CVE-2026-59879: patch immutable to v4.3.9

[celdrake]

CVE Fix

Vulnerabilities Addressed

CVE ID	Severity	Package	Old Version	New Version
CVE-2026-59879	High	immutable	3.8.3	4.3.9
CVE-2026-59880	High	immutable	3.8.3	4.3.9

Dependabot: https://github.com/flightctl/flightctl-ui/security/dependabot/162 , https://github.com/flightctl/flightctl-ui/security/dependabot/163

Advisory: GHSA-v56q-mh7h-f735, GHSA-xvcm-6775-5m9r

Strategy Justification

CVE-2026-59879 — immutable

#	Strategy	Result	Details
1	Direct update (minor)	N/A	Transitive only via @openshift-console/dynamic-plugin-sdk
2	Transitive update	N/A	Cannot upgrade @openshift-console/dynamic-plugin-sdk (ocp-plugin constraint); SDK pins immutable: "3.x" and no patched 3.x exists
3	Override/pin	Success	Root npm override "immutable": "4.3.9"; lockfile updated; SDK stays at 4.19.1
4	Major version update	Skipped	Major bump applied via override (Strategy 3); 5.1.8 not required

No application source changes. Same override pattern as the recent js-yaml CVE fix, so it is straightforward to backport to release-1.1 and release-1.2.

Validation

• Dependencies: immutable updated to 4.3.9 via npm override (SDK remains 4.19.1)
• Vulnerability scan: FIXED (npm audit / verify.py — CVE-2026-59879 absent)
• Tests: npm run lint PASS; npm run build and npm run build:ocp PASS

Rollback

To revert this change:

git revert <commit-sha>

Or remove the "immutable": "4.3.9" entry from root package.json overrides and run npm install.

• Dependency/security: Updated the root npm override for immutable from 3.8.3 to 4.3.9 to address CVE-2026-59879 and CVE-2026-59880; retained the js-yaml override.
• Lockfile: Regenerated dependency resolution data.
• Affected areas: No changes to shared UI components, platform-specific apps, types, i18n, Cypress/E2E tests, auth proxy, packaging, or CI workflows.
• Validation: Vulnerability checks, linting, and both build commands pass.

[coderabbitai]

Walkthrough

The root package.json adds an immutable override pinned to version 4.3.9 and preserves the existing js-yaml override at 4.3.0.

Changes

Dependency overrides

Layer / File(s)	Summary
Pin immutable dependency package.json	The overrides section forces immutable to resolve to version 4.3.9 while retaining the js-yaml override.

Estimated code review effort: 1 (Trivial) | ~2 minutes

🚥 Pre-merge checks | ✅ 15

✅ Passed checks (15 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title accurately summarizes the main change: pinning immutable to v4.3.9 to patch a CVE.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
No-Hardcoded-Secrets	✅ Passed	No API keys, tokens, passwords, private keys, or credentialed URLs were added; changes only pin immutable in package.json and update lockfile metadata.
No-Weak-Crypto	✅ Passed	Only package.json/package-lock.json changed to pin immutable 4.3.9; no MD5/SHA1/DES/RC4/3DES/Blowfish/ECB or custom crypto code was added.
No-Injection-Vectors	✅ Passed	Only package.json/package-lock.json changed to add an npm override for immutable; no source files or unsafe eval/innerHTML/os.system/yaml.load patterns were introduced.
Container-Privileges	✅ Passed	The PR only updates package.json/package-lock.json; no container/K8s manifest changed, so no privileged settings were introduced.
No-Sensitive-Data-In-Logs	✅ Passed	No logging code changed; the diff only updates an immutable override and lockfile, so no new sensitive-data exposure path was added.
Resource-Leaks	✅ Passed	PR only changes package.json/package-lock.json; no Go files under proxy/ were modified, so no new resource leaks to flag.
Unchecked-Errors	✅ Passed	PR changes only package.json/package-lock.json; no proxy/ Go files were touched, so unchecked-error rules are not applicable.
Ai-Attribution	✅ Passed	HEAD commit includes Made-with: Cursor; no AI-related Co-Authored-By trailer appears in the PR commit or diff.
Generated-Files-Not-Hand-Edited	✅ Passed	Only package.json and package-lock.json changed; none match the generated-file paths in libs/types/** or libs/i18n/locales/en/translation.json.
I18n-Compliance	✅ Passed	No .tsx files were changed; this PR only updates package.json and package-lock.json, so there are no new user-visible string i18n issues to flag.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch cve-fix/CVE-2026-59879

---

_{Comment @coderabbitai help to get the list of available commands.}

[celdrake]

Tested in OCP console. The OCP console is still using v3.8.x, so the runtime will keep running in the existing version.
In flightctl-ui the dependency is not used directly, and it's not part of our build either.

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@package.json`:
- Line 60: Replace the direct immutable 4.3.9 dependency with a v3-compatible
release, or first upgrade `@openshift-console/dynamic-plugin-sdk` to a version
explicitly supporting Immutable.js v4. Do not force immutable v4 while retaining
SDK version 4.19.1; preserve SDK runtime compatibility and add compatibility
coverage if upgrading to v4.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Enterprise

Run ID: bebb182f-395b-4d28-8e3f-5671e90f7691

📥 Commits

Reviewing files that changed from the base of the PR and between d586f35 and db73194.

⛔ Files ignored due to path filters (1)

• package-lock.json is excluded by !**/package-lock.json

📒 Files selected for processing (1)

• package.json