chore(deps): bump lodash and lodash-contrib #1959
Conversation
Bumps [lodash](https://github.com/lodash/lodash) and [lodash-contrib](https://github.com/node4good/lodash-contrib). These dependencies needed to be updated together. Updates `lodash` from 4.17.21 to 4.17.23 - [Release notes](https://github.com/lodash/lodash/releases) - [Commits](lodash/lodash@4.17.21...4.17.23) Updates `lodash-contrib` from 4.1200.1 to 31001.1.0 - [Commits](node4good/lodash-contrib@v4.1200.1...v31001.1.0) --- updated-dependencies: - dependency-name: lodash dependency-version: 4.17.23 dependency-type: direct:production - dependency-name: lodash-contrib dependency-version: 31001.1.0 dependency-type: direct:production ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
bot
added
dependencies
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
There was a problem hiding this comment.
Cursor Bugbot has reviewed your changes and found 2 potential issues.
Bugbot Autofix is OFF. To automatically fix reported issues with Cloud Agents, enable Autofix in the Cursor dashboard.
This PR is being reviewed by Cursor Bugbot
Details
Your team is on the Bugbot Free tier. On this plan, Bugbot will review limited PRs each billing cycle for each member of your team.
To receive Bugbot reviews on all of your PRs, visit the Cursor dashboard to activate Pro and start your 14-day free trial.
| "lodash": "^4.17.21", | ||
| "lodash-contrib": "^4.1200.1", | ||
| "lodash": "^4.17.23", | ||
| "lodash-contrib": "^31001.1.0", |
There was a problem hiding this comment.
Security update introduces vulnerable lodash 3.10.1 dependency
High Severity
The lodash-contrib update from 4.1200.1 to 31001.1.0 introduces lodash@3.10.1 as a nested dependency, which has known security vulnerabilities including prototype pollution (CVE-2019-10744) and command injection (CVE-2021-23337). This negates the security benefit of updating the main lodash package and actually makes the dependency tree less secure than before. The previous lodash-contrib@4.1200.1 used lodash@4.12.x, so this is a significant downgrade in the transitive dependency.
Additional Locations (1)
| "bpmn-moddle": "^6.0.0", | ||
| "i18next": "^15.0.8", | ||
| "jointjs": "^3.1.1", | ||
| "lodash": "^4.17.21", |
There was a problem hiding this comment.
Lodash removed from peerDependencies in lockfile but remains in package.json
Low Severity
The package.json updates lodash in peerDependencies from ^4.17.21 to ^4.17.23, but package-lock.json removes lodash entirely from its peerDependencies section instead of updating it. This inconsistency between the two files means the lockfile no longer accurately reflects the package's peer dependency declarations, which could affect dependency resolution for consumers of this package.
Additional Locations (1)
modeler
|
||||||||||||||||||||||||||||
| Project |
modeler
|
| Branch Review |
dependabot/npm_and_yarn/multi-9767cac4aa
|
| Run status |
|
| Run duration | 06m 01s |
| Commit |
|
| Committer | dependabot[bot] |
| View all properties for this run ↗︎ | |
| Test results | |
|---|---|
Failures
|
0
|
Flaky
|
0
|
Pending
|
83
|
Skipped
|
0
|
Passing
|
305
|
| View all changes introduced in this branch ↗︎ | |
|
Bumps lodash and lodash-contrib. These dependencies needed to be updated together.
Updates
lodashfrom 4.17.21 to 4.17.23Commits
dec55b7Bump main to v4.17.23 (#6088)19c9251fix: setCacheHas JSDoc return type should be boolean (#6071)b5e6729jsdoc: Add -0 and BigInt zeros to _.compact falsey values list (#6062)edadd45Prevent prototype pollution on baseUnset function4879a7adoc: fix autoLink function, conversion of source links (#6056)9648f69chore: removeyarn.lockfile (#6053)dfa407dci: remove legacy configuration files (#6052)156e196feat: add renovate setup (#6039)933e106ci: add pipeline for Bun (#6023)072a807docs: update links related to Open JS Foundation (#5968)Updates
lodash-contribfrom 4.1200.1 to 31001.1.0Commits
a6295eb[util.strings] Update slugify tests to match lodash style8655e8e[util.strings] Port slugify tests to QUnit setupcb3c2c6[util.strings] Add tests for slugify and fix issues3bc3ba5[util.strings] Move regular expressions to one object literald734c84[util.strings] Add error message to strContains throw statement212bd98reworked into CommonJS primary -> browserify for browsers2645d8dupdate author1d0231btravis fixd16414etravis fix8e66967393.0.1Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot mergewill merge this PR after your CI passes on it@dependabot squash and mergewill squash and merge this PR after your CI passes on it@dependabot cancel mergewill cancel a previously requested merge and block automerging@dependabot reopenwill reopen this PR if it is closed@dependabot closewill close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)You can disable automated security fix PRs for this repo from the Security Alerts page.
Note
Updates dependency versions; no app code changes.
lodashto^4.17.23and updatespeerDependenciesto matchlodash-contribto^31001.1.0Written by Cursor Bugbot for commit d97f778. This will update automatically on new commits. Configure here.