R11DT-4120 - Bump vulnerable deps in swagger-ui (immutable, dompurify, js-yaml, axios, brace-expansion)

[mvios]

R11DT-4120 - Fix vulnerabilities in swagger-ui

Remediates all 16 Wiz dependency findings against OutSystems/swagger-ui (b11) by bumping the 5 flagged components, regenerating the lockfile, applying the upstream immutable-v4 source fixes, and rebuilding the vendored dist/ bundles. Follows the established surgical-bump pattern (see #205 / R11DT-4052).

Changes

Component	Type	Change	Resolved	Findings cleared
immutable	direct	=3.8.3 → =4.3.9	4.3.9	CVE-2026-59879, CVE-2026-59880
dompurify	direct	=3.4.11 → =3.4.12	3.4.12	GHSA-c2j3-45gr-mqc4
js-yaml	direct	=4.2.0 → =4.3.0	4.3.0	CVE-2026-59869
axios	override	>=1.16.0 → >=1.18.0	1.18.1	10 GHSA advisories
apidom → brace-expansion	override	>=5.0.6 → >=5.0.8	5.0.8	CVE-2026-13149, CVE-2026-14257

Rebuilt dist/ bundles are included (Platform vendors the prebuilt artifacts).

immutable v3 → v4 requires source changes (upstream swagger-api#10969)

immutable 4.x is a breaking major, and the =3.8.3 → =4.3.9 bump alone regressed rendering: under v4, Map#toArray() returns [key, value] entry pairs (v3 returned values), so components doing keyedMap.map(...).toArray() leaked the map key as a stray React text node — e.g. a duplicated, unstyled operation-tag label. v4 also changed Map#mergeDeep to concatenate Lists instead of replacing them.

This PR ports the exact source changes from upstream swagger-api/swagger-ui#10969 ("fix(deps): bump immutable to 4.3.9", merged 2026-07-22), which is upstream's own migration for this identical bump — so the fork aligns with upstream rather than diverging:

• operations.jsx, overview.jsx, auth/oauth2.jsx, auth/auths.jsx, oas31/auth/auths.jsx: .toArray() → .valueSeq().toArray() (values), and definitions.map((v,k)=>k).toArray() → definitions.keySeq().toArray() (keys)
• core/utils/index.js arrayify(): guard with Im.isKeyed() to keep returning values for keyed collections
• examples-select-value-retainer.jsx: mergeDeep(obj) → merge(obj)
• json-schema-5/model.jsx: cautionary comment about v4 mergeDeep + List semantics

Verification

• npm audit: all 16 Wiz-flagged instances clear.
• Render parity (the key check): headless render via Chrome DevTools Protocol of the same OpenAPI spec on the pre-bump (immutable v3) bundle vs. this v4+fixes bundle → byte-identical output after the same normalization Platform's RESTService_swaggerUiTests applies. So the vendored render is unchanged and Platform's golden tests pass without regenerating goldens. (Repro under specs/…/immutable-v4-render-repro/.)
• Jest unit (test:unit): 34 pre-existing failures, identical before and after (unchanged by this work).
• Build: webpack bundles rebuilt; dist/index.html cache-busting hashes refreshed.

Out of scope (documented)

npm audit also flags pre-existing, non-Wiz copies not shipped in dist: sass's build-time immutable@5.1.5 and dev-tooling brace-expansion 1.x/2.x. These existed at baseline and were not introduced here; left untouched per surgical scope (NFR2).

Residuals for reviewers

• Full Cypress e2e (cy:ci) not run locally (Cypress verified/available); recommend CI.
• Interactive visual render smoke (load an OpenAPI spec, confirm branding + no console errors) still recommended before/at merge.

Downstream Platform vendoring PR: OutSystems/Platform#12511.