[dependabot]

Bumps the security group with 2 updates in the / directory: immutable and brace-expansion.

Updates immutable from 3.7.6 to 3.8.4

Release notes

Sourced from immutable's releases.

v3.8.4

What's Changed

• Port DoS patches for CVE-2026-59879 and CVE-2026-59880 onto branch 3.x by @​Zoe7 in immutable-js/immutable-js#2250

New Contributors

• @​Zoe7 made their first contribution in immutable-js/immutable-js#2250

Full Changelog: immutable-js/immutable-js@v3.8.3...v3.8.4

v3.8.3

Fix Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') in immutable

v3.8.2

This patch release relicenses with the MIT license, but includes no other changes. Intended for those who have not yet been able to update to the 4.x builds, but have a legal need for the change in license.

v3.8.1

Minor touch ups discovered after the last release, plus a few more bug fixes! Plus, you can now contribute to immutable-js using the latest version of node.

New:

• The methods keyOf, findKey, lastKeyOf, and findLastKey were moved from KeyedIterable to Iterable, so they may be also used on Lists and Sets. (#740)

Fixes:

• Some issues with the flow definitions have been polished out thanks to @​marudor. (#840, #841, #845)
• Collections which contain Symbol keys or values can now be stringified. (#620)
• Negative indexing into the keySeq of an IndexedIterable returns correct results. (#811)
• Can use the value Infinity as a key in a Collection without crashing. (#797)

v3.8.0

Whoa, a new version of Immutable! The big news is that we now export types for both Flow and TypeScript in the npm module! Also that pesky length warning has finally been fully removed. There are also a good amount of small bug fixes and performance improvements. Finally, the API docs have been improved greatly! Check it out http://facebook.github.io/immutable-js/docs/.

A huge huge thanks to everyone in the community for contributing these improvements. The large majority of work cited below is community contributions.

New:

• Now exports Flow types (#805)
• Now exports typings for TypeScript use. (#808)
• Cursor TypeScript definitions (#765)
• No longer warns when accessing length property of a collection. (88f880fc02a377eb36dc1b9f3d6c86c2d1c287dd)
• Map.of() takes key, value interleaved pairs (#727)
• findEntry and findLastEntry now respect notSetValue argument (#822)

Fixes:

• Iterable::take(Infinity) takes infinitely instead of 0 (#834)
• Proper toOrderedMap and toOrderedSet method definitions (#761)
• Records return themselves for no-op Record#set calls for better performance (#795)
• Range#toString propertly reports step (#759)
• Add missing Set#contains (96b09465f95a4f9f5229b4183a06faca39235fec)

Commits

• 4c57f48 3.8.4
• 6796775 Merge branch 'Zoe7-port-ghsa-list-and-hash-collision' into 3.x
• 0fe3f77 Port DoS patches for CVE-2026-59879 and CVE-2026-59880 onto branch 3.x
• 9ec138f wrong npm tag
• cc1d403 update package
• 6dc6c6f try to build with docker
• 2d65e47 update release script
• c407425 bump v3.8.3
• c6ff68a release script on 3.x branch
• a675a66 Merge pull request #2179 from immutable-js/port-patch-for-cve-2026-29063
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for immutable since your current version.

Updates brace-expansion from 1.1.11 to 1.1.21

Release notes

Sourced from brace-expansion's releases.

v1.1.15

• Backport v5.0.6 change to v1 (#111) 0b09384

---

juliangruber/brace-expansion@v1.1.14...v1.1.15

v1.1.12

• pkg: publish on tag 1.x c460dbd
• fmt ccb8ac6
• Fix potential ReDoS Vulnerability or Inefficient Regular Expression (#65) c3c73c8

---

juliangruber/brace-expansion@v1.1.11...v1.1.12

Commits

• 8e81e18 1.1.21
• ffdfa3e Merge commit from fork
• c6513ad 1.1.20
• 1efee7c Merge commit from fork
• a34340a 1.1.19
• 0bcbfc0 Merge commit from fork
• 758fcd6 1.1.18
• 27fbeed Merge commit from fork
• 5c57cc2 1.1.17
• d757f1d npm ignore .claude
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions
  You can disable automated security fix PRs for this repo from the Security Alerts page.

[henryqdineen]

@dependabot recreate

[dependabot]

Looks like these dependencies are no longer updatable, so this is no longer needed.

[dependabot]

Looks like this PR is closed. If the branch still exists, you can re-open the PR and then use @dependabot rebase or @dependabot recreate. If the branch was deleted, Dependabot will create a new PR on the next scheduled run, or you can trigger an update from the Dependency graph page.