From a91025af44110ad11793cb449048e84e62e062f1 Mon Sep 17 00:00:00 2001
From: Deirdre Malone <dmalone@redhat.com>
Date: Mon, 18 May 2026 17:09:20 +0100
Subject: [PATCH] OCPBUGS-79452: immutable bump: fix for CVE-2026-29063 [4.19]

Signed-off-by: Deirdre Malone <dmalone@redhat.com>
---
 web/package-lock.json | 14 +++++++-------
 web/package.json      |  7 +++++--
 2 files changed, 12 insertions(+), 9 deletions(-)

diff --git a/web/package-lock.json b/web/package-lock.json
index fc552c691..dbb00bada 100644
--- a/web/package-lock.json
+++ b/web/package-lock.json
@@ -67,7 +67,7 @@
         "i18next": "^21.8.14",
         "i18next-http-backend": "^2.2.0",
         "immer": "^10.1.3",
-        "immutable": "3.x",
+        "immutable": "^3.8.3",
         "js-yaml": "^4.1.0",
         "lodash-es": "^4.17.21",
         "lru-cache": "^6.0.0",
@@ -15547,9 +15547,9 @@
       }
     },
     "node_modules/immutable": {
-      "version": "3.8.2",
-      "resolved": "https://registry.npmjs.org/immutable/-/immutable-3.8.2.tgz",
-      "integrity": "sha512-15gZoQ38eYjEjxkorfbcgBKBL6R7T459OuK+CpcWt7O3KF4uPCx2tD0uFETlUDIyo+1789crbMhTvQBSR5yBMg==",
+      "version": "3.8.3",
+      "resolved": "https://registry.npmjs.org/immutable/-/immutable-3.8.3.tgz",
+      "integrity": "sha512-AUY/VyX0E5XlibOmWt10uabJzam1zlYjwiEgQSDc5+UIkFNaF9WM0JxXKaNMGf+F/ffUF+7kRKXM9A7C0xXqMg==",
       "license": "MIT",
       "engines": {
         "node": ">=0.10.0"
@@ -22792,9 +22792,9 @@
       }
     },
     "node_modules/sass/node_modules/immutable": {
-      "version": "5.1.4",
-      "resolved": "https://registry.npmjs.org/immutable/-/immutable-5.1.4.tgz",
-      "integrity": "sha512-p6u1bG3YSnINT5RQmx/yRZBpenIl30kVxkTLDyHLIMk0gict704Q9n+thfDI7lTRm9vXdDYutVzXhzcThxTnXA==",
+      "version": "5.1.5",
+      "resolved": "https://registry.npmjs.org/immutable/-/immutable-5.1.5.tgz",
+      "integrity": "sha512-t7xcm2siw+hlUM68I+UEOK+z84RzmN59as9DZ7P1l0994DKUWV7UXBMQZVxaoMSRQ+PBZbHCOoBt7a2wxOMt+A==",
       "dev": true,
       "license": "MIT"
     },
diff --git a/web/package.json b/web/package.json
index d1dc16732..9689faad3 100644
--- a/web/package.json
+++ b/web/package.json
@@ -105,7 +105,7 @@
     "i18next": "^21.8.14",
     "i18next-http-backend": "^2.2.0",
     "immer": "^10.1.3",
-    "immutable": "3.x",
+    "immutable": "^3.8.3",
     "js-yaml": "^4.1.0",
     "lodash-es": "^4.17.21",
     "lru-cache": "^6.0.0",
@@ -178,7 +178,10 @@
     "echarts": "^5.6.0",
     "qs": "^6.14.1",
     "axios": "1.15.0",
-    "koa": "^3.1.2"
+    "koa": "^3.1.2",
+    "sass": {
+      "immutable": "^5.1.5"
+    }
   },
   "consolePlugin": {
     "name": "monitoring-plugin",