From 386331e086660a4cf2fd126309b7cebea4b5d75e Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Fri, 6 Mar 2026 21:03:19 +0000 Subject: [PATCH 1/2] chore(deps): bump immutable in /templates Bumps and [immutable](https://github.com/immutable-js/immutable-js). These dependencies needed to be updated together. Updates `immutable` from 3.8.2 to 3.8.3 - [Release notes](https://github.com/immutable-js/immutable-js/releases) - [Changelog](https://github.com/immutable-js/immutable-js/blob/main/CHANGELOG.md) - [Commits](https://github.com/immutable-js/immutable-js/compare/v3.8.2...v3.8.3) Updates `immutable` from 5.1.4 to 5.1.5 - [Release notes](https://github.com/immutable-js/immutable-js/releases) - [Changelog](https://github.com/immutable-js/immutable-js/blob/main/CHANGELOG.md) - [Commits](https://github.com/immutable-js/immutable-js/compare/v3.8.2...v3.8.3) --- updated-dependencies: - dependency-name: immutable dependency-version: 3.8.3 dependency-type: indirect - dependency-name: immutable dependency-version: 5.1.5 dependency-type: indirect ... Signed-off-by: dependabot[bot] --- templates/package-lock.json | 18 +++++++++--------- 1 file changed, 9 insertions(+), 9 deletions(-) diff --git a/templates/package-lock.json b/templates/package-lock.json index d4574d11a20..504af9ae423 100644 --- a/templates/package-lock.json +++ b/templates/package-lock.json @@ -6228,9 +6228,9 @@ } }, "node_modules/immutable": { - "version": "3.8.2", - "resolved": "https://registry.npmjs.org/immutable/-/immutable-3.8.2.tgz", - "integrity": "sha512-15gZoQ38eYjEjxkorfbcgBKBL6R7T459OuK+CpcWt7O3KF4uPCx2tD0uFETlUDIyo+1789crbMhTvQBSR5yBMg==", + "version": "3.8.3", + "resolved": "https://registry.npmjs.org/immutable/-/immutable-3.8.3.tgz", + "integrity": "sha512-AUY/VyX0E5XlibOmWt10uabJzam1zlYjwiEgQSDc5+UIkFNaF9WM0JxXKaNMGf+F/ffUF+7kRKXM9A7C0xXqMg==", "dev": true, "license": "MIT", "engines": { @@ -8684,9 +8684,9 @@ } }, "node_modules/sass-embedded/node_modules/immutable": { - "version": "5.1.4", - "resolved": "https://registry.npmjs.org/immutable/-/immutable-5.1.4.tgz", - "integrity": "sha512-p6u1bG3YSnINT5RQmx/yRZBpenIl30kVxkTLDyHLIMk0gict704Q9n+thfDI7lTRm9vXdDYutVzXhzcThxTnXA==", + "version": "5.1.5", + "resolved": "https://registry.npmjs.org/immutable/-/immutable-5.1.5.tgz", + "integrity": "sha512-t7xcm2siw+hlUM68I+UEOK+z84RzmN59as9DZ7P1l0994DKUWV7UXBMQZVxaoMSRQ+PBZbHCOoBt7a2wxOMt+A==", "dev": true, "license": "MIT", "peer": true @@ -8725,9 +8725,9 @@ } }, "node_modules/sass/node_modules/immutable": { - "version": "5.1.4", - "resolved": "https://registry.npmjs.org/immutable/-/immutable-5.1.4.tgz", - "integrity": "sha512-p6u1bG3YSnINT5RQmx/yRZBpenIl30kVxkTLDyHLIMk0gict704Q9n+thfDI7lTRm9vXdDYutVzXhzcThxTnXA==", + "version": "5.1.5", + "resolved": "https://registry.npmjs.org/immutable/-/immutable-5.1.5.tgz", + "integrity": "sha512-t7xcm2siw+hlUM68I+UEOK+z84RzmN59as9DZ7P1l0994DKUWV7UXBMQZVxaoMSRQ+PBZbHCOoBt7a2wxOMt+A==", "dev": true, "license": "MIT" }, From 3ac1aee10f92b71a880de411f97a74518e33bdfd Mon Sep 17 00:00:00 2001 From: "Liangying.Wei" Date: Fri, 14 Aug 2026 10:24:03 +1000 Subject: [PATCH 2/2] fix(deps): override vulnerable immutable Force BrowserSync and its UI onto the first release patched for the current Immutable advisories while leaving Sass on its supported 5.x line. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> --- templates/package-lock.json | 24 ++++++++++++++---------- templates/package.json | 8 ++++++++ 2 files changed, 22 insertions(+), 10 deletions(-) diff --git a/templates/package-lock.json b/templates/package-lock.json index 2350e43e2c4..b5a40477889 100644 --- a/templates/package-lock.json +++ b/templates/package-lock.json @@ -3290,6 +3290,13 @@ "stream-throttle": "^0.1.3" } }, + "node_modules/browser-sync-ui/node_modules/immutable": { + "version": "4.3.9", + "resolved": "https://ms-feed-12.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/immutable/-/immutable-4.3.9.tgz", + "integrity": "sha1-yYNJ4F6cbipNj+iKwLNj4NU2tUQ=", + "dev": true, + "license": "MIT" + }, "node_modules/browser-sync/node_modules/cliui": { "version": "8.0.1", "resolved": "https://registry.npmjs.org/cliui/-/cliui-8.0.1.tgz", @@ -3305,6 +3312,13 @@ "node": ">=12" } }, + "node_modules/browser-sync/node_modules/immutable": { + "version": "4.3.9", + "resolved": "https://ms-feed-12.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/immutable/-/immutable-4.3.9.tgz", + "integrity": "sha1-yYNJ4F6cbipNj+iKwLNj4NU2tUQ=", + "dev": true, + "license": "MIT" + }, "node_modules/browser-sync/node_modules/wrap-ansi": { "version": "7.0.0", "resolved": "https://registry.npmjs.org/wrap-ansi/-/wrap-ansi-7.0.0.tgz", @@ -6199,16 +6213,6 @@ "node": ">= 4" } }, - "node_modules/immutable": { - "version": "3.8.3", - "resolved": "https://registry.npmjs.org/immutable/-/immutable-3.8.3.tgz", - "integrity": "sha512-AUY/VyX0E5XlibOmWt10uabJzam1zlYjwiEgQSDc5+UIkFNaF9WM0JxXKaNMGf+F/ffUF+7kRKXM9A7C0xXqMg==", - "dev": true, - "license": "MIT", - "engines": { - "node": ">=0.10.0" - } - }, "node_modules/import-fresh": { "version": "3.3.1", "resolved": "https://registry.npmjs.org/import-fresh/-/import-fresh-3.3.1.tgz", diff --git a/templates/package.json b/templates/package.json index 45633626561..9d96ec5af74 100644 --- a/templates/package.json +++ b/templates/package.json @@ -18,6 +18,14 @@ "test": "node --import tsx --test modern/src/*.test.ts", "start": "node build.js --watch" }, + "overrides": { + "browser-sync": { + "immutable": "4.3.9" + }, + "browser-sync-ui": { + "immutable": "4.3.9" + } + }, "dependencies": { "@default/anchor-js": "npm:anchor-js@5.0.0", "@default/bootstrap": "npm:bootstrap@3.4.1",