OCPBUGS-86338: Bump immutable.js to v3.8.3#16480
Conversation
openshift-ci-robot
added
jira/severity-important
|
@jhadvig: This pull request references Jira Issue OCPBUGS-86338, which is valid. The bug has been moved to the POST state. 3 validation(s) were run on this bug
The bug has been updated to refer to the pull request using the external bug tracker. DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: jhadvig The full list of commands accepted by this bot can be found here. The pull request process is described here DetailsNeeds approval from an approver in each of these files:
Approvers can indicate their approval by writing |
openshift-ci
Bot
added
the
approved
|
@jhadvig: This pull request references Jira Issue OCPBUGS-86338, which is valid. 3 validation(s) were run on this bug
DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Repository: openshift/coderabbit/.coderabbit.yaml Review profile: CHILL Plan: Enterprise Run ID: ⛔ Files ignored due to path filters (1)
📒 Files selected for processing (2)
✅ Files skipped from review due to trivial changes (2)
WalkthroughThis PR pins the ChangesImmutable version pinning
Estimated code review effort: 🚥 Pre-merge checks | ✅ 14 | ❌ 1❌ Failed checks (1 inconclusive)
✅ Passed checks (14 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@frontend/package.json`:
- Line 196: Replace the caret ranges for the immutable packages with exact pins:
change the dependency "immutable": "^3.8.3", the dev/dependency
"`@types/immutable`": "^3.8.3", and the "resolutions" entry "immutable": "^3.8.3"
to remove the leading caret (use "3.8.3") so all three occurrences are exact
versions; ensure no other caret-prefixed immutable entries remain in
package.json and run npm/yarn install to update lockfile.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository YAML (base), Central YAML (inherited)
Review profile: CHILL
Plan: Enterprise
Run ID: c456fd94-96f9-439e-8beb-b4716cd26cc6
⛔ Files ignored due to path filters (2)
dynamic-demo-plugin/yarn.lockis excluded by!**/yarn.lock,!**/*.lockfrontend/yarn.lockis excluded by!**/yarn.lock,!**/*.lock
📒 Files selected for processing (2)
dynamic-demo-plugin/package.jsonfrontend/package.json
📜 Review details
🧰 Additional context used
📓 Path-based instructions (3)
frontend/**/*.{ts,tsx,js,jsx,json}
📄 CodeRabbit inference engine (AGENTS.md)
Never use absolute URLs or paths in the console code. The console runs behind a proxy under an arbitrary path.
Files:
frontend/package.json
{go.mod,go.sum,frontend/package.json,frontend/yarn.lock}
📄 CodeRabbit inference engine (README.md)
Dependencies should be pinned to an exact semver, sha, or git tag (no caret operator ^) in backend and frontend
Files:
frontend/package.json
frontend/package.json
📄 CodeRabbit inference engine (README.md)
Use
~semver range operator for@patternflydependencies to avoid unintended minor version bumps, as PatternFly releases do not strictly follow semantic versioning
Files:
frontend/package.json
🔇 Additional comments (1)
dynamic-demo-plugin/package.json (1)
82-82: ⚡ Quick winRequest missing input: Provide the original
<review_comment>content (and any diff snippet it refers to) so I can rewrite it correctly foropenshift/console.
| "i18next-http-backend": "^1.0.21", | ||
| "i18next-v4-format-converter": "^1.1.1", | ||
| "immutable": "3.x", | ||
| "immutable": "^3.8.3", |
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
FILE="frontend/package.json"
# Print the relevant lines around the claimed locations and also any immutable entries
echo "== immutable entries =="
rg -n "\"immutable\"|\"`@types/immutable`\"" "$FILE" || true
echo
echo "== lines 180-210 =="
nl -ba "$FILE" | sed -n '180,210p'
echo
echo "== lines 230-260 =="
nl -ba "$FILE" | sed -n '230,260p'
echo
echo "== lines 300-340 =="
nl -ba "$FILE" | sed -n '300,340p'Repository: openshift/console
Length of output: 268
🏁 Script executed:
#!/bin/bash
set -euo pipefail
FILE="frontend/package.json"
echo "== immutable entries =="
rg -n "\"immutable\"|\"`@types/immutable`\"" "$FILE" || true
show_range() {
local start="$1" end="$2"
echo
echo "== lines ${start}-${end} =="
awk -v s="$start" -v e="$end" 'NR>=s && NR<=e {printf "%d:%s\n", NR, $0}' "$FILE"
}
show_range 180 210
show_range 230 260
show_range 300 340Repository: openshift/console
Length of output: 3870
Pin immutable and @types/immutable to exact versions (remove ^)
frontend/package.json still uses caret ranges for:
- line 196:
"immutable": "^3.8.3" - line 246:
"@types/immutable": "^3.8.3" - line 324:
"immutable": "^3.8.3"(in"resolutions")
This violates the “no caret / exact pin” guideline and can drift to unvetted patch releases.
Proposed fix
- "immutable": "^3.8.3",
+ "immutable": "3.8.3",
...
- "`@types/immutable`": "^3.8.3",
+ "`@types/immutable`": "3.8.3",
...
- "immutable": "^3.8.3",
+ "immutable": "3.8.3",📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| "immutable": "^3.8.3", | |
| "immutable": "3.8.3", |
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@frontend/package.json` at line 196, Replace the caret ranges for the
immutable packages with exact pins: change the dependency "immutable": "^3.8.3",
the dev/dependency "`@types/immutable`": "^3.8.3", and the "resolutions" entry
"immutable": "^3.8.3" to remove the leading caret (use "3.8.3") so all three
occurrences are exact versions; ensure no other caret-prefixed immutable entries
remain in package.json and run npm/yarn install to update lockfile.
|
/retest |
1 similar comment
|
/retest |
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
|
@jhadvig: all tests passed! Full PR test history. Your PR dashboard. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here. |
3 participants
This PR bumps immutable.js from v3.8.2 to v3.8.3
All unit and linting tests have passed locally before commit.
Pre-Commit Verification
The husky pre-commit hook automatically ran and passed:
CVE-2026-29063 Fix Complete
Vulnerability Details
Verification Results
Before Fix
After Fix
Testing Summary
Build Verification
Code Quality
Unit Tests
Compatibility Analysis
APIs Modified in 3.8.3 Security Patch
The following APIs had
__proto__guards added:mergeDeep()mergeDeepWith()merge()Map.toJS()Map.toObject()APIs Used by relay-compiler
Based on code analysis, relay-compiler uses:
asImmutable()asMutable()forEach()get()toArray()update()delete()Overlap Analysis
APIs changed by patch that relay-compiler uses: ZERO (0)
✅ No overlap between patched APIs and used APIs
Risk Assessment
Summary by CodeRabbit