It would be great to have the fix for the security advisory GHSA-wf6x-7x77-mvgw backported to the 3.x version as well. I couldn’t find a 3.x maintenance branch, so I’m unsure how to prepare a backport myself.

I realize that the latest 3.x release (3.8.2) was published almost 9 years ago. However, a number of widely used packages still depend on it. For example, browser-sync still pulls in immutable@3.8.2. BrowserSync has close to 1 million weekly downloads on npm but does not appear to be actively maintained anymore, so it seems unlikely that it will upgrade to immutable@4 in the near future.

A quick GitHub search shows that more than 19k public repositories still depend on a ^3 version of Immutable.js:

For example:

> npm ls immutable

@org/repo@ C:\repos\...
└─┬ browser-sync@3.0.4
  ├─┬ browser-sync-ui@3.0.4
  │ └── immutable@3.8.2 deduped
  └── immutable@3.8.2

Given the continued indirect usage of immutable@3, a minimal backport of the security fix would help many projects address the advisory without requiring upstream dependencies to migrate to v4.