Skip to content

Commit 410297b

Browse files
chore(deps): update dependency lodash to v4.17.23 [security] (#423)
This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Adoption](https://docs.renovatebot.com/merge-confidence/) | [Passing](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---|---|---| | [lodash](https://lodash.com/) ([source](https://redirect.github.com/lodash/lodash)) | [`4.17.21` → `4.17.23`](https://renovatebot.com/diffs/npm/lodash/4.17.21/4.17.23) | ![age](https://developer.mend.io/api/mc/badges/age/npm/lodash/4.17.23?slim=true) | ![adoption](https://developer.mend.io/api/mc/badges/adoption/npm/lodash/4.17.23?slim=true) | ![passing](https://developer.mend.io/api/mc/badges/compatibility/npm/lodash/4.17.21/4.17.23?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/lodash/4.17.21/4.17.23?slim=true) | ### GitHub Vulnerability Alerts #### [CVE-2025-13465](https://redirect.github.com/lodash/lodash/security/advisories/GHSA-xxjr-mmjv-4gpg) ### Impact Lodash versions 4.0.0 through 4.17.22 are vulnerable to prototype pollution in the `_.unset` and `_.omit` functions. An attacker can pass crafted paths which cause Lodash to delete methods from global prototypes. The issue permits deletion of properties but does not allow overwriting their original behavior. ### Patches This issue is patched on 4.17.23. --- ### Release Notes <details> <summary>lodash/lodash (lodash)</summary> ### [`v4.17.23`](https://redirect.github.com/lodash/lodash/compare/0082be44648961341600e879042f74cd29d65d05...4.17.23) [Compare Source](https://redirect.github.com/lodash/lodash/compare/4.17.21...4.17.23) </details> --- ### Configuration 📅 **Schedule**: Branch creation - "" (UTC), Automerge - At any time (no schedule defined). 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/mnahkies/openapi-code-generator). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0Mi45Mi4xIiwidXBkYXRlZEluVmVyIjoiNDIuOTIuMSIsInRhcmdldEJyYW5jaCI6Im1haW4iLCJsYWJlbHMiOltdfQ==--> Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
1 parent 2035eb6 commit 410297b

2 files changed

Lines changed: 7 additions & 5 deletions

File tree

pnpm-lock.yaml

Lines changed: 5 additions & 5 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

pnpm-workspace.yaml

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -27,6 +27,8 @@ minimumReleaseAgeExclude:
2727
- "@biomejs/cli-win32-x64@2.3.10"
2828
- "@biomejs/cli-darwin-x64@2.3.10"
2929
- "@biomejs/cli-win32-arm64@2.3.10"
30+
# Renovate security update: lodash@4.17.23
31+
- lodash@4.17.23
3032

3133
nodeOptions: "${NODE_OPTIONS:- } --experimental-vm-modules"
3234

0 commit comments

Comments
 (0)