable-js/immutable-js@v3.8.2...v5.1.5) Updates `@graphql-tools/relay-operation-optimizer` from 6.3.0 to 6.5.18 - [Release notes](https://github.com/ardatan/graphql-tools/releases) - [Changelog](https://github.com/ardatan/graphql-tools/blob/master/packages/relay-operation-optimizer/CHANGELOG.md) - [Commits](https://github.com/ardatan/graphql-tools/commits/@graphql-tools/relay-operation-optimizer@6.5.18/packages/relay-operation-optimizer) --- updated-dependencies: - dependency-name: immutable dependency-version: 5.1.5 dependency-type: direct:production - dependency-name: "@graphql-tools/relay-operation-optimizer" dependency-version: 6.5.18 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot bot added dependencies Pull requests that update a dependency file javascript Pull requests that update Javascript code labels Mar 5, 2026

dependabot bot force-pushed the dependabot/npm_and_yarn/catalog/multi-1ddf64ff75 branch from 92c5d59 to 2b470b7 Compare March 18, 2026 23:02

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

build(deps): bump immutable and @graphql-tools/relay-operation-optimizer in /catalog#4755

build(deps): bump immutable and @graphql-tools/relay-operation-optimizer in /catalog#4755
dependabot[bot] wants to merge 1 commit intomasterfrom
dependabot/npm_and_yarn/catalog/multi-1ddf64ff75

dependabot bot commented on behalf of github Mar 5, 2026 •

edited

Loading

Uh oh!

greptile-apps bot commented Mar 5, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

dependabot bot commented on behalf of github Mar 5, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

v5.1.5

What's Changed

v5.1.4

What's Changed

Documentation

Internal

New Contributors

v5.1.3

What's Changed

TypeScript

Documentation

5.1.5

5.1.4

Documentation

Internal

5.1.3

TypeScript

Documentation

Internal

5.1.2

6.5.18

Patch Changes

6.5.17

Patch Changes

6.5.16

Patch Changes

6.5.15

Patch Changes

6.5.14

Patch Changes

6.5.13

Patch Changes

6.5.12

Greptile Summary

Confidence Score: 1/5

Flowchart

Uh oh!

greptile-apps bot commented Mar 5, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

dependabot bot commented on behalf of github Mar 5, 2026 •

edited

Loading