Merge pull request #2282 from opencloud-eu/renovate/npm-lodash-es-vulnerability

JammingBen · web-flow · commit 5041a424557a · 2026-04-02T14:14:33.000+02:00
fix(deps): update dependency lodash-es to v4.18.1 [security]
diff --git a/packages/web-app-admin-settings/package.json b/packages/web-app-admin-settings/package.json
@@ -17,7 +17,7 @@
     "axios": "1.14.0",
     "email-validator": "^2.0.4",
     "fuse.js": "7.1.0",
-    "lodash-es": "4.17.23",
+    "lodash-es": "4.18.1",
     "mark.js": "^8.11.1",
     "pinia": "3.0.4",
     "uuid": "13.0.0",
diff --git a/packages/web-app-app-store/package.json b/packages/web-app-app-store/package.json
@@ -13,7 +13,7 @@
     "@opencloud-eu/web-pkg": "workspace:*",
     "axios": "1.14.0",
     "fuse.js": "7.1.0",
-    "lodash-es": "4.17.23",
+    "lodash-es": "4.18.1",
     "mark.js": "^8.11.1",
     "pinia": "3.0.4",
     "vue-concurrency": "5.0.3",
diff --git a/packages/web-app-contacts/package.json b/packages/web-app-contacts/package.json
@@ -11,7 +11,7 @@
     "@opencloud-eu/design-system": "workspace:^",
     "@opencloud-eu/web-client": "workspace:*",
     "@opencloud-eu/web-pkg": "workspace:*",
-    "lodash-es": "4.17.23",
+    "lodash-es": "4.18.1",
     "pinia": "3.0.4",
     "vue-concurrency": "5.0.3",
     "vue-router": "5.0.4",
diff --git a/packages/web-app-external/package.json b/packages/web-app-external/package.json
@@ -10,7 +10,7 @@
   "peerDependencies": {
     "@opencloud-eu/web-client": "workspace:*",
     "@opencloud-eu/web-pkg": "workspace:*",
-    "lodash-es": "4.17.23",
+    "lodash-es": "4.18.1",
     "pinia": "3.0.4",
     "qs": "^6.13.0",
     "uuid": "13.0.0",
diff --git a/packages/web-app-files/package.json b/packages/web-app-files/package.json
@@ -16,7 +16,7 @@
     "axios": "1.14.0",
     "email-validator": "^2.0.4",
     "fuse.js": "7.1.0",
-    "lodash-es": "4.17.23",
+    "lodash-es": "4.18.1",
     "luxon": "3.7.2",
     "mark.js": "^8.11.1",
     "p-queue": "^9.0.0",
diff --git a/packages/web-app-mail/package.json b/packages/web-app-mail/package.json
@@ -14,7 +14,7 @@
     "axios": "1.14.0",
     "dompurify": "^3.2.3",
     "fuse.js": "7.1.0",
-    "lodash-es": "4.17.23",
+    "lodash-es": "4.18.1",
     "luxon": "^3.7.2",
     "mark.js": "^8.11.1",
     "pinia": "3.0.4",
diff --git a/packages/web-app-ocm/package.json b/packages/web-app-ocm/package.json
@@ -10,7 +10,7 @@
     "axios": "1.14.0",
     "email-validator": "^2.0.4",
     "fuse.js": "7.1.0",
-    "lodash-es": "4.17.23",
+    "lodash-es": "4.18.1",
     "vue-concurrency": "5.0.3",
     "uuid": "13.0.0",
     "vue-router": "5.0.4",
diff --git a/packages/web-runtime/package.json b/packages/web-runtime/package.json
@@ -22,7 +22,7 @@
     "deepmerge": "4.3.1",
     "email-validator": "2.0.4",
     "fuse.js": "7.1.0",
-    "lodash-es": "4.17.23",
+    "lodash-es": "4.18.1",
     "luxon": "3.7.2",
     "mark.js": "8.11.1",
     "oidc-client-ts": "^3.5.0",
diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml
diff --git a/tests/e2e/package.json b/tests/e2e/package.json
@@ -3,7 +3,7 @@
   "devDependencies": {
     "@ai-zen/node-fetch-event-source": "^2.1.4",
     "fast-xml-parser": "^5.5.9",
-    "lodash-es": "4.17.23",
+    "lodash-es": "^4.18.1",
     "luxon": "^3.7.2",
     "uuid": "^13.0.0"
   }

Original file line number	Diff line number	Diff line change
`@@ -3,7 +3,7 @@`
`3`	`3`	`"devDependencies": {`
`4`	`4`	`"@ai-zen/node-fetch-event-source": "^2.1.4",`
`5`	`5`	`"fast-xml-parser": "^5.5.9",`
`6`		`- "lodash-es": "4.17.23",`
	`6`	`+ "lodash-es": "^4.18.1",`
`7`	`7`	`"luxon": "^3.7.2",`
`8`	`8`	`"uuid": "^13.0.0"`
`9`	`9`	`}`