Skip to content

fix(deps): bump lodash and @microsoft/api-extractor#842

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/multi-4c254740be
Open

fix(deps): bump lodash and @microsoft/api-extractor#842
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/multi-4c254740be

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Apr 8, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps lodash and @microsoft/api-extractor. These dependencies needed to be updated together.
Updates lodash from 4.17.23 to 4.18.1

Release notes

Sourced from lodash's releases.

4.18.1

Bugs

Fixes a ReferenceError issue in lodash lodash-es lodash-amd and lodash.template when using the template and fromPairs functions from the modular builds. See lodash/lodash#6167

These defects were related to how lodash distributions are built from the main branch using https://github.com/lodash-archive/lodash-cli. When internal dependencies change inside lodash functions, equivalent updates need to be made to a mapping in the lodash-cli. (hey, it was ahead of its time once upon a time!). We know this, but we missed it in the last release. It's the kind of thing that passes in CI, but fails bc the build is not the same thing you tested.

There is no diff on main for this, but you can see the diffs for each of the npm packages on their respective branches:

4.18.0

v4.18.0

Full Changelog: lodash/lodash@4.17.23...4.18.0

Security

_.unset / _.omit: Fixed prototype pollution via constructor/prototype path traversal (GHSA-f23m-r3pf-42rh, fe8d32e). Previously, array-wrapped path segments and primitive roots could bypass the existing guards, allowing deletion of properties from built-in prototypes. Now constructor and prototype are blocked unconditionally as non-terminal path keys, matching baseSet. Calls that previously returned true and deleted the property now return false and leave the target untouched.

_.template: Fixed code injection via imports keys (GHSA-r5fr-rjxr-66jc, CVE-2026-4800, 879aaa9). Fixes an incomplete patch for CVE-2021-23337. The variable option was validated against reForbiddenIdentifierChars but importsKeys was left unguarded, allowing code injection via the same Function() constructor sink. imports keys containing forbidden identifier characters now throw "Invalid imports option passed into _.template".

Docs

  • Add security notice for _.template in threat model and API docs (#6099)
  • Document lower > upper behavior in _.random (#6115)
  • Fix quotes in _.compact jsdoc (#6090)

lodash.* modular packages

Diff

We have also regenerated and published a select number of the lodash.* modular packages.

These modular packages had fallen out of sync significantly from the minor/patch updates to lodash. Specifically, we have brought the following packages up to parity w/ the latest lodash release because they have had CVEs on them in the past:

Commits
  • cb0b9b9 release(patch): bump main to 4.18.1 (#6177)
  • 75535f5 chore: prune stale advisory refs (#6170)
  • 62e91bc docs: remove n_ Node.js < 6 REPL note from README (#6165)
  • 59be2de release(minor): bump to 4.18.0 (#6161)
  • af63457 fix: broken tests for _.template 879aaa9
  • 1073a76 fix: linting issues
  • 879aaa9 fix: validate imports keys in _.template
  • fe8d32e fix: block prototype pollution in baseUnset via constructor/prototype traversal
  • 18ba0a3 refactor(fromPairs): use baseAssignValue for consistent assignment (#6153)
  • b819080 ci: add dist sync validation workflow (#6137)
  • Additional commits viewable in compare view

Updates @microsoft/api-extractor from 7.56.3 to 7.58.1

Changelog

Sourced from @​microsoft/api-extractor's changelog.

7.58.1

Sat, 04 Apr 2026 00:14:00 GMT

Patches

7.58.0

Wed, 01 Apr 2026 15:13:38 GMT

Minor changes

  • Upgrade the bundled compiler engine to TypeScript 5.9.3

7.57.8

Tue, 31 Mar 2026 15:14:14 GMT

Version update only

7.57.7

Mon, 09 Mar 2026 15:14:07 GMT

Patches

  • Bump minimatch version from 10.2.1 to 10.2.3 to address CVE-2026-27903.

7.57.6

Wed, 25 Feb 2026 21:39:42 GMT

Patches

7.57.5

Wed, 25 Feb 2026 00:34:29 GMT

Version update only

7.57.4

Tue, 24 Feb 2026 01:13:27 GMT

Version update only

7.57.3

Mon, 23 Feb 2026 00:42:21 GMT

Patches

  • Add missing "./extends/*.json" to the package.json "exports" field so that "@​microsoft/api-extractor/extends/tsdoc-base.json" is importable.

... (truncated)

Commits

You can trigger a rebase of this PR by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
    You can disable automated security fix PRs for this repo from the Security Alerts page.

Note
Automatic rebases have been disabled on this pull request as it has been open for over 30 days.

@dependabot
fix(deps): bump lodash and @microsoft/api-extractor
1035de5 
Bumps [lodash](https://github.com/lodash/lodash) and [@microsoft/api-extractor](https://github.com/microsoft/rushstack/tree/HEAD/apps/api-extractor). These dependencies needed to be updated together.

Updates `lodash` from 4.17.23 to 4.18.1
- [Release notes](https://github.com/lodash/lodash/releases)
- [Commits](lodash/lodash@4.17.23...4.18.1)

Updates `@microsoft/api-extractor` from 7.56.3 to 7.58.1
- [Changelog](https://github.com/microsoft/rushstack/blob/main/apps/api-extractor/CHANGELOG.md)
- [Commits](https://github.com/microsoft/rushstack/commits/@microsoft/api-extractor_v7.58.1/apps/api-extractor)

---
updated-dependencies:
- dependency-name: lodash
  dependency-version: 4.18.1
  dependency-type: indirect
- dependency-name: "@microsoft/api-extractor"
  dependency-version: 7.58.1
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Apr 8, 2026
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Apr 8, 2026
@netlify

netlify Bot commented Apr 8, 2026 •
edited
Loading

Copy link
Copy Markdown

✅ Deploy Preview for phillips-seldon ready!

Name Link
🔨 Latest commit 1035de5
🔍 Latest deploy log https://app.netlify.com/projects/phillips-seldon/deploys/69d68a9595a08a0008b8b995
😎 Deploy Preview https://deploy-preview-842--phillips-seldon.netlify.app
📱 Preview on mobile
Toggle QR Code...

QR Code

Use your smartphone camera to open QR code link.

To edit notification comments on pull requests, go to your Netlify project configuration.

@github-actions

github-actions Bot commented Apr 8, 2026

Copy link
Copy Markdown

🚀 Storybook preview is ready.

• Preview: https://68b9f094608b90f3cfec5a06-wivgsialbr.chromatic.com/
• Chromatic build: https://www.chromatic.com/build?appId=68b9f094608b90f3cfec5a06&number=480

@scottdickerson

scottdickerson commented Jun 25, 2026

Copy link
Copy Markdown
Contributor

Dependency Upgrade Risk Assessment

Risk Level: low

What This Library Does & How We Use It

lodash is a utility library used in the development toolchain. @microsoft/api-extractor generates API type declarations for the published package. Neither is a runtime dependency in the published seldon bundle.

What Changed

lodash 4.17.23 → 4.18.1 (minor), @microsoft/api-extractor also updated

Risk Rationale

  • Breaking changes: no — minor patch fixing a ReferenceError bug in lodash
  • Usage breadth: dev/build pipeline only
  • Criticality: dev tooling — lodash is not in seldon's runtime dependencies; api-extractor only runs during publish

Regression Tests Checklist

Before merging, confirm:

  • bun run build completes without errors and produces expected dist output
  • bun test passes
  • Run bun run build and confirm the generated .d.ts type declarations are correct

Assessment performed automatically. Review and adjust if you have additional context.

@scottdickerson

scottdickerson commented Jun 25, 2026

Copy link
Copy Markdown
Contributor

Dependency Upgrade Risk Assessment

Risk Level: low

What This Library Does & How We Use It

lodash is a utility library used in the dev toolchain. @microsoft/api-extractor generates API type declarations for the published package. Neither is in seldon's runtime dependencies — they are dev tools only.

What Changed

lodash 4.17.23 → 4.18.1 (minor), @microsoft/api-extractor also updated

Risk Rationale

  • Breaking changes: no — minor patch fixing a ReferenceError bug in lodash
  • Usage breadth: dev/build pipeline only
  • Criticality: dev tooling — @microsoft/api-extractor runs during the publish step to generate .d.ts files; lodash is not in seldon's runtime dependencies

Regression Tests Checklist

Before merging, confirm:

  • bun run build completes without errors and produces expected dist output
  • bun test passes
  • Run bun run build and confirm the generated .d.ts type declarations are correct

Assessment performed automatically. Review and adjust if you have additional context.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@davidicus davidicus Awaiting requested review from davidicus davidicus is a code owner
@scottdickerson scottdickerson Awaiting requested review from scottdickerson scottdickerson is a code owner

At least 2 approving reviews are required to merge this pull request.

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file dependency-upgrade-risk:low javascript Pull requests that update javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@scottdickerson