It would be great to have the fix for the security advisory GHSA-wf6x-7x77-mvgw backported to the 3.x version as well. I couldn’t find a 3.x maintenance branch, so I’m unsure how to prepare a backport myself.

I realize that the latest 3.x release (3.8.2) was published almost 9 years ago. However, a number of widely used packages still depend on it. For example, browser-sync still pulls in [email protected]. BrowserSync has close to 1 million weekly downloads on npm but does not appear to be actively maintained anymore, so it seems unlikely that it will upgrade to immutable@4 in the near future.

A quick GitHub search shows that more than 19k public repositories still depend on a ^3 version of Immutable.js:

For example:

> npm ls immutable

@org/repo@ C:\repos\...
└─┬ [email protected]
  ├─┬ [email protected]
  │ └── [email protected] deduped
  └── [email protected]

Given the continued indirect usage of immutable@3, a minimal backport of the security fix would help many projects address the advisory without requiring upstream dependencies to migrate to v4.