Immutable.js `List` 32-bit trie overflow → unrecoverable DoS

I received a Dependabot security alert for a repo that's using browser-sync 3.0.4 concerning Immutable being vulnerable to Immutable.js List 32-bit trie overflow:

Dependabot cannot update immutable to a non-vulnerable version The latest possible version that can be installed is 3.8.3 because of the following conflicting dependencies:

复制

[email protected] requires immutable@^3
[email protected] requires immutable@^3 via [email protected]
A patched version exists for immutable, but the available update path still resolves it to 3.8.3

The earliest fixed version is 4.3.9.

Similar to issue #2111

Is there a plan for a browser-sync update to handle this?