# What changed in immutable

> 9 changes in immutable 5 from its official release notes, upgrade guides and advisories: 1 breaking, 4 security. Each one cited. Sources checked 2026-10-18. HTML: https://unstale.sh/npm/immutable/

To see which of these apply to a repository, run `npx @unstale/cli init` in it.

## immutable 5

### Breaking changes

- On a lazy Seq of unknown size, has(index) checks whether the index exists instead of searching for a value equal to the index. (5.1.7) — [release notes](https://github.com/immutable-js/immutable-js/releases/tag/v5.1.7)

### Security

- DoS patches for CVE-2026-59879 and CVE-2026-59880 were ported onto branch 3.x. (3.8.4, 4.3.9, 5.1.8) — [release notes](https://github.com/immutable-js/immutable-js/releases/tag/v3.8.4), [security advisory](https://github.com/advisories/GHSA-V56Q-MH7H-F735), [security advisory](https://github.com/advisories/GHSA-XVCM-6775-5M9R)
- Guards oversized bounds in setListBounds, addressing a security vulnerability affecting List. (3.8.4, 4.3.9, 5.1.8) — [release notes](https://github.com/immutable-js/immutable-js/releases/tag/v5.1.8), [security advisory](https://github.com/advisories/GHSA-V56Q-MH7H-F735), [release notes](https://github.com/immutable-js/immutable-js/releases/tag/v4.3.9)
- Indexes large hash-collision buckets for faster lookups in Map. (3.8.4, 4.3.9, 5.1.8) — [release notes](https://github.com/immutable-js/immutable-js/releases/tag/v5.1.8), [security advisory](https://github.com/advisories/GHSA-XVCM-6775-5M9R), [release notes](https://github.com/immutable-js/immutable-js/releases/tag/v4.3.9)
- Immutable is vulnerable to Prototype Pollution (3.8.3, 4.3.8, 5.1.5) — [security advisory](https://github.com/advisories/GHSA-WF6X-7X77-MVGW), [release notes](https://github.com/immutable-js/immutable-js/releases/tag/v3.8.3), [release notes](https://github.com/immutable-js/immutable-js/releases/tag/v5.1.5), [release notes](https://github.com/immutable-js/immutable-js/releases/tag/v4.3.8)

### Fixes and other changes

- List now preserves undefined values when grown past 32 elements. (5.1.9) — [release notes](https://github.com/immutable-js/immutable-js/releases/tag/v5.1.9)
- Repeat.lastIndexOf now returns size - 1 instead of size for the last index. (5.1.7) — [release notes](https://github.com/immutable-js/immutable-js/releases/tag/v5.1.7)
- The type for reduce is improved when no initial value is given. (5.1.7) — [release notes](https://github.com/immutable-js/immutable-js/releases/tag/v5.1.7)
- The reverseFactory iterator now reads reversedSequence.size instead of this, fixing reversed-sequence iteration behavior. (5.1.6) — [release notes](https://github.com/immutable-js/immutable-js/releases/tag/v5.1.6)