chore(deps-dev): Bump immutable from 4.3.8 to 4.3.9

[dependabot]

Bumps immutable from 4.3.8 to 4.3.9.

Release notes

Sourced from immutable's releases.

v4.3.9

What's changed

• fix(List): guard oversized bounds in setListBounds. Fixes CVE GHSA-v56q-mh7h-f735
• perf(Map): index large hash-collision buckets for faster lookups. Fixes CVE GHSA-xvcm-6775-5m9r

Full Changelog: immutable-js/immutable-js@v4.3.8...v4.3.9

Changelog

Sourced from immutable's changelog.

4.3.9

• fix(List): guard oversized bounds in setListBounds. Fixes CVE GHSA-v56q-mh7h-f735
• perf(Map): index large hash-collision buckets for faster lookups. Fixes CVE GHSA-xvcm-6775-5m9r

5.1.7

• fix(Repeat): lastIndexOf returned size instead of size - 1 by @​chatman-media in immutable-js/immutable-js#2227. Fixes CVE CVE-2026-29063
• fix(IndexedCollection): has(index) on a lazy Seq of unknown size now checks index existence instead of searching for a value equal to the index #2203
• [TypeScript]: reduce/reduceRight without an initial value now infer the result type from the collection's values when the reducer returns a value (e.g. list.reduce((a, b) => a + b) infers number), matching Array#reduce. Previously an explicit type argument was required. #2205

5.1.6

• fix(reverseFactory): read reversedSequence.size in __iterator instead of this #2196

5.1.5

• Fix Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') in immutable

5.1.4

• Migrate some files to TS by @​jdeniau in immutable-js/immutable-js#2125
  • Iterator.ts
  • PairSorting.ts
  • toJS.ts
  • Math.ts
  • Hash.ts
• Extract CollectionHelperMethods and convert to TS by @​jdeniau in immutable-js/immutable-js#2131
• Use npm trusted publishing only to avoid token stealing.

Documentation

• Fix/a11y issues by @​lyannel in immutable-js/immutable-js#2136
• Doc add Map.get signature update by @​borracciaBlu in immutable-js/immutable-js#2138
• fix(doc):minor-issues#2132 by @​JayMeDotDot in immutable-js/immutable-js#2133
• Fix algolia search by @​jdeniau in immutable-js/immutable-js#2135
• Typo in OrderedMap by @​jdeniau in immutable-js/immutable-js#2144

Internal

• chore: Sort all imports and activate eslint import rule by @​jdeniau in immutable-js/immutable-js#2119

5.1.3

TypeScript

• fix: allow readonly map entry constructor by @​septs in immutable-js/immutable-js#2123

Documentation

... (truncated)

Commits

• 5da7919 4.3.9
• 794a1a9 Merge commit from fork
• 3dd7e56 perf(Map): index large hash-collision buckets for faster lookups
• 62d0b58 fix ts in tests
• 8c0e5f8 Merge commit from fork
• f0bc997 Merge commit from fork
• 8ac83f4 change tag
• f7373e5 use id-token to deploy 4.x version
• 2f545ad changelog
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.

[ryanio]

Re-ran the failed job — the coverage failure here was a flake, not caused by this bump.

Evidence: lint and tests both passed on the same commit, and the tests job runs the identical suite. The two failures were both 3 ERC1155 <=> ETH in the multi-listing spec, reverting with:

SolidityError: VM Exception while processing transaction: reverted with custom error 'NoSpecifiedOrdersAvailable()'

NoSpecifiedOrdersAvailable() from fulfillAvailableOrders means every order was filtered as unfulfillable — the signature of orders aging past endTime mid-test. The coverage job runs the suite under c8 instrumentation, which is slow enough to push time-sensitive orders over their expiry, so it fails where tests does not.

This PR only changes one transitive lockfile entry, immutable 4.3.8 → 4.3.9, which cannot influence EVM execution. immutable reaches the tree at seaport → hardhat@2.28.6 → immutable — the vendored contracts repo's own Hardhat 2 toolchain, dev-only and never loaded by this SDK, which runs on Hardhat 3.

Worth taking anyway: 4.3.9 fixes GHSA-v56q-mh7h-f735 (oversized bounds in setListBounds), and it clears the finding from npm audit.

One ordering note: #924 also touches package-lock.json, so whichever merges second needs a rebase. This one is a single-line change, and immutable stays at 4.3.8 in #924, so merging in either order works — Dependabot will rebase this if #924 goes first.

Separately, that flaky spec is worth a follow-up. Pinning the block timestamp or widening the order window in the multi-listing tests would stop coverage from intermittently failing on unrelated dependency PRs.

[ryanio]

Approving — passes on re-run, confirming the earlier failure was the timing flake described above and not related to this bump. All checks green.

Worth taking for GHSA-v56q-mh7h-f735, even though the package is dev-only and reached transitively through seaport → hardhat@2.28.6. It also clears the finding from npm audit.

[ryanio]

Approving — coverage passes on re-run, confirming the earlier failure was the timing flake described above rather than anything to do with this bump. All checks green.

Worth taking for GHSA-v56q-mh7h-f735, even though the package is dev-only and reached transitively via seaport → hardhat@2.28.6. It also clears the finding from npm audit.