Skip to content

fix: bump immutable override to clear high-severity audit#3137

Closed
HarshMN2345 wants to merge 1 commit into
mainfrom
fix-audit-immutable
Closed

fix: bump immutable override to clear high-severity audit#3137
HarshMN2345 wants to merge 1 commit into
mainfrom
fix-audit-immutable

Conversation

@HarshMN2345

Copy link
Copy Markdown
Member

Summary

  • bun audit --audit-level high was failing CI on two high-severity immutable advisories (pulled in transitively via sass): a 32-bit trie overflow DoS and a hash-collision algorithmic complexity DoS.
  • Bumped the existing immutable override from ^5.1.5 to ^5.1.8 to reach the patched range.
  • No direct dependency changes — only the transitive override.

Test plan

  • bun audit --audit-level high — 0 vulnerabilities
  • bun install --frozen-lockfile — succeeds
  • bun run check — 0 errors

bun audit --audit-level high was failing on immutable (pulled in via
sass) for two DoS advisories (32-bit trie overflow, hash-collision
complexity). Bumped the override from ^5.1.5 to ^5.1.8.
@appwrite

appwrite Bot commented Jul 22, 2026

Copy link
Copy Markdown

Console (appwrite/console)

Project ID: 688b7bf400350cbd60e9

Sites (1)
Site Status Logs Preview QR
 console-stage
688b7cf6003b1842c9dc
Processing Processing View Logs Preview URL QR Code

Tip

Schedule functions to run as often as every minute with cron expressions

@greptile-apps

greptile-apps Bot commented Jul 22, 2026

Copy link
Copy Markdown
Contributor

Greptile Summary

This PR updates the transitive Immutable.js override to a patched release range. The main changes are:

  • Raises the immutable override from ^5.1.5 to ^5.1.8.
  • Resolves immutable to version 5.1.9 in the Bun lockfile.
  • Updates the lockfile integrity hash for the new package.

Confidence Score: 5/5

This looks safe to merge.

  • No blocking issues found in the changed code.
  • The manifest and lockfile use matching override ranges.
  • Immutable.js 5.1.9 satisfies Sass's declared ^5.1.5 dependency range.

Important Files Changed

Filename Overview
package.json Raises the existing immutable override to the patched ^5.1.8 range.
bun.lock Synchronizes the override and resolves immutable to version 5.1.9 with its updated integrity hash.

Reviews (1): Last reviewed commit: "fix: bump immutable override to clear hi..." | Re-trigger Greptile

@HarshMN2345

Copy link
Copy Markdown
Member Author

Folding this into #3136 instead of a separate PR.

@HarshMN2345
HarshMN2345 deleted the fix-audit-immutable branch July 22, 2026 10:47
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant