build(deps): bump the npm_and_yarn group across 1 directory with 15 updates by dependabot[bot] · Pull Request #175 · intercom/contentful-typescript-codegen

dependabot · 2026-04-23T01:04:18Z

Resolves intercom/intercom#500235.

Bumps the npm_and_yarn group with 6 updates in the / directory:

Package	From	To
lodash	`4.17.21`	`4.18.1`
rollup	`2.79.2`	`2.80.0`
semantic-release	`17.4.7`	`19.0.3`
follow-redirects	`1.15.6`	`1.16.0`
js-yaml	`3.14.1`	`3.14.2`
picomatch	`2.2.2`	`2.3.2`

Updates lodash from 4.17.21 to 4.18.1

Release notes

Sourced from lodash's releases.

4.18.1

Bugs

Fixes a ReferenceError issue in lodash lodash-es lodash-amd and lodash.template when using the template and fromPairs functions from the modular builds. See lodash/lodash#6167

These defects were related to how lodash distributions are built from the main branch using https://github.com/lodash-archive/lodash-cli. When internal dependencies change inside lodash functions, equivalent updates need to be made to a mapping in the lodash-cli. (hey, it was ahead of its time once upon a time!). We know this, but we missed it in the last release. It's the kind of thing that passes in CI, but fails bc the build is not the same thing you tested.

There is no diff on main for this, but you can see the diffs for each of the npm packages on their respective branches:

lodash: lodash/lodash@4.18.0-npm...4.18.1-npm

lodash-es: lodash/lodash@4.18.0-es...4.18.1-es

lodash-amd: lodash/lodash@4.18.0-amd...4.18.1-amd

lodash.templatelodash/lodash@4.18.0-npm-packages...4.18.1-npm-packages

4.18.0

v4.18.0

Full Changelog: lodash/lodash@4.17.23...4.18.0

Security

_.unset / _.omit: Fixed prototype pollution via constructor/prototype path traversal (GHSA-f23m-r3pf-42rh, fe8d32e). Previously, array-wrapped path segments and primitive roots could bypass the existing guards, allowing deletion of properties from built-in prototypes. Now constructor and prototype are blocked unconditionally as non-terminal path keys, matching baseSet. Calls that previously returned true and deleted the property now return false and leave the target untouched.

_.template: Fixed code injection via imports keys (GHSA-r5fr-rjxr-66jc, CVE-2026-4800, 879aaa9). Fixes an incomplete patch for CVE-2021-23337. The variable option was validated against reForbiddenIdentifierChars but importsKeys was left unguarded, allowing code injection via the same Function() constructor sink. imports keys containing forbidden identifier characters now throw "Invalid imports option passed into _.template".

Docs

Add security notice for _.template in threat model and API docs (#6099)

Document lower > upper behavior in _.random (#6115)

Fix quotes in _.compact jsdoc (#6090)

lodash.* modular packages

Diff

We have also regenerated and published a select number of the lodash.* modular packages.

These modular packages had fallen out of sync significantly from the minor/patch updates to lodash. Specifically, we have brought the following packages up to parity w/ the latest lodash release because they have had CVEs on them in the past:

lodash.orderby

lodash.tonumber

lodash.trim

lodash.trimend

lodash.sortedindexby

lodash.zipobjectdeep

lodash.unset

lodash.omit

lodash.template

Commits

cb0b9b9 release(patch): bump main to 4.18.1 (#6177)
75535f5 chore: prune stale advisory refs (#6170)
62e91bc docs: remove n_ Node.js < 6 REPL note from README (#6165)
59be2de release(minor): bump to 4.18.0 (#6161)
af63457 fix: broken tests for _.template 879aaa9
1073a76 fix: linting issues
879aaa9 fix: validate imports keys in _.template
fe8d32e fix: block prototype pollution in baseUnset via constructor/prototype traversal
18ba0a3 refactor(fromPairs): use baseAssignValue for consistent assignment (#6153)
b819080 ci: add dist sync validation workflow (#6137)
Additional commits viewable in compare view

Updates rollup from 2.79.2 to 2.80.0

Changelog

Sourced from rollup's changelog.

2.80.0

2026-02-22

Features

Throw when the generated bundle contains paths that would leave the output directory (#6277)

Pull Requests

#6277: Validate bundle stays within output dir (@lukastaegert)

Commits

d17ae15 2.80.0
d6dee5e Validate bundle stays within output dir (#6277)
See full diff in compare view

Install script changes

This version adds prepare script that runs during installation. Review the package contents before updating.

Updates semantic-release from 17.4.7 to 19.0.3

Commits

58a226f fix(log-repo): use the original form of the repo url to remove the need to ma...
17d60d3 build(deps): bump npm from 8.3.1 to 8.12.0 (#2447)
ab45ab1 chore(lint): disabled rules that dont apply to this project (#2408)
ea389c3 chore(deps): update dependency yargs-parser to 13.1.2 [security] (#2402)
fa994db build(deps): bump node-fetch from 2.6.1 to 2.6.7 (#2399)
b79116b build(deps): bump trim-off-newlines from 1.0.1 to 1.0.3
6fd7e56 build(deps): bump minimist from 1.2.5 to 1.2.6
2b94bb4 docs: update broken link to CI config recipes (#2378)
b4bc191 docs: Correct circleci workflow (#2365)
2c30e26 Merge pull request #2333 from semantic-release/next
Additional commits viewable in compare view

Updates @octokit/plugin-paginate-rest from 2.11.0 to 6.1.2

Release notes

Sourced from @octokit/plugin-paginate-rest's releases.

v6.1.2

6.1.2 (2023-05-19)

Bug Fixes

build: replace Pika with esbuild and tsc (#527) (3ba0db6)

v6.1.1

6.1.1 (2023-05-19)

Bug Fixes

bump @octokit/types (#528) (9240b2f)

v6.1.0

6.1.0 (2023-05-12)

Features

many new endpoints (#518) (06d6543)

v6.0.0

6.0.0 (2023-01-20)

Features

many unrelease endpoint updates (#497) (24ada6e)

BREAKING CHANGES

remove defunct endpoints

v5.0.1

5.0.1 (2022-10-13)

Bug Fixes

release: use org secret for npm token to fix publishing to npm (d2ab1b5)

v5.0.0

5.0.0 (2022-10-13)

Bug Fixes

... (truncated)

Commits

3ba0db6 fix(build): replace Pika with esbuild and tsc (#527)
9240b2f fix: bump @octokit/types (#528)
6c2eead build: update cache (#526)
7a92a4e build(deps): lock file maintenance
20aa882 build(deps): lock file maintenance (#522)
06d6543 feat: many new endpoints (#518)
ce80cc3 chore(deps): update dependency prettier to v2.8.8 (#520)
ded0209 build: add script to fix package.json before publishing (#519)
abd9dee build(deps): lock file maintenance
6dca030 build(deps): lock file maintenance (#516)
Additional commits viewable in compare view

Updates @octokit/request-error from 2.0.5 to 3.0.3

Release notes

Sourced from @octokit/request-error's releases.

v3.0.3

3.0.3 (2023-01-20)

Bug Fixes

deps: update dependency @octokit/types to v9 (#307) (82c78fc)

v3.0.2

3.0.2 (2022-10-13)

Bug Fixes

deps: update dependency @octokit/types to v8 (4cabbec)

v3.0.1

3.0.1 (2022-08-15)

Bug Fixes

deps: update dependency @octokit/types to v7 (#254) (5abe81a)

v3.0.0

3.0.0 (2022-07-08)

Continuous Integration

stop testing against NodeJS v10, v12 (#236) (0a86afe)

BREAKING CHANGES

Drop support for NodeJS v10, v12

v2.1.0

2.1.0 (2021-06-11)

Features

error.response. Deprecates error.headers (#194) (487082b)

v2.0.6

2.0.6 (2021-06-11)

Bug Fixes

... (truncated)

Commits

82c78fc fix(deps): update dependency @octokit/types to v9 (#307)
77c025d build(deps): lock file maintenance (#306)
ff02c35 chore(deps): update dependency prettier to v2.8.3
faa94a9 Default branch rename (#304)
ef89a55 🚧 Workflows have changed (#303)
cb67bdc build(deps): lock file maintenance (#302)
c0dda2c build(release.yml): set node-version to lts/*
11ec169 chore(deps): update dependency prettier to v2.8.2 (#301)
aa91a4b build(deps): lock file maintenance (#299)
e5d6520 🚧 Workflows have changed (#300)
Additional commits viewable in compare view

Updates @octokit/request from 5.4.14 to 6.2.8

Release notes

Sourced from @octokit/request's releases.

v6.2.8

6.2.8 (2023-06-16)

Reverts

Revert "fix(deps): update dependency @octokit/request-error to v4 (#593)" (9c9c6d7), closes #593

v6.2.7

6.2.7 (2023-06-16)

Bug Fixes

deps: update dependency @octokit/request-error to v4 (#593) (62f51d6)

v6.2.6

6.2.6 (2023-06-13)

Bug Fixes

deps: update dependency @octokit/tsconfig to v2, explicitly mark type imports (#588) (71d7488)

v6.2.5

6.2.5 (2023-05-18)

Bug Fixes

build: replace pika with esbuild and tsc (#584) (947d7a5)

v6.2.4

6.2.4 (2023-05-16)

Bug Fixes

addsduplex option when sending a body (3df1556), closes #570

v6.2.3

6.2.3 (2023-01-21)

Bug Fixes

deps: update dependency @octokit/types to v9 (9247e87)

v6.2.2

6.2.2 (2022-10-13)

... (truncated)

Commits

9c9c6d7 Revert "fix(deps): update dependency @octokit/request-error to v4 (#593)"
62f51d6 fix(deps): update dependency @octokit/request-error to v4 (#593)
cbd121f docs: replace references to Skypack CDN with esm.sh (#595)
71d7488 fix(deps): update dependency @octokit/tsconfig to v2, explicitly mark type ...
ab33ea2 chore(deps): update dependency esbuild to ^0.18.0 (#590)
947d7a5 fix(build): replace pika with esbuild and tsc (#584)
3df1556 fix: addsduplex option when sending a body
792a68f chore(deps): update dependency prettier to v2.8.8
2970f68 ci(action): update actions/add-to-project action to v0.5.0 (#578)
cdf3701 [fix] addsduplex option when sending a body
Additional commits viewable in compare view

Updates @tootallnate/once from 1.1.2 to 2.0.0

Release notes

Sourced from @tootallnate/once's releases.

2.0.0

Major Changes

Big refactor for v2: #5

Returns a regular Promise instead of CancelablePromise.

The Promise is strongly typed when posssible. This is the main new feature.

Always returns the full array of arguments passed to the event handler (i.e. what was previously once.spread() is now the regular once()).

Compatible with AbortController to remove event listeners before the Promise has been fulfilled.

Requires TypeScript v4 or newer.

Jest tests running CI via GitHub Actions.

Minor Changes

Add README.md: d00821f35b44ed48466b8e5d202c2788e3688df6

Create LICENSE: #2

Patches

Fix: c3260138d77811bde3823cebd490ff59b35fe32f

Remove test script: #4

Credits

Huge thanks to @lewish and @vivekkj123 for helping!

Commits

b71b6e8 2.0.0
4460bff Big refactor for v2 (#5)
c4862ce Remove test script (#4)
de4a704 Create LICENSE (#2)
f02eb4b README++
c326013 Fix
d00821f Add README.md
See full diff in compare view

Updates follow-redirects from 1.15.6 to 1.16.0

Commits

0c23a22 Release version 1.16.0 of the npm package.
844c4d3 Add sensitiveHeaders option.
5e8b8d0 ci: add Node.js 24.x to the CI matrix
7953e22 ci: upgrade GitHub Actions to use setup-node@v6 and checkout@v6
86dc1f8 Sanitizing input.
21ef28a Release version 1.15.11 of the npm package.
7c88135 Roll back tree shaking.
6e389ba Release version 1.15.10 of the npm package.
5bc496e Shake me up before you go-go.
694d6b4 Bump minimist from 1.2.5 to 1.2.8
Additional commits viewable in compare view

Updates handlebars from 4.7.7 to 4.7.9

Release notes

Sourced from handlebars's releases.

v4.7.9

fix: enable shell mode for spawn to resolve Windows EINVAL issue - e0137c2

fix type "RuntimeOptions" also accepting string partials - eab1d14

feat(types): set hash to be a Record<string, any> - de4414d

fix non-contiguous program indices - 4512766

refactor: rename i to startPartIndex - e497a35

security: fix security issues - 68d8df5

GHSA-2w6w-674q-4c4q

GHSA-3mfm-83xf-c92r

GHSA-xhpv-hc6g-r9c6

GHSA-xjpj-3mr7-gcpf

GHSA-9cx6-37pm-9jff

GHSA-2qvq-rjwj-gvw9

GHSA-7rx3-28cr-v5wh

GHSA-442j-39wm-28r2

Commits

v4.7.8

Make library compatible with workers (#1894) - 3d3796c

Don't rely on Node.js global object (#1776) - 2954e7e

Fix compiling of each block params in strict mode (#1855) - 30dbf04

Fix rollup warning when importing Handlebars as ESM - 03d387b

Fix bundler issue with webpack 5 (#1862) - c6c6bbb

Use https instead of git for mustache submodule - 88ac068

Commits

Changelog

Sourced from handlebars's changelog.

v4.7.9 - March 26th, 2026

fix: enable shell mode for spawn to resolve Windows EINVAL issue - e0137c2

fix type "RuntimeOptions" also accepting string partials - eab1d14

feat(types): set hash to be a Record<string, any> - de4414d

fix non-contiguous program indices - 4512766

refactor: rename i to startPartIndex - e497a35

security: fix security issues - 68d8df5

Commits

v4.7.8 - July 27th, 2023

Make library compatible with workers (#1894) - 3d3796c

Don't rely on Node.js global object (#1776) - 2954e7e

Fix compiling of each block params in strict mode (#1855) - 30dbf04

Fix rollup warning when importing Handlebars as ESM - 03d387b

Fix bundler issue with webpack 5 (#1862) - c6c6bbb

Use https instead of git for mustache submodule - 88ac068

Commits

Commits

dce542c v4.7.9
8a41389 Update release notes
68d8df5 Fix security issues
b2a0831 Fix browser tests
9f98c16 Fix release script
45443b4 Revert "Improve partial indenting performance"
8841a5f Fix CI errors with linting
e0137c2 fix: enable shell mode for spawn to resolve Windows EINVAL issue
e914d60 Improve rendering performance
7de4b41 Upgrade GitHub Actions checkout and setup-node on 4.x branch
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by jaylinski, a new releaser for handlebars since your current version.

Updates http-cache-semantics from 3.8.1 to 4.2.0

Commits

See full diff in compare view

Updates js-yaml from 3.14.1 to 3.14.2

Changelog

Sourced from js-yaml's changelog.

[3.14.2] - 2025-11-15

Security

Backported v4.1.1 fix to v3

[4.1.1] - 2025-11-12

Security

Fix prototype pollution issue in yaml merge (<<) operator.

[4.1.0] - 2021-04-15

Added

Types are now exported as yaml.types.XXX.

Every type now has options property with original arguments kept as they were (see yaml.types.int.options as an example).

Changed

Schema.extend() now keeps old type order in case of conflicts (e.g. Schema.extend([ a, b, c ]).extend([ b, a, d ]) is now ordered as abcd instead of cbad).

[4.0.0] - 2021-01-03

Changed

Check migration guide to see details for all breaking changes.

Breaking: "unsafe" tags !!js/function, !!js/regexp, !!js/undefined are moved to js-yaml-js-types package.

Breaking: removed safe* functions. Use load, loadAll, dump instead which are all now safe by default.

yaml.DEFAULT_SAFE_SCHEMA and yaml.DEFAULT_FULL_SCHEMA are removed, use yaml.DEFAULT_SCHEMA instead.

yaml.Schema.create(schema, tags) is removed, use schema.extend(tags) instead.

!!binary now always mapped to Uint8Array on load.

Reduced nesting of /lib folder.

Parse numbers according to YAML 1.2 instead of YAML 1.1 (01234 is now decimal, 0o1234 is octal, 1:23 is parsed as string instead of base60).

dump() no longer quotes :, [, ], (, ) except when necessary, #470, #557.

Line and column in exceptions are now formatted as (X:Y) instead of at line X, column Y (also present in compact format), #332.

Code snippet created in exceptions now contains multiple lines with line numbers.

dump() now serializes undefined as null in collections and removes keys with undefined in mappings, #571.

dump() with skipInvalid=true now serializes invalid items in collections as null.

Custom tags starting with ! are now dumped as !tag instead of !<!tag>, #576.

Custom tags starting with tag:yaml.org,2002: are now shorthanded using !!, #258.

Added

Added .mjs (es modules) support.

Added quotingType and forceQuotes options for dumper to configure string literal style, #290, #529.

Added styles: { '!!null': 'empty' } option for dumper (serializes { foo: null } as "foo: "), #570.

... (truncated)

Commits

9963d36 3.14.2 released
10d3c8e dist rebuild
5278870 fix prototype pollution in merge (<<) (#731)
See full diff in compare view

Updates marked from 2.0.1 to 4.3.0

Release notes

Sourced from marked's releases.

v4.3.0

4.3.0 (2023-03-22)

Bug Fixes

always return promise if async (#2728) (042dcc5)

fenced code doesn't need a trailing newline (#2756) (3acbb7f)

Features

add preprocess and postprocess hooks (#2730) (9b452bc)

v4.2.12

4.2.12 (2023-01-14)

Sorry for all of the quick releases. We were testing out different ways to build the files for releases. v4.2.5 - v4.2.12 have no changes to how marked works. The only addition is the version number in the comment in the build files.

Bug Fixes

revert to build script in ci (d2ab474)

v4.2.11

4.2.11 (2023-01-14)

Bug Fixes

just build in version (22ac2cf)

v4.2.10

4.2.10 (2023-01-14)

Bug Fixes

use version (fd759b3)

v4.2.9

4.2.9 (2023-01-14)

Bug Fixes

fix version (96380c3)

... (truncated)

Commits

d65cf63 chore(release): 4.3.0 [skip ci]
28f4342 🗜️ build v4.3.0 [skip ci]
9b452bc feat: add preprocess and postprocess hooks (#2730)
042dcc5 fix: always return promise if async (#2728)
3acbb7f fix: fenced code doesn't need a trailing newline (#2756)
d1f1319 chore(deps-dev): Bump rollup from 3.19.1 to 3.20.0 (#2760)
0ced8a5 chore(deps-dev): Bump jasmine from 4.5.0 to 4.6.0 (#2758)
a5bbe19 chore(deps-dev): Bump @babel/core from 7.21.0 to 7.21.3 (#2761)
00f6e2a chore(deps-dev): Bump semantic-release from 20.1.1 to 20.1.3 (#2759)
8c7bca8 chore(deps-dev): Bump node-fetch from 3.3.0 to 3.3.1 (#2754)
Additional commits viewable in compare view

Updates picomatch from 2.2.2 to 2.3.2

Release notes

Sourced from picomatch's releases.

2.3.2

This is a security release fixing several security relevant issues.

What's Changed

fix: exception when glob pattern contains constructor by @Jason3S in micromatch/picomatch#144

Fix for CVE-2026-33671

Fix for CVE-2026-33672

Full Changelog: micromatch/picomatch@2.3.1...2.3.2

2.3.1

Fixed

Fixes bug when a pattern containing an expression after the closing parenthesis (/!(*.d).{ts,tsx}) was incorrectly converted to regexp (9f241ef).

Changed

Some documentation improvements (f81d236, 421e0e7).

2.2.3

Fixed

Do not skip pattern seperator for square brackets (fb08a30).

Set negatedExtGlob also if it does not span the whole pattern (032e3f5).

Changelog

Sourced from picomatch's changelog.

Release history

All notable changes to this project will be documented in this file.

The format is based on Keep a Changelog and this project adheres to Semantic Versioning.

Changelogs are for humans, not machines.

There should be an entry for every single version.

The same types of changes should be grouped.

Versions and sections should be linkable.

The latest version comes first.

The release date of each versions is displayed.

Mention whether you follow Semantic Versioning.

Changelog entries are classified using the following labels (from keep-a-changelog):

Added for new features.

Changed for changes in existing functionality.

Deprecated for soon-to-be removed features.

Removed for now removed features.

Fixed for any bug fixes.

Security in case of vulnerabilities.

4.0.0 (2024-02-07)

Fixes

Fix bad text values in parse #126, thanks to @connor4312

Changed

Remove process global to work outside of node #129, thanks to @styfle

Add sideEffects to package.json #128, thanks to @frandiox

Removed os, make compatible browser environment. See #124, thanks to @gwsbhqt

3.0.1

Fixes

... (truncated)

Commits

81cba8d Publish 2.3.2
fc1f6b6 Merge commit from fork
eec17ae Merge commit from fork
78f8ca4 Merge pull request #156 from micromatch/backport-144
3f4f10e Merge pull request #144 from Jason3S/jdent-object-properties
5467a5a 2.3.1
9f241ef Merge pull request #102 from micromatch/ISSUE-93_incorrect_extglob_expanding
ac3cb66 fix: support stars in negation extglobs with expression after closing parenth...
719d348 Merge pull request #85 from XhmikosR/codeql
ac74e57 Merge pull request #91 from XhmikosR/patch-1
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by danez, a new releaser for picomatch since your current version.

Updates tar from 4.4.19 to 6.2.1

Release notes

Sourced from tar's releases.

v6.1.13

6.1.13 (2022-12-07)

Dependencies

cc4e0dd #343 bump minipass from 3.3.6 to 4.0.0

v6.1.12

6.1.12 (2022-10-31)

Bug Fixes

57493ee #332 ensuring close event is emited after stream has ended (@webark)

b003c64 #314 replace deprecated String.prototype.substr() (#314) (@CommanderRoot, @lukekarrys)

Documentation

f129929 #313 remove dead link to benchmarks (#313) (@yetzt)

c1faa9f add examples/explanation of using tar.t (@isaacs)

Changelog

Sourced from tar's changelog.

Changelog

7.5

Added zstd compression support.

Consistent TOCTOU behavior in sync t.list

Only read from ustar block if not specified in Pax

Fix sync tar.list when file size reduces while reading

Sanitize absolute linkpaths properly

Prevent writing hardlink entries to the archive ahead of their file target

7.4

Deprecate onentry in favor of onReadEntry for clarity.

7.3

Add onWriteEntry option

7.2

DRY the command definitions into a single makeCommand method, and update the type signatures to more appropriately infer the return type from the options and arguments provided.

7.1

Update minipass to v7.1.0

Update the type definitions of write() and end() methods on Unpack and Parser classes to be compatible with the NodeJS.WritableStream type in the latest versions of @types/node.

7.0

Drop support for node <18

Rewrite in TypeScript, provide ESM and CommonJS hybrid interface

Add tree-shake friendly exports, like import('tar/create') and import('tar/read-entry') to get individual functions or classes.

Add chmod option that defaults to false, and deprecate noChmod. That is, reverse the default option regarding explicitly setting file system modes to match tar entry settings.

Add processUmask option to avoid having to call process.umask() when chmod: true (or noChmod: false) is set.

... (truncated)

Commits

bef7b1e 6.2.1
fe8cd57 prevent extraction in excessively deep subfolders
fe7ebfd remove security.md
5bc9d40 6.2.0
fe1ef5e changelog 6.2
e483220 get rid of npm lint stuff
689928a ci that works outside of npm org
db6f539 file inference improvements for .tbr and .tgz
336fa8f refactor: dry and other pr comments
eeba222 chore: lint fixes
Additional commits viewable in compare view

Updates yargs-parser from 7.0.0 to 18.1.3

Release notes

Sourced from yargs-parser's releases.

yargs-parser yargs-parser-v15.0.3

Bug Fixes

build: should use releases_created when using manifest (49ea4ef)

yargs-parser yargs-parser-v15.0.2

Bug Fixes

perf: address slow parse when using unknown-options-as-args (#400) (bc387ec)

Changelog

Sourced from yargs-parser's changelog.

18.1.3 (2020-04-16)

Bug Fixes

setArg: op...
Description has been truncated

…pdates Bumps the npm_and_yarn group with 6 updates in the / directory: | Package | From | To | | --- | --- | --- | | [lodash](https://github.com/lodash/lodash) | `4.17.21` | `4.18.1` | | [rollup](https://github.com/rollup/rollup) | `2.79.2` | `2.80.0` | | [semantic-release](https://github.com/semantic-release/semantic-release) | `17.4.7` | `19.0.3` | | [follow-redirects](https://github.com/follow-redirects/follow-redirects) | `1.15.6` | `1.16.0` | | [js-yaml](https://github.com/nodeca/js-yaml) | `3.14.1` | `3.14.2` | | [picomatch](https://github.com/micromatch/picomatch) | `2.2.2` | `2.3.2` | Updates `lodash` from 4.17.21 to 4.18.1 - [Release notes](https://github.com/lodash/lodash/releases) - [Commits](lodash/lodash@4.17.21...4.18.1) Updates `rollup` from 2.79.2 to 2.80.0 - [Release notes](https://github.com/rollup/rollup/releases) - [Changelog](https://github.com/rollup/rollup/blob/v2.80.0/CHANGELOG.md) - [Commits](rollup/rollup@v2.79.2...v2.80.0) Updates `semantic-release` from 17.4.7 to 19.0.3 - [Release notes](https://github.com/semantic-release/semantic-release/releases) - [Commits](semantic-release/semantic-release@v17.4.7...v19.0.3) Updates `@octokit/plugin-paginate-rest` from 2.11.0 to 6.1.2 - [Release notes](https://github.com/octokit/plugin-paginate-rest.js/releases) - [Commits](octokit/plugin-paginate-rest.js@v2.11.0...v6.1.2) Updates `@octokit/request-error` from 2.0.5 to 3.0.3 - [Release notes](https://github.com/octokit/request-error.js/releases) - [Commits](octokit/request-error.js@v2.0.5...v3.0.3) Updates `@octokit/request` from 5.4.14 to 6.2.8 - [Release notes](https://github.com/octokit/request.js/releases) - [Commits](octokit/request.js@v5.4.14...v6.2.8) Updates `@tootallnate/once` from 1.1.2 to 2.0.0 - [Release notes](https://github.com/TooTallNate/once/releases) - [Changelog](https://github.com/TooTallNate/once/blob/master/CHANGELOG.md) - [Commits](TooTallNate/once@1.1.2...2.0.0) Updates `follow-redirects` from 1.15.6 to 1.16.0 - [Release notes](https://github.com/follow-redirects/follow-redirects/releases) - [Commits](follow-redirects/follow-redirects@v1.15.6...v1.16.0) Updates `handlebars` from 4.7.7 to 4.7.9 - [Release notes](https://github.com/handlebars-lang/handlebars.js/releases) - [Changelog](https://github.com/handlebars-lang/handlebars.js/blob/v4.7.9/release-notes.md) - [Commits](handlebars-lang/handlebars.js@v4.7.7...v4.7.9) Updates `http-cache-semantics` from 3.8.1 to 4.2.0 - [Commits](https://github.com/kornelski/http-cache-semantics/commits) Updates `js-yaml` from 3.14.1 to 3.14.2 - [Changelog](https://github.com/nodeca/js-yaml/blob/master/CHANGELOG.md) - [Commits](nodeca/js-yaml@3.14.1...3.14.2) Updates `marked` from 2.0.1 to 4.3.0 - [Release notes](https://github.com/markedjs/marked/releases) - [Commits](markedjs/marked@v2.0.1...v4.3.0) Updates `picomatch` from 2.2.2 to 2.3.2 - [Release notes](https://github.com/micromatch/picomatch/releases) - [Changelog](https://github.com/micromatch/picomatch/blob/master/CHANGELOG.md) - [Commits](micromatch/picomatch@2.2.2...2.3.2) Updates `tar` from 4.4.19 to 6.2.1 - [Release notes](https://github.com/isaacs/node-tar/releases) - [Changelog](https://github.com/isaacs/node-tar/blob/main/CHANGELOG.md) - [Commits](isaacs/node-tar@v4.4.19...v6.2.1) Updates `yargs-parser` from 7.0.0 to 18.1.3 - [Release notes](https://github.com/yargs/yargs-parser/releases) - [Changelog](https://github.com/yargs/yargs-parser/blob/main/CHANGELOG.md) - [Commits](yargs/yargs-parser@v7.0.0...v18.1.3) --- updated-dependencies: - dependency-name: lodash dependency-version: 4.18.1 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: rollup dependency-version: 2.80.0 dependency-type: direct:development dependency-group: npm_and_yarn - dependency-name: semantic-release dependency-version: 19.0.3 dependency-type: direct:development dependency-group: npm_and_yarn - dependency-name: "@octokit/plugin-paginate-rest" dependency-version: 6.1.2 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: "@octokit/request-error" dependency-version: 3.0.3 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: "@octokit/request" dependency-version: 6.2.8 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: "@tootallnate/once" dependency-version: 2.0.0 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: follow-redirects dependency-version: 1.16.0 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: handlebars dependency-version: 4.7.9 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: http-cache-semantics dependency-version: 4.2.0 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: js-yaml dependency-version: 3.14.2 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: marked dependency-version: 4.3.0 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: picomatch dependency-version: 2.3.2 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: tar dependency-version: 6.2.1 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: yargs-parser dependency-version: 18.1.3 dependency-type: indirect dependency-group: npm_and_yarn ... Signed-off-by: dependabot[bot] <support@github.com>

socket-security · 2026-04-23T01:05:15Z

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Package	Supply Chain Security	Vulnerability	Quality	Maintenance
rollup@2.79.2 ⏵ 2.80.0	⁺¹	⁺¹⁶
lodash@4.17.21 ⏵ 4.18.1	⁺¹	⁺¹⁹	⁺¹
semantic-release@17.4.7 ⏵ 19.0.3	⁺¹	⁺²		⁺²

View full report

socket-security · 2026-04-23T01:05:16Z

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action	Severity	Alert (click "▶" to expand/collapse)
Warn		License policy violation: npm `npm` under CC-BY-3.0 License: CC-BY-3.0 - The applicable license policy does not permit this license (5) (package/node_modules/spdx-exceptions/package.json) From: `?` → `npm/semantic-release@19.0.3` → `npm/npm@8.19.4` ℹ Read more on: This package \| This alert \| What is a license policy violation? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/npm@8.19.4`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report

dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Apr 23, 2026

github-management-service added dependabot-semver-unknown alert-severity-MODERATE labels Apr 23, 2026

github-management-service requested a review from a team April 23, 2026 01:04

github-management-service added the dependabot-failed-tests label Apr 23, 2026

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

build(deps): bump the npm_and_yarn group across 1 directory with 15 updates#175

build(deps): bump the npm_and_yarn group across 1 directory with 15 updates#175
dependabot[bot] wants to merge 1 commit intomasterfrom
dependabot/npm_and_yarn/npm_and_yarn-8b6f720c45

dependabot Bot commented on behalf of github Apr 23, 2026 •

edited by github-management-service

Loading

Uh oh!

socket-security Bot commented Apr 23, 2026

Uh oh!

socket-security Bot commented Apr 23, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

dependabot Bot commented on behalf of github Apr 23, 2026 • edited by github-management-service Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

4.18.1

Bugs

4.18.0

v4.18.0

Security

Docs

lodash.* modular packages

2.80.0

Features

Pull Requests

v6.1.2

6.1.2 (2023-05-19)

Bug Fixes

v6.1.1

6.1.1 (2023-05-19)

Bug Fixes

v6.1.0

6.1.0 (2023-05-12)

Features

v6.0.0

6.0.0 (2023-01-20)

Features

BREAKING CHANGES

v5.0.1

5.0.1 (2022-10-13)

Bug Fixes

v5.0.0

5.0.0 (2022-10-13)

Bug Fixes

v3.0.3

3.0.3 (2023-01-20)

Bug Fixes

v3.0.2

3.0.2 (2022-10-13)

Bug Fixes

v3.0.1

3.0.1 (2022-08-15)

Bug Fixes

v3.0.0

3.0.0 (2022-07-08)

Continuous Integration

BREAKING CHANGES

v2.1.0

2.1.0 (2021-06-11)

Features

v2.0.6

2.0.6 (2021-06-11)

Bug Fixes

v6.2.8

6.2.8 (2023-06-16)

Reverts

v6.2.7

6.2.7 (2023-06-16)

Bug Fixes

v6.2.6

6.2.6 (2023-06-13)

Bug Fixes

v6.2.5

6.2.5 (2023-05-18)

Bug Fixes

v6.2.4

6.2.4 (2023-05-16)

Bug Fixes

v6.2.3

6.2.3 (2023-01-21)

Bug Fixes

v6.2.2

6.2.2 (2022-10-13)

2.0.0

Major Changes

Minor Changes

Patches

Credits

v4.7.9

v4.7.8

v4.7.9 - March 26th, 2026

v4.7.8 - July 27th, 2023

dependabot Bot commented on behalf of github Apr 23, 2026 •

edited by github-management-service

Loading

`lodash.*` modular packages