Skip to content

chore(deps): bump lodash and verdaccio in /src - #760

Merged
ikemtz merged 1 commit into
masterfrom
dependabot/npm_and_yarn/src/multi-bcad7aace6
Aug 8, 2026
Merged

chore(deps): bump lodash and verdaccio in /src#760
ikemtz merged 1 commit into
masterfrom
dependabot/npm_and_yarn/src/multi-bcad7aace6

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Jul 27, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps lodash to 4.18.1 and updates ancestor dependency verdaccio. These dependencies need to be updated together.

Updates lodash from 4.17.21 to 4.18.1

Release notes

Sourced from lodash's releases.

4.18.1

Bugs

Fixes a ReferenceError issue in lodash lodash-es lodash-amd and lodash.template when using the template and fromPairs functions from the modular builds. See lodash/lodash#6167

These defects were related to how lodash distributions are built from the main branch using https://github.com/lodash-archive/lodash-cli. When internal dependencies change inside lodash functions, equivalent updates need to be made to a mapping in the lodash-cli. (hey, it was ahead of its time once upon a time!). We know this, but we missed it in the last release. It's the kind of thing that passes in CI, but fails bc the build is not the same thing you tested.

There is no diff on main for this, but you can see the diffs for each of the npm packages on their respective branches:

4.18.0

v4.18.0

Full Changelog: lodash/lodash@4.17.23...4.18.0

Security

_.unset / _.omit: Fixed prototype pollution via constructor/prototype path traversal (GHSA-f23m-r3pf-42rh, fe8d32e). Previously, array-wrapped path segments and primitive roots could bypass the existing guards, allowing deletion of properties from built-in prototypes. Now constructor and prototype are blocked unconditionally as non-terminal path keys, matching baseSet. Calls that previously returned true and deleted the property now return false and leave the target untouched.

_.template: Fixed code injection via imports keys (GHSA-r5fr-rjxr-66jc, CVE-2026-4800, 879aaa9). Fixes an incomplete patch for CVE-2021-23337. The variable option was validated against reForbiddenIdentifierChars but importsKeys was left unguarded, allowing code injection via the same Function() constructor sink. imports keys containing forbidden identifier characters now throw "Invalid imports option passed into _.template".

Docs

  • Add security notice for _.template in threat model and API docs (#6099)
  • Document lower > upper behavior in _.random (#6115)
  • Fix quotes in _.compact jsdoc (#6090)

lodash.* modular packages

Diff

We have also regenerated and published a select number of the lodash.* modular packages.

These modular packages had fallen out of sync significantly from the minor/patch updates to lodash. Specifically, we have brought the following packages up to parity w/ the latest lodash release because they have had CVEs on them in the past:

Commits
  • cb0b9b9 release(patch): bump main to 4.18.1 (#6177)
  • 75535f5 chore: prune stale advisory refs (#6170)
  • 62e91bc docs: remove n_ Node.js < 6 REPL note from README (#6165)
  • 59be2de release(minor): bump to 4.18.0 (#6161)
  • af63457 fix: broken tests for _.template 879aaa9
  • 1073a76 fix: linting issues
  • 879aaa9 fix: validate imports keys in _.template
  • fe8d32e fix: block prototype pollution in baseUnset via constructor/prototype traversal
  • 18ba0a3 refactor(fromPairs): use baseAssignValue for consistent assignment (#6153)
  • b819080 ci: add dist sync validation workflow (#6137)
  • Additional commits viewable in compare view

Updates verdaccio from 6.3.2 to 6.9.2

Release notes

Sourced from verdaccio's releases.

v6.9.2

Patch Changes

  • 297dc43: fix: apply package access controls to the starredByUser endpoint

    The GET /-/_view/starredByUser view did not enforce the configured package access policy when listing a user's starred packages. Results are now filtered through auth.allow_access, so the response only includes packages the requesting client is authorized to see.

  • 05917d5: Update verdaccio dependencies to the latest npm dist-tag (@verdaccio/ui-theme tracks next-9):

    • @verdaccio/ui-theme: 9.0.0-next-9.22 → 9.0.0-next-9.23

v6.9.1

Patch Changes

  • dfe3938: Update verdaccio dependencies to the latest npm dist-tag (@verdaccio/ui-theme tracks next-9):

    • @verdaccio/auth: 8.1.0 → 8.1.1
    • @verdaccio/config: 8.2.0 → 8.2.1
    • @verdaccio/core: 8.2.0 → 8.2.1
    • @verdaccio/hooks: 8.1.1 → 8.1.2
    • @verdaccio/loaders: 8.1.0 → 8.1.1
    • @verdaccio/local-storage-legacy: 11.4.0 → 11.4.1
    • @verdaccio/logger: 8.1.0 → 8.1.1
    • @verdaccio/middleware: 8.1.0 → 8.1.1
    • @verdaccio/package-filter: 13.1.0 → 13.1.1
    • @verdaccio/signature: 8.1.0 → 8.1.1
    • @verdaccio/tarball: 13.1.0 → 13.1.1
    • @verdaccio/ui-theme: 9.0.0-next-9.21 → 9.0.0-next-9.22
    • @verdaccio/url: 13.1.0 → 13.1.1
    • @verdaccio/utils: 8.2.0 → 8.2.1
    • verdaccio-audit: 13.1.0 → 13.1.1
    • verdaccio-htpasswd: 13.1.0 → 13.1.1

v6.9.0

Minor Changes

  • b67a665: feat: require Node.js 22 as the minimum supported version

    Node.js 22 or higher is now required (previously the CLI still accepted Node.js 18, while engines already demanded 20). The CLI refuses to start on older runtimes and engines is set to >=22; Node.js 24 is the recommended version. CI, e2e, and smoke test matrices now cover Node.js 22, 24, and 26. Registry operators on Node.js 18 or 20 must upgrade the runtime before taking this release.

  • b67a665: feat: dual CJS + ESM build with exports field, migrate build from babel to vite 8

    Native ESM support. The package now ships both CommonJS (build/**/*.js) and ESM

... (truncated)

Changelog

Sourced from verdaccio's changelog.

6.9.2

Patch Changes

  • 297dc43: fix: apply package access controls to the starredByUser endpoint

    The GET /-/_view/starredByUser view did not enforce the configured package access policy when listing a user's starred packages. Results are now filtered through auth.allow_access, so the response only includes packages the requesting client is authorized to see.

  • 05917d5: Update verdaccio dependencies to the latest npm dist-tag (@verdaccio/ui-theme tracks next-9):

    • @verdaccio/ui-theme: 9.0.0-next-9.22 → 9.0.0-next-9.23

6.9.1

Patch Changes

  • dfe3938: Update verdaccio dependencies to the latest npm dist-tag (@verdaccio/ui-theme tracks next-9):

    • @verdaccio/auth: 8.1.0 → 8.1.1
    • @verdaccio/config: 8.2.0 → 8.2.1
    • @verdaccio/core: 8.2.0 → 8.2.1
    • @verdaccio/hooks: 8.1.1 → 8.1.2
    • @verdaccio/loaders: 8.1.0 → 8.1.1
    • @verdaccio/local-storage-legacy: 11.4.0 → 11.4.1
    • @verdaccio/logger: 8.1.0 → 8.1.1
    • @verdaccio/middleware: 8.1.0 → 8.1.1
    • @verdaccio/package-filter: 13.1.0 → 13.1.1
    • @verdaccio/signature: 8.1.0 → 8.1.1
    • @verdaccio/tarball: 13.1.0 → 13.1.1
    • @verdaccio/ui-theme: 9.0.0-next-9.21 → 9.0.0-next-9.22
    • @verdaccio/url: 13.1.0 → 13.1.1
    • @verdaccio/utils: 8.2.0 → 8.2.1
    • verdaccio-audit: 13.1.0 → 13.1.1
    • verdaccio-htpasswd: 13.1.0 → 13.1.1

6.9.0

Minor Changes

  • b67a665: feat: require Node.js 22 as the minimum supported version

    Node.js 22 or higher is now required (previously the CLI still accepted Node.js 18, while engines already demanded 20). The CLI refuses to start on older runtimes and engines is set to >=22; Node.js 24 is the recommended version. CI, e2e, and smoke test matrices now cover Node.js 22, 24, and 26. Registry operators on Node.js 18 or 20 must upgrade the runtime before taking this release.

... (truncated)

Commits
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for verdaccio since your current version.

@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Jul 27, 2026
@socket-security

socket-security Bot commented Jul 27, 2026 •
edited
Loading

Copy link
Copy Markdown

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff Package Supply Chain
Security		 Vulnerability Quality Maintenance License
Updatedverdaccio@​6.3.2 ⏵ 6.9.296 +110010098 +2100

View full report

@socket-security

socket-security Bot commented Jul 27, 2026 •
edited
Loading

Copy link
Copy Markdown

All alerts resolved. Learn more about Socket for GitHub.

This PR previously contained dependency changes with security issues that have been resolved, removed, or ignored.

View full report

@dependabot
chore(deps): bump lodash and verdaccio in /src
fafdb89 
Bumps [lodash](https://github.com/lodash/lodash) to 4.18.1 and updates ancestor dependency [verdaccio](https://github.com/verdaccio/verdaccio). These dependencies need to be updated together.


Updates `lodash` from 4.17.21 to 4.18.1
- [Release notes](https://github.com/lodash/lodash/releases)
- [Commits](lodash/lodash@4.17.21...4.18.1)

Updates `verdaccio` from 6.3.2 to 6.9.2
- [Release notes](https://github.com/verdaccio/verdaccio/releases)
- [Changelog](https://github.com/verdaccio/verdaccio/blob/v6.9.2/CHANGELOG.md)
- [Commits](verdaccio/verdaccio@v6.3.2...v6.9.2)

---
updated-dependencies:
- dependency-name: lodash
  dependency-version: 4.18.1
  dependency-type: indirect
- dependency-name: verdaccio
  dependency-version: 6.9.0
  dependency-type: direct:development
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
dependabot Bot force-pushed the dependabot/npm_and_yarn/src/multi-bcad7aace6 branch from b0087f5 to fafdb89 Compare August 8, 2026 06:37
@ikemtz

ikemtz commented Aug 8, 2026

Copy link
Copy Markdown
Owner

@rebase

@ikemtz
ikemtz merged commit 693d463 into master Aug 8, 2026
9 checks passed
@ikemtz
ikemtz deleted the dependabot/npm_and_yarn/src/multi-bcad7aace6 branch August 8, 2026 14:11
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@ikemtz