Skip to content

chore(deps): Bump lodash, rollup-plugin-license and @microsoft/api-extractor#1046

Merged
github-actions[bot] merged 1 commit into
mainfrom
dependabot/npm_and_yarn/multi-2731579dc1
Jun 22, 2026
Merged

chore(deps): Bump lodash, rollup-plugin-license and @microsoft/api-extractor#1046
github-actions[bot] merged 1 commit into
mainfrom
dependabot/npm_and_yarn/multi-2731579dc1

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Apr 10, 2026

Copy link
Copy Markdown
Contributor

Bumps lodash, rollup-plugin-license and @microsoft/api-extractor. These dependencies needed to be updated together.
Updates lodash from 4.17.23 to 4.18.1

Release notes

Sourced from lodash's releases.

4.18.1

Bugs

Fixes a ReferenceError issue in lodash lodash-es lodash-amd and lodash.template when using the template and fromPairs functions from the modular builds. See lodash/lodash#6167

These defects were related to how lodash distributions are built from the main branch using https://github.com/lodash-archive/lodash-cli. When internal dependencies change inside lodash functions, equivalent updates need to be made to a mapping in the lodash-cli. (hey, it was ahead of its time once upon a time!). We know this, but we missed it in the last release. It's the kind of thing that passes in CI, but fails bc the build is not the same thing you tested.

There is no diff on main for this, but you can see the diffs for each of the npm packages on their respective branches:

4.18.0

v4.18.0

Full Changelog: lodash/lodash@4.17.23...4.18.0

Security

_.unset / _.omit: Fixed prototype pollution via constructor/prototype path traversal (GHSA-f23m-r3pf-42rh, fe8d32e). Previously, array-wrapped path segments and primitive roots could bypass the existing guards, allowing deletion of properties from built-in prototypes. Now constructor and prototype are blocked unconditionally as non-terminal path keys, matching baseSet. Calls that previously returned true and deleted the property now return false and leave the target untouched.

_.template: Fixed code injection via imports keys (GHSA-r5fr-rjxr-66jc, CVE-2026-4800, 879aaa9). Fixes an incomplete patch for CVE-2021-23337. The variable option was validated against reForbiddenIdentifierChars but importsKeys was left unguarded, allowing code injection via the same Function() constructor sink. imports keys containing forbidden identifier characters now throw "Invalid imports option passed into _.template".

Docs

  • Add security notice for _.template in threat model and API docs (#6099)
  • Document lower > upper behavior in _.random (#6115)
  • Fix quotes in _.compact jsdoc (#6090)

lodash.* modular packages

Diff

We have also regenerated and published a select number of the lodash.* modular packages.

These modular packages had fallen out of sync significantly from the minor/patch updates to lodash. Specifically, we have brought the following packages up to parity w/ the latest lodash release because they have had CVEs on them in the past:

Commits
  • cb0b9b9 release(patch): bump main to 4.18.1 (#6177)
  • 75535f5 chore: prune stale advisory refs (#6170)
  • 62e91bc docs: remove n_ Node.js < 6 REPL note from README (#6165)
  • 59be2de release(minor): bump to 4.18.0 (#6161)
  • af63457 fix: broken tests for _.template 879aaa9
  • 1073a76 fix: linting issues
  • 879aaa9 fix: validate imports keys in _.template
  • fe8d32e fix: block prototype pollution in baseUnset via constructor/prototype traversal
  • 18ba0a3 refactor(fromPairs): use baseAssignValue for consistent assignment (#6153)
  • b819080 ci: add dist sync validation workflow (#6137)
  • Additional commits viewable in compare view

Updates rollup-plugin-license from 3.6.0 to 3.7.1

Changelog

Sourced from rollup-plugin-license's changelog.

3.5.0 (2024-06-22)

  • release: prepare next release (71f5bcf)
  • release: prepare next release (2c51c64)
  • release: release version (f27f51d)
  • release: release version (8a7f79c)
  • chore: fix lint task (a7c455f)
  • chore: remove (deprecated) eslint-config-google (0ba031f)
  • chore(ci): push release to current branch (03112e9)
  • chore(deps-dev): bump @​rollup/plugin-commonjs from 25.0.7 to 25.0.8 (#1732) (8bd6fb3), closes #1732
  • chore(deps-dev): bump @​rollup/plugin-commonjs from 25.0.8 to 26.0.1 (#1741) (25f03f2), closes #1741
  • chore(deps-dev): bump globalthis from 1.0.3 to 1.0.4 (#1721) (54084da), closes #1721
  • chore(deps-dev): bump gulp-conventional-changelog from 4.0.0 to 5.0.0 (#1723) (d6ae13f), closes #1723
  • chore(deps-dev): bump prettier from 3.2.5 to 3.3.0 (#1737) (3e80b2a), closes #1737
  • chore(deps-dev): bump prettier from 3.3.0 to 3.3.1 (#1740) (ef8aabf), closes #1740
  • chore(deps-dev): bump prettier from 3.3.1 to 3.3.2 (#1746) (e4fbe41), closes #1746
  • chore(deps-dev): bump rimraf from 5.0.5 to 5.0.7 (#1727) (44fd2d4), closes #1727
  • chore(deps-dev): bump rollup from 4.14.3 to 4.16.2 (#1715) (0126778), closes #1715
  • chore(deps-dev): bump rollup from 4.16.2 to 4.16.4 (#1716) (2256205), closes #1716
  • chore(deps-dev): bump rollup from 4.16.4 to 4.17.2 (#1722) (084276a), closes #1722
  • chore(deps-dev): bump the babel group with 2 updates (#1720) (6720a77), closes #1720
  • chore(deps-dev): bump the babel group with 2 updates (#1739) (2d3d1d3), closes #1739
  • chore(deps-dev): bump the babel group with 3 updates (#1733) (b56dc88), closes #1733
  • chore(deps-dev): bump the typescript-eslint group across 1 directory with 2 updates (#1729) (5cfc7c0), closes #1729
  • chore(deps-dev): bump the typescript-eslint group across 1 directory with 2 updates (#1748) (c0abf2d), closes #1748
  • chore(deps-dev): bump the typescript-eslint group with 2 updates (#1714) (1deea69), closes #1714
  • chore(deps-dev): bump the typescript-eslint group with 2 updates (#1717) (3571d80), closes #1717
  • chore(deps-dev): bump the typescript-eslint group with 2 updates (#1735) (c3d769f), closes #1735
  • chore(deps-dev): bump the typescript-eslint group with 2 updates (#1736) (2e053de), closes #1736
  • chore(deps-dev): bump typescript from 5.4.5 to 5.5.2 (#1750) (374962d), closes #1750
  • --- (#1730) (40dc5e6), closes #1730
  • Update readme (780ff50)
  • feat: drop glob usage (#1742) (2623a1b), closes #1742
  • feat: drop mkdirp (#1743) (2f90c74), closes #1743
  • feat: include private self dependency (1401f5d)
  • docs: update README & changelog (bdfca87)

3.4.0 (2024-04-18)

  • release: prepare next release (1c6c911)
  • release: release version (a576572)
  • chore: add changelog update workflow (5f4ed57)
  • chore: update changelog (a48e164)
  • chore: update readme (8254eae)
  • chore(ci): add node 21 (80cefa0)
  • chore(ci): remove invalid option (16e4d5d)
  • chore(ci): update actions/checkout to version 4.1.2 (9742e59)
  • chore(ci): use node 20 (184cc0b)

... (truncated)

Commits
  • 6faf8f5 release: release version
  • 9b28938 chore(ci): add provenance
  • 23fd98e chore: update npmignore
  • 4d9fc6f chore(ci): use --no-git-checks in publish task
  • e01dc36 chore(ci): update publish task
  • fd0f645 chore(ci): fix publish task
  • 3f298e6 fix: fix lint
  • 348e933 Fix bug when a package license type is string (#2108)
  • 3fc6424 chore: enable pnpm trustPolicy
  • ccc4626 chore: enable pnpm blockExoticSubdeps
  • Additional commits viewable in compare view
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for rollup-plugin-license since your current version.


Updates @microsoft/api-extractor from 7.55.2 to 7.58.9

Changelog

Sourced from @​microsoft/api-extractor's changelog.

7.58.9

Sat, 13 Jun 2026 00:16:18 GMT

Version update only

7.58.8

Mon, 08 Jun 2026 15:15:49 GMT

Patches

  • Add support for new d.ts extension format when using TS moduleResolution 'bundler' or 'nodenext'.

7.58.7

Mon, 20 Apr 2026 23:31:13 GMT

Version update only

7.58.6

Mon, 20 Apr 2026 15:15:24 GMT

Patches

  • Fix an issue where empty lines were included in DTS rollups in place of API items that were trimmed.

7.58.5

Sat, 18 Apr 2026 03:47:10 GMT

Version update only

7.58.4

Sat, 18 Apr 2026 00:15:16 GMT

Patches

  • Bump semver.

7.58.3

Fri, 17 Apr 2026 15:14:57 GMT

Patches

  • Remove dependecy on lodash.

7.58.2

Thu, 09 Apr 2026 00:15:07 GMT

Version update only

7.58.1

Sat, 04 Apr 2026 00:14:00 GMT

... (truncated)

Commits
  • b6a0df8 Bump versions [skip ci]
  • 8c28c0d Update changelogs [skip ci]
  • 2a07c93 chore: bump decoupled local dependencies (#5825)
  • 89cbc56 Bump versions [skip ci]
  • 4a6de47 Update changelogs [skip ci]
  • 0310914 [api-extractor] Add support for new TS declaration format when using module r...
  • fde6ed5 Fix: syntax error in resulting d.ts file (#5799)
  • 2b7c453 chore: bump decoupled local dependencies (#5790)
  • 7a6a5f3 Bump versions [skip ci]
  • d0c8fd6 Update changelogs [skip ci]
  • Additional commits viewable in compare view

Note
Automatic rebases have been disabled on this pull request as it has been open for over 30 days.

@dependabot dependabot Bot added 3. to review dependencies Pull requests that update a dependency file labels Apr 10, 2026
@github-actions github-actions Bot enabled auto-merge April 10, 2026 03:32
@susnux

susnux commented Jun 22, 2026

Copy link
Copy Markdown
Contributor

@dependabot rebase

…tractor

Bumps [lodash](https://github.com/lodash/lodash), [rollup-plugin-license](https://github.com/mjeanroy/rollup-plugin-license) and [@microsoft/api-extractor](https://github.com/microsoft/rushstack/tree/HEAD/apps/api-extractor). These dependencies needed to be updated together.

Updates `lodash` from 4.17.23 to 4.18.1
- [Release notes](https://github.com/lodash/lodash/releases)
- [Commits](lodash/lodash@4.17.23...4.18.1)

Updates `rollup-plugin-license` from 3.6.0 to 3.7.1
- [Changelog](https://github.com/mjeanroy/rollup-plugin-license/blob/master/CHANGELOG.md)
- [Commits](mjeanroy/rollup-plugin-license@v3.6.0...v3.7.1)

Updates `@microsoft/api-extractor` from 7.55.2 to 7.58.9
- [Changelog](https://github.com/microsoft/rushstack/blob/main/apps/api-extractor/CHANGELOG.md)
- [Commits](https://github.com/microsoft/rushstack/commits/@microsoft/api-extractor_v7.58.9/apps/api-extractor)

---
updated-dependencies:
- dependency-name: "@microsoft/api-extractor"
  dependency-version: 7.58.2
  dependency-type: indirect
- dependency-name: lodash
  dependency-version: 4.18.1
  dependency-type: indirect
- dependency-name: rollup-plugin-license
  dependency-version: 3.7.1
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot force-pushed the dependabot/npm_and_yarn/multi-2731579dc1 branch from b6d9ab1 to 9d9832e Compare June 22, 2026 10:38
@github-actions github-actions Bot merged commit f47488e into main Jun 22, 2026
42 checks passed
@github-actions github-actions Bot deleted the dependabot/npm_and_yarn/multi-2731579dc1 branch June 22, 2026 10:41
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

3. to review dependencies Pull requests that update a dependency file

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant