chore: bump lodash-es from 4.17.23 to 4.18.1 in /web by dependabot[bot] · Pull Request #986 · Aureliolo/synthorg

dependabot · 2026-04-02T07:20:42Z

Bumps lodash-es from 4.17.23 to 4.18.1.

Release notes

4.18.1

Bugs

Fixes a ReferenceError issue in lodash lodash-es lodash-amd and lodash.template when using the template and fromPairs functions from the modular builds. See lodash/lodash#6167

These defects were related to how lodash distributions are built from the main branch using https://github.com/lodash-archive/lodash-cli. When internal dependencies change inside lodash functions, equivalent updates need to be made to a mapping in the lodash-cli. (hey, it was ahead of its time once upon a time!). We know this, but we missed it in the last release. It's the kind of thing that passes in CI, but fails bc the build is not the same thing you tested.

There is no diff on main for this, but you can see the diffs for each of the npm packages on their respective branches:

lodash: lodash/lodash@4.18.0-npm...4.18.1-npm

lodash-es: lodash/lodash@4.18.0-es...4.18.1-es

lodash-amd: lodash/lodash@4.18.0-amd...4.18.1-amd

lodash.templatelodash/lodash@4.18.0-npm-packages...4.18.1-npm-packages

4.18.0

v4.18.0

Full Changelog: lodash/lodash@4.17.23...4.18.0

Security

_.unset / _.omit: Fixed prototype pollution via constructor/prototype path traversal (GHSA-f23m-r3pf-42rh, fe8d32e). Previously, array-wrapped path segments and primitive roots could bypass the existing guards, allowing deletion of properties from built-in prototypes. Now constructor and prototype are blocked unconditionally as non-terminal path keys, matching baseSet. Calls that previously returned true and deleted the property now return false and leave the target untouched.

_.template: Fixed code injection via imports keys (GHSA-r5fr-rjxr-66jc, CVE-2026-4800, 879aaa9). Fixes an incomplete patch for CVE-2021-23337. The variable option was validated against reForbiddenIdentifierChars but importsKeys was left unguarded, allowing code injection via the same Function() constructor sink. imports keys containing forbidden identifier characters now throw "Invalid imports option passed into _.template".

Docs

Add security notice for _.template in threat model and API docs (#6099)

Document lower > upper behavior in _.random (#6115)

Fix quotes in _.compact jsdoc (#6090)

lodash.* modular packages

Diff

We have also regenerated and published a select number of the lodash.* modular packages.

These modular packages had fallen out of sync significantly from the minor/patch updates to lodash. Specifically, we have brought the following packages up to parity w/ the latest lodash release because they have had CVEs on them in the past:

lodash.orderby

lodash.tonumber

lodash.trim

lodash.trimend

lodash.sortedindexby

lodash.zipobjectdeep

lodash.unset

lodash.omit

lodash.template

Commits

cb0b9b9 release(patch): bump main to 4.18.1 (#6177)
75535f5 chore: prune stale advisory refs (#6170)
62e91bc docs: remove n_ Node.js < 6 REPL note from README (#6165)
59be2de release(minor): bump to 4.18.0 (#6161)
af63457 fix: broken tests for _.template 879aaa9
1073a76 fix: linting issues
879aaa9 fix: validate imports keys in _.template
fe8d32e fix: block prototype pollution in baseUnset via constructor/prototype traversal
18ba0a3 refactor(fromPairs): use baseAssignValue for consistent assignment (#6153)
b819080 ci: add dist sync validation workflow (#6137)
Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
You can disable automated security fix PRs for this repo from the Security Alerts page.

Bumps [lodash-es](https://github.com/lodash/lodash) from 4.17.23 to 4.18.1. - [Release notes](https://github.com/lodash/lodash/releases) - [Commits](lodash/lodash@4.17.23...4.18.1) --- updated-dependencies: - dependency-name: lodash-es dependency-version: 4.18.1 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com>

github-actions · 2026-04-02T07:22:57Z

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

Snapshot Warnings

⚠️: No snapshots were found for the head SHA a09949a.

Ensure that dependencies are being submitted on PR branches. Re-running this action after a short time may resolve the issue. See the documentation for more information and troubleshooting advice.

OpenSSF Scorecard

Package

Version

Score

Details

npm/lodash-es

4.18.1

🟢 7.1

Details

Check	Score	Reason
Binary-Artifacts	🟢 10	no binaries found in the repo
Branch-Protection	⚠️ -1	internal error: error during branchesHandler.setup: internal error: githubv4.Query: Resource not accessible by integration
CI-Tests	🟢 8	23 out of 26 merged PRs checked by a CI test -- score normalized to 8
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
Code-Review	🟢 8	Found 25/30 approved changesets -- score normalized to 8
Contributors	🟢 10	project has 89 contributing companies or organizations
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
Dependency-Update-Tool	🟢 10	update tool detected
Fuzzing	🟢 10	project is fuzzed
License	🟢 9	license file detected
Maintained	🟢 10	14 commit(s) and 12 issue activity found in the last 90 days -- score normalized to 10
Packaging	⚠️ -1	packaging workflow not detected
Pinned-Dependencies	⚠️ 1	dependency not pinned by hash detected -- score normalized to 1
SAST	🟢 9	SAST tool detected but not run on all commits
Security-Policy	🟢 10	security policy file detected
Signed-Releases	⚠️ -1	no releases found
Token-Permissions	⚠️ 0	detected GitHub workflow tokens with excessive permissions
Vulnerabilities	⚠️ 0	94 existing vulnerabilities detected

Scanned Files

web/package-lock.json

Aureliolo · 2026-04-02T07:34:29Z

Consolidated into #987 -- lodash-es update applied there alongside lodash.

dependabot · 2026-04-02T07:34:32Z

OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting @dependabot ignore this major version or @dependabot ignore this minor version. You can also ignore all major, minor, or patch releases for a dependency by adding an ignore condition with the desired update_types to your config file.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.

- lodash-es 4.17.23 -> 4.18.1 (security: prototype pollution, code injection) - @eslint-react/eslint-plugin 3.0.0 -> 4.2.1 (major: remove stale component-hook-factories disables) - @codemirror/view 6.40.0 -> 6.41.0 - @tanstack/react-query 5.96.0 -> 5.96.1 - @playwright/test 1.59.0 -> 1.59.1 (Windows console fix) - @storybook/* 10.3.3 -> 10.3.4 (a11y flake fix, CSF4 Vitest fix) - esbuild 0.27.4 -> 0.27.5 - Full lockfile refresh for transitive deps - Document bash -c workaround for npm --prefix limitation

…ywright, esbuild, codemirror) (#987) Consolidates #986 and #990 into a single web dependency update PR. ### Security fixes (lodash 4.17.23 -> 4.18.1) - **`_.unset` / `_.omit`**: Prototype pollution via constructor/prototype path traversal (GHSA-f23m-r3pf-42rh) - **`_.template`**: Code injection via imports keys (GHSA-r5fr-rjxr-66jc, CVE-2026-4800) ### Package updates | Package | From | To | Type | |---------|------|----|------| | lodash | 4.17.23 | 4.18.1 | security (transitive via inquirer) | | lodash-es | 4.17.23 | 4.18.1 | security (transitive via lighthouse) | | @eslint-react/eslint-plugin | 3.0.0 | 4.2.1 | major (rule prefix flattening, removed component-hook-factories) | | @codemirror/view | 6.40.0 | 6.41.0 | minor (posAtCoords fix, cursorScrollMargin) | | @tanstack/react-query | 5.96.0 | 5.96.1 | patch (DTS rollup fix) | | @playwright/test | 1.59.0 | 1.59.1 | patch (Windows console regression fix) | | @storybook/* (5 pkgs) | 10.3.3 | 10.3.4 | patch (a11y flake fix, CSF4 Vitest fix) | | esbuild | 0.27.4 | 0.27.5 | patch (metafile regression, async generator fix) | ### Additional changes - Full lockfile refresh for all transitive deps - Removed 11 stale `@eslint-react/component-hook-factories` disable comments (rule removed in v4) - Document `bash -c` workaround for `npm --prefix` limitation in CLAUDE.md Closes #986 --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Aurelio <19254254+Aureliolo@users.noreply.github.com>

dependabot bot added dependencies Pull requests that update a dependency file scope:web Vue 3 dashboard type:chore Maintenance, cleanup, dependency updates labels Apr 2, 2026

dependabot bot requested a review from Aureliolo as a code owner April 2, 2026 07:20

Aureliolo added a commit that referenced this pull request Apr 2, 2026

chore: also bump lodash-es to 4.18.1 (consolidate #986)

d4c1b6d

Aureliolo closed this Apr 2, 2026

dependabot bot deleted the dependabot/npm_and_yarn/web/lodash-es-4.18.1 branch April 2, 2026 07:34

Aureliolo mentioned this pull request Apr 2, 2026

chore: bump web dependencies (lodash, eslint-react v4, storybook, playwright, esbuild, codemirror) #987

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

chore: bump lodash-es from 4.17.23 to 4.18.1 in /web#986

chore: bump lodash-es from 4.17.23 to 4.18.1 in /web#986
dependabot[bot] wants to merge 1 commit intomainfrom
dependabot/npm_and_yarn/web/lodash-es-4.18.1

dependabot bot commented on behalf of github Apr 2, 2026

Uh oh!

github-actions bot commented Apr 2, 2026

Uh oh!

Aureliolo commented Apr 2, 2026

Uh oh!

dependabot bot commented on behalf of github Apr 2, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

dependabot bot commented on behalf of github Apr 2, 2026

4.18.1

Bugs

4.18.0

v4.18.0

Security

Docs

lodash.* modular packages

Uh oh!

github-actions bot commented Apr 2, 2026

Dependency Review

Snapshot Warnings

OpenSSF Scorecard

Scanned Files

Uh oh!

Aureliolo commented Apr 2, 2026

Uh oh!

dependabot bot commented on behalf of github Apr 2, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

`lodash.*` modular packages