Skip to content

chore: bump web dependencies (lodash, eslint-react v4, storybook, playwright, esbuild, codemirror)#987

Merged
Aureliolo merged 5 commits intomainfrom
dependabot/npm_and_yarn/web/lodash-4.18.1
Apr 2, 2026
Merged

chore: bump web dependencies (lodash, eslint-react v4, storybook, playwright, esbuild, codemirror)#987
Aureliolo merged 5 commits intomainfrom
dependabot/npm_and_yarn/web/lodash-4.18.1

Conversation

@dependabot
Copy link
Copy Markdown
Contributor

@dependabot dependabot bot commented on behalf of github Apr 2, 2026 •
edited by Aureliolo
Loading

Consolidates #986 and #990 into a single web dependency update PR.

Security fixes (lodash 4.17.23 -> 4.18.1)

Package updates

Package From To Type
lodash 4.17.23 4.18.1 security (transitive via inquirer)
lodash-es 4.17.23 4.18.1 security (transitive via lighthouse)
@eslint-react/eslint-plugin 3.0.0 4.2.1 major (rule prefix flattening, removed component-hook-factories)
@codemirror/view 6.40.0 6.41.0 minor (posAtCoords fix, cursorScrollMargin)
@tanstack/react-query 5.96.0 5.96.1 patch (DTS rollup fix)
@playwright/test 1.59.0 1.59.1 patch (Windows console regression fix)
@storybook/* (5 pkgs) 10.3.3 10.3.4 patch (a11y flake fix, CSF4 Vitest fix)
esbuild 0.27.4 0.27.5 patch (metafile regression, async generator fix)

Additional changes

  • Full lockfile refresh for all transitive deps
  • Removed 11 stale @eslint-react/component-hook-factories disable comments (rule removed in v4)
  • Document bash -c workaround for npm --prefix limitation in CLAUDE.md

Closes #986

@dependabot
chore: bump lodash from 4.17.23 to 4.18.1 in /web
e2302b6 
Bumps [lodash](https://github.com/lodash/lodash) from 4.17.23 to 4.18.1.
- [Release notes](https://github.com/lodash/lodash/releases)
- [Commits](lodash/lodash@4.17.23...4.18.1)

---
updated-dependencies:
- dependency-name: lodash
  dependency-version: 4.18.1
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot bot added dependencies Pull requests that update a dependency file scope:web Vue 3 dashboard type:chore Maintenance, cleanup, dependency updates labels Apr 2, 2026
@dependabot dependabot bot requested a review from Aureliolo as a code owner April 2, 2026 07:21
@github-actions
Copy link
Copy Markdown
Contributor

github-actions bot commented Apr 2, 2026 •
edited
Loading

Dependency Review

The following issues were found:

  • ✅ 0 vulnerable package(s)
  • ✅ 0 package(s) with incompatible licenses
  • ✅ 0 package(s) with invalid SPDX license definitions
  • ⚠️ 1 package(s) with unknown licenses.
  • ⚠️ 1 packages with OpenSSF Scorecard issues.

View full job summary

@Aureliolo Aureliolo mentioned this pull request Apr 2, 2026
Closed
@Aureliolo
chore: consolidate web dep updates (#986, #990)
e7e499d 
- lodash-es 4.17.23 -> 4.18.1 (security: prototype pollution, code injection)
- @eslint-react/eslint-plugin 3.0.0 -> 4.2.1 (major: remove stale component-hook-factories disables)
- @codemirror/view 6.40.0 -> 6.41.0
- @tanstack/react-query 5.96.0 -> 5.96.1
- @playwright/test 1.59.0 -> 1.59.1 (Windows console fix)
- @storybook/* 10.3.3 -> 10.3.4 (a11y flake fix, CSF4 Vitest fix)
- esbuild 0.27.4 -> 0.27.5
- Full lockfile refresh for transitive deps
- Document bash -c workaround for npm --prefix limitation
@Aureliolo Aureliolo mentioned this pull request Apr 2, 2026
Closed
@Aureliolo Aureliolo changed the title chore: bump lodash from 4.17.23 to 4.18.1 in /web chore: bump web dependencies (lodash, eslint-react v4, storybook, playwright, esbuild, codemirror) Apr 2, 2026
@socket-security
Copy link
Copy Markdown

socket-security bot commented Apr 2, 2026 •
edited
Loading

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff Package Supply Chain
Security		 Vulnerability Quality Maintenance License
Updatednpm/​@​codemirror/​view@​6.40.0 ⏵ 6.41.095 +110085 +197 +2100
Updatednpm/​@​eslint-react/​eslint-plugin@​3.0.0 ⏵ 4.2.19910010096100
Updatednpm/​@​playwright/​test@​1.59.0 ⏵ 1.59.110010010099100

View full report

@Aureliolo Aureliolo merged commit c344dfb into main Apr 2, 2026
28 checks passed
@Aureliolo Aureliolo deleted the dependabot/npm_and_yarn/web/lodash-4.18.1 branch April 2, 2026 08:01
@Aureliolo Aureliolo mentioned this pull request Apr 2, 2026
Merged
Aureliolo added a commit that referenced this pull request Apr 2, 2026
@Aureliolo @github-actions
chore(main): release 0.5.6 (#967)
1f67e54 
🤖 I have created a release *beep* *boop*
---


##
[0.5.6](v0.5.5...v0.5.6)
(2026-04-02)


### Features

* calendar + hybrid ceremony scheduling strategies
([#985](#985))
([59a9b84](59a9b84)),
closes [#969](#969)
[#970](#970)
* landing page interactive components
([#984](#984))
([49868cb](49868cb))
* log aggregation and shipping (syslog, HTTP, compression)
([#964](#964))
([84be9f8](84be9f8))
* restructure builtin templates into inheritance tree
([#982](#982))
([3794c12](3794c12))
* sprint ceremony runtime scheduler with pluggable strategies
([#983](#983))
([43564a9](43564a9))


### Maintenance

* add no-bash-file-writes rule to CLAUDE.md
([#968](#968))
([a854dcc](a854dcc))
* bump web dependencies (lodash, eslint-react v4, storybook, playwright,
esbuild, codemirror)
([#987](#987))
([c344dfb](c344dfb))

---
This PR was generated with [Release
Please](https://github.com/googleapis/release-please). See
[documentation](https://github.com/googleapis/release-please#release-please).

---------

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@Aureliolo Aureliolo Awaiting requested review from Aureliolo Aureliolo is a code owner

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file scope:web Vue 3 dashboard type:chore Maintenance, cleanup, dependency updates

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@Aureliolo