Skip to content

Bump lodash from 4.17.23 to 4.18.1 in the utilities group across 1 directory#3630

Merged
dev-dist merged 1 commit intomainfrom
dependabot/npm_and_yarn/utilities-52571dc7e9
Apr 7, 2026
Merged

Bump lodash from 4.17.23 to 4.18.1 in the utilities group across 1 directory#3630
dev-dist merged 1 commit intomainfrom
dependabot/npm_and_yarn/utilities-52571dc7e9

Conversation

@dependabot
Copy link
Copy Markdown
Contributor

@dependabot dependabot bot commented on behalf of github Apr 5, 2026 •
edited
Loading

Bumps the utilities group with 1 update in the / directory: lodash.

Updates lodash from 4.17.23 to 4.18.1

Release notes

Sourced from lodash's releases.

4.18.1

Bugs

Fixes a ReferenceError issue in lodash lodash-es lodash-amd and lodash.template when using the template and fromPairs functions from the modular builds. See lodash/lodash#6167

These defects were related to how lodash distributions are built from the main branch using https://github.com/lodash-archive/lodash-cli. When internal dependencies change inside lodash functions, equivalent updates need to be made to a mapping in the lodash-cli. (hey, it was ahead of its time once upon a time!). We know this, but we missed it in the last release. It's the kind of thing that passes in CI, but fails bc the build is not the same thing you tested.

There is no diff on main for this, but you can see the diffs for each of the npm packages on their respective branches:

4.18.0

v4.18.0

Full Changelog: lodash/lodash@4.17.23...4.18.0

Security

_.unset / _.omit: Fixed prototype pollution via constructor/prototype path traversal (GHSA-f23m-r3pf-42rh, fe8d32e). Previously, array-wrapped path segments and primitive roots could bypass the existing guards, allowing deletion of properties from built-in prototypes. Now constructor and prototype are blocked unconditionally as non-terminal path keys, matching baseSet. Calls that previously returned true and deleted the property now return false and leave the target untouched.

_.template: Fixed code injection via imports keys (GHSA-r5fr-rjxr-66jc, CVE-2026-4800, 879aaa9). Fixes an incomplete patch for CVE-2021-23337. The variable option was validated against reForbiddenIdentifierChars but importsKeys was left unguarded, allowing code injection via the same Function() constructor sink. imports keys containing forbidden identifier characters now throw "Invalid imports option passed into _.template".

Docs

  • Add security notice for _.template in threat model and API docs (#6099)
  • Document lower > upper behavior in _.random (#6115)
  • Fix quotes in _.compact jsdoc (#6090)

lodash.* modular packages

Diff

We have also regenerated and published a select number of the lodash.* modular packages.

These modular packages had fallen out of sync significantly from the minor/patch updates to lodash. Specifically, we have brought the following packages up to parity w/ the latest lodash release because they have had CVEs on them in the past:

Commits
  • cb0b9b9 release(patch): bump main to 4.18.1 (#6177)
  • 75535f5 chore: prune stale advisory refs (#6170)
  • 62e91bc docs: remove n_ Node.js < 6 REPL note from README (#6165)
  • 59be2de release(minor): bump to 4.18.0 (#6161)
  • af63457 fix: broken tests for _.template 879aaa9
  • 1073a76 fix: linting issues
  • 879aaa9 fix: validate imports keys in _.template
  • fe8d32e fix: block prototype pollution in baseUnset via constructor/prototype traversal
  • 18ba0a3 refactor(fromPairs): use baseAssignValue for consistent assignment (#6153)
  • b819080 ci: add dist sync validation workflow (#6137)
  • Additional commits viewable in compare view

@dependabot dependabot bot requested a review from a team as a code owner April 5, 2026 22:08
@vercel
Copy link
Copy Markdown

vercel bot commented Apr 5, 2026 •
edited
Loading

The latest updates on your projects. Learn more about Vercel for GitHub.

Project Deployment Actions Updated (UTC)
documentation Ready Ready Preview Apr 7, 2026 6:36pm

Request Review

@dependabot dependabot bot changed the title Bump lodash from 4.17.23 to 4.18.1 in the utilities group Bump lodash from 4.17.23 to 4.18.1 in the utilities group across 1 directory Apr 7, 2026
@dependabot dependabot bot force-pushed the dependabot/npm_and_yarn/utilities-52571dc7e9 branch from 64f4a70 to 7246e10 Compare April 7, 2026 18:28
@dev-dist dev-dist enabled auto-merge (squash) April 7, 2026 18:29
@dependabot
Bump lodash from 4.17.23 to 4.18.1 in the utilities group
7fc6760 
Bumps the utilities group with 1 update: [lodash](https://github.com/lodash/lodash).


Updates `lodash` from 4.17.23 to 4.18.1
- [Release notes](https://github.com/lodash/lodash/releases)
- [Commits](lodash/lodash@4.17.23...4.18.1)

---
updated-dependencies:
- dependency-name: lodash
  dependency-version: 4.18.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: utilities
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot bot force-pushed the dependabot/npm_and_yarn/utilities-52571dc7e9 branch from 7246e10 to 7fc6760 Compare April 7, 2026 18:33
@dev-dist dev-dist merged commit c3b5772 into main Apr 7, 2026
22 of 23 checks passed
@dev-dist dev-dist deleted the dependabot/npm_and_yarn/utilities-52571dc7e9 branch April 7, 2026 18:37
SyedAsadKazmi added a commit that referenced this pull request Apr 10, 2026
@SyedAsadKazmi @sebastian-lerner-link
@github-actions @khadni @dev-dist @dependabot @gfletcher-cll @dangitsdavid
Add CCIP TON (#3613)
ca45516 
* Add CCIP TON

* Data Feeds: add Bob, Katana, Sonic, TRON, Plasma, Monad to deprecating feeds chainlist (#3614)

Made-with: Cursor

Co-authored-by: Sebastian Lerner <sebastian.lerner2@gmail.com>

* Data: Update changelog for new data items (#3606)

Co-authored-by: khadni <98668332+khadni@users.noreply.github.com>
Co-authored-by: devin distefano <devin.distefano@smartcontract.com>

* Bump the astro-framework group with 2 updates (#3608)

Bumps the astro-framework group with 2 updates: [@astrojs/partytown](https://github.com/withastro/astro/tree/HEAD/packages/integrations/partytown) and [@astrojs/sitemap](https://github.com/withastro/astro/tree/HEAD/packages/integrations/sitemap).


Updates `@astrojs/partytown` from 2.1.5 to 2.1.6
- [Release notes](https://github.com/withastro/astro/releases)
- [Changelog](https://github.com/withastro/astro/blob/main/packages/integrations/partytown/CHANGELOG.md)
- [Commits](https://github.com/withastro/astro/commits/@astrojs/partytown@2.1.6/packages/integrations/partytown)

Updates `@astrojs/sitemap` from 3.7.1 to 3.7.2
- [Release notes](https://github.com/withastro/astro/releases)
- [Changelog](https://github.com/withastro/astro/blob/main/packages/integrations/sitemap/CHANGELOG.md)
- [Commits](https://github.com/withastro/astro/commits/@astrojs/sitemap@3.7.2/packages/integrations/sitemap)

---
updated-dependencies:
- dependency-name: "@astrojs/partytown"
  dependency-version: 2.1.6
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: astro-framework
- dependency-name: "@astrojs/sitemap"
  dependency-version: 3.7.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: astro-framework
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* Bump react-instantsearch in the documentation group (#3609)

Bumps the documentation group with 1 update: [react-instantsearch](https://github.com/algolia/instantsearch).


Updates `react-instantsearch` from 7.28.0 to 7.28.1
- [Release notes](https://github.com/algolia/instantsearch/releases)
- [Commits](https://github.com/algolia/instantsearch/compare/react-instantsearch@7.28.0...react-instantsearch@7.28.1)

---
updated-dependencies:
- dependency-name: react-instantsearch
  dependency-version: 7.28.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: documentation
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* Bump @supabase/supabase-js from 2.99.3 to 2.100.1 (#3611)

Bumps [@supabase/supabase-js](https://github.com/supabase/supabase-js/tree/HEAD/packages/core/supabase-js) from 2.99.3 to 2.100.1.
- [Release notes](https://github.com/supabase/supabase-js/releases)
- [Changelog](https://github.com/supabase/supabase-js/blob/master/packages/core/supabase-js/CHANGELOG.md)
- [Commits](https://github.com/supabase/supabase-js/commits/v2.100.1/packages/core/supabase-js)

---
updated-dependencies:
- dependency-name: "@supabase/supabase-js"
  dependency-version: 2.100.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* Update fee table (#3603)

* Add tempo-testnet-moderato, deprecate tempo-testnet, and directory refresh (#3615)

* cre cli 1.9.0 release (#3616)

* cre edge case docs (#3617)

* update rmn callout (#3619)

* atlas updates (#3620)

* docs: reorganize Selecting Data Feeds page structure (#3621)

* Data Feeds: add Bob, Katana, Sonic, TRON, Plasma, Monad to deprecating feeds chainlist

Made-with: Cursor

* docs: reorganize Selecting Data Feeds — separate risk tiers from Market Price Feeds

- Add "Market pricing risk by category" section for Low through Deprecating tiers
- Move "Market Price Feeds" and "Bounded Market Price Feeds" next to Exchange Rate Feeds
- Preserve anchors #market-price-feeds and #bounded-market-price-feeds
- Fix typo: "ice mitigation" → "risk mitigation" in Exchange Rate Feeds aside
- Sync llms-full.txt with selecting-data-feeds.mdx

Made-with: Cursor

---------

Co-authored-by: Sebastian Lerner <sebastian.lerner2@gmail.com>
Co-authored-by: devin distefano <devin.distefano@smartcontract.com>

* fixes

* Add Yee, apxUSD, apyUSD tokens, and directory refresh (#3622)

* typo (#3635)

* Add Conceptual Docs

* Bump fuse.js from 7.1.0 to 7.3.0 (#3633)

Bumps [fuse.js](https://github.com/krisk/Fuse) from 7.1.0 to 7.3.0.
- [Release notes](https://github.com/krisk/Fuse/releases)
- [Changelog](https://github.com/krisk/Fuse/blob/main/CHANGELOG.md)
- [Commits](krisk/Fuse@v7.1.0...v7.3.0)

---
updated-dependencies:
- dependency-name: fuse.js
  dependency-version: 7.3.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: devin distefano <devin.distefano@smartcontract.com>

* Bump @supabase/supabase-js from 2.101.0 to 2.101.1 (#3632)

Bumps [@supabase/supabase-js](https://github.com/supabase/supabase-js/tree/HEAD/packages/core/supabase-js) from 2.101.0 to 2.101.1.
- [Release notes](https://github.com/supabase/supabase-js/releases)
- [Changelog](https://github.com/supabase/supabase-js/blob/master/packages/core/supabase-js/CHANGELOG.md)
- [Commits](https://github.com/supabase/supabase-js/commits/v2.101.1/packages/core/supabase-js)

---
updated-dependencies:
- dependency-name: "@supabase/supabase-js"
  dependency-version: 2.101.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: devin distefano <devin.distefano@smartcontract.com>

* Bump lodash from 4.17.23 to 4.18.1 in the utilities group (#3630)

Bumps the utilities group with 1 update: [lodash](https://github.com/lodash/lodash).


Updates `lodash` from 4.17.23 to 4.18.1
- [Release notes](https://github.com/lodash/lodash/releases)
- [Commits](lodash/lodash@4.17.23...4.18.1)

---
updated-dependencies:
- dependency-name: lodash
  dependency-version: 4.18.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: utilities
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* Bump react-instantsearch in the documentation group (#3629)

Bumps the documentation group with 1 update: [react-instantsearch](https://github.com/algolia/instantsearch).


Updates `react-instantsearch` from 7.28.1 to 7.29.0
- [Release notes](https://github.com/algolia/instantsearch/releases)
- [Commits](https://github.com/algolia/instantsearch/compare/react-instantsearch@7.28.1...react-instantsearch@7.29.0)

---
updated-dependencies:
- dependency-name: react-instantsearch
  dependency-version: 7.29.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: documentation
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* Bump ts-jest from 29.4.6 to 29.4.9 in the testing-tools group (#3627)

Bumps the testing-tools group with 1 update: [ts-jest](https://github.com/kulshekhar/ts-jest).


Updates `ts-jest` from 29.4.6 to 29.4.9
- [Release notes](https://github.com/kulshekhar/ts-jest/releases)
- [Changelog](https://github.com/kulshekhar/ts-jest/blob/main/CHANGELOG.md)
- [Commits](kulshekhar/ts-jest@v29.4.6...v29.4.9)

---
updated-dependencies:
- dependency-name: ts-jest
  dependency-version: 29.4.9
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: testing-tools
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* Bump @types/node from 20.19.37 to 20.19.39 in the typescript group (#3628)

Bumps the typescript group with 1 update: [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node).


Updates `@types/node` from 20.19.37 to 20.19.39
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node)

---
updated-dependencies:
- dependency-name: "@types/node"
  dependency-version: 20.19.39
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: typescript
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* Bump the ui-frameworks group across 1 directory with 3 updates (#3637)

Bumps the ui-frameworks group with 3 updates in the / directory: [preact](https://github.com/preactjs/preact), [swagger-ui-dist](https://github.com/swagger-api/swagger-ui) and [swagger-ui-react](https://github.com/swagger-api/swagger-ui).


Updates `preact` from 10.29.0 to 10.29.1
- [Release notes](https://github.com/preactjs/preact/releases)
- [Commits](preactjs/preact@10.29.0...10.29.1)

Updates `swagger-ui-dist` from 5.32.1 to 5.32.2
- [Release notes](https://github.com/swagger-api/swagger-ui/releases)
- [Commits](swagger-api/swagger-ui@v5.32.1...v5.32.2)

Updates `swagger-ui-react` from 5.32.1 to 5.32.2
- [Release notes](https://github.com/swagger-api/swagger-ui/releases)
- [Commits](swagger-api/swagger-ui@v5.32.1...v5.32.2)

---
updated-dependencies:
- dependency-name: preact
  dependency-version: 10.29.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: ui-frameworks
- dependency-name: swagger-ui-dist
  dependency-version: 5.32.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: ui-frameworks
- dependency-name: swagger-ui-react
  dependency-version: 5.32.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: ui-frameworks
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* Bump solhint from 6.1.0 to 6.2.1 in the blockchain group (#3625)

Bumps the blockchain group with 1 update: [solhint](https://github.com/protofire/solhint).


Updates `solhint` from 6.1.0 to 6.2.1
- [Release notes](https://github.com/protofire/solhint/releases)
- [Changelog](https://github.com/protofire/solhint/blob/develop/CHANGELOG.md)
- [Commits](protofire/solhint@v6.1.0...v6.2.1)

---
updated-dependencies:
- dependency-name: solhint
  dependency-version: 6.2.1
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: blockchain
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* remove deprecated chains (#3636)

* update supported postgresql versions for chainlink nodes (#3639)

* Changelog Update: New data found (#3623)

* Data: Update changelog for new data items

* prettier fix

---------

Co-authored-by: khadni <98668332+khadni@users.noreply.github.com>
Co-authored-by: devin distefano <devin.distefano@smartcontract.com>

* Data Feeds: Stablecoin bound update (#3638)

* change bound to only diplsay when price is less than 2 USD

* change bound to only display when bound is less than 2 dollars

* fix(ccip/billing): simplify messaging network fee table and clarify note scope (#3640)

* Add API Refs

* Add `tempo-mainnet` & `ton-mainnet` networks, `WRON` token, and directory refresh (#3641)

* Add tempo-mainnet & ton-mainnet, WRON & USDC.e tokens, and directory refresh

* fixes

* Add CCIP TON

* fixes

* Add Conceptual Docs

* Add API Refs

* fixes

* update-changelog

---------

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: sebastian-lerner-link <sebastian.lerner@smartcontract.com>
Co-authored-by: Sebastian Lerner <sebastian.lerner2@gmail.com>
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: khadni <98668332+khadni@users.noreply.github.com>
Co-authored-by: devin distefano <devin.distefano@smartcontract.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: gfletcher-cll <grace.fletcher@smartcontract.com>
Co-authored-by: dangitsdavid <32752664+dangitsdavid@users.noreply.github.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@dev-dist dev-dist dev-dist approved these changes

Assignees

No one assigned

Labels

dependencies

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@dev-dist