Bump the npm_and_yarn group across 13 directories with 11 updates by dependabot[bot] · Pull Request #55 · theomnira/Codira

dependabot · 2026-04-08T15:27:35Z

Bumps the npm_and_yarn group with 2 updates in the /compiler/internal/vm/debugger/tools/lldb-dap/extension directory: brace-expansion and picomatch.
Bumps the npm_and_yarn group with 6 updates in the /compiler/internal/vm/foundation/test directory:

Package	From	To
@nestjs/core	`11.0.3`	`11.1.18`
astro	`5.5.5`	`5.18.1`
happy-dom	`17.0.3`	`20.8.9`
hono	`4.7.2`	`4.12.12`
lodash	`4.17.21`	`4.18.1`
nodemailer	`6.9.3`	`8.0.5`

Bumps the npm_and_yarn group with 1 update in the /compiler/internal/vm/foundation/test/cli/install/migration/contoso-test directory: brace-expansion.
Bumps the npm_and_yarn group with 1 update in the /compiler/internal/vm/foundation/test/cli/install/migration/missing-resolved-properties directory: lodash.
Bumps the npm_and_yarn group with 2 updates in the /compiler/internal/vm/foundation/test/cli/install/migration/yarn/yarn-cli-repo directory: brace-expansion and handlebars.
Bumps the npm_and_yarn group with 2 updates in the /compiler/internal/vm/foundation/test/integration/vite-build/the-test-app directory: nodemailer and vite.
Bumps the npm_and_yarn group with 1 update in the /compiler/internal/vm/foundation/test/js/third_party/astro directory: astro.
Bumps the npm_and_yarn group with 4 updates in the /compiler/internal/vm/libconsepts/dynamic_bitset/doc directory: brace-expansion, picomatch, handlebars and convict.
Bumps the npm_and_yarn group with 1 update in the /compiler/internal/vm/libconsepts/msm/doc directory: picomatch.
Bumps the npm_and_yarn group with 4 updates in the /compiler/internal/vm/libconsepts/openmethod/doc directory: brace-expansion, picomatch, handlebars and convict.
Bumps the npm_and_yarn group with 4 updates in the /compiler/internal/vm/libconsepts/redis/doc directory: brace-expansion, picomatch, handlebars and convict.
Bumps the npm_and_yarn group with 4 updates in the /compiler/internal/vm/libconsepts/unordered/doc directory: brace-expansion, picomatch, handlebars and convict.
Bumps the npm_and_yarn group with 4 updates in the /compiler/internal/vm/libconsepts/url/doc directory: brace-expansion, picomatch, handlebars and convict.

Updates brace-expansion from 2.0.2 to 2.0.3

Commits

73b5459 2.0.3
311ac0d Backport fix for GHSA-f886-m6hf-6m8v to v2 (#96)
See full diff in compare view

Updates brace-expansion from 1.1.12 to 1.1.13

Commits

73b5459 2.0.3
311ac0d Backport fix for GHSA-f886-m6hf-6m8v to v2 (#96)
See full diff in compare view

Updates picomatch from 2.3.1 to 2.3.2

Release notes

Sourced from picomatch's releases.

2.3.2

This is a security release fixing several security relevant issues.

What's Changed

fix: exception when glob pattern contains constructor by @Jason3S in micromatch/picomatch#144

Fix for CVE-2026-33671

Fix for CVE-2026-33672

Full Changelog: micromatch/picomatch@2.3.1...2.3.2

Changelog

Sourced from picomatch's changelog.

Release history

All notable changes to this project will be documented in this file.

The format is based on Keep a Changelog and this project adheres to Semantic Versioning.

Changelogs are for humans, not machines.

There should be an entry for every single version.

The same types of changes should be grouped.

Versions and sections should be linkable.

The latest version comes first.

The release date of each versions is displayed.

Mention whether you follow Semantic Versioning.

Changelog entries are classified using the following labels (from keep-a-changelog):

Added for new features.

Changed for changes in existing functionality.

Deprecated for soon-to-be removed features.

Removed for now removed features.

Fixed for any bug fixes.

Security in case of vulnerabilities.

4.0.0 (2024-02-07)

Fixes

Fix bad text values in parse #126, thanks to @connor4312

Changed

Remove process global to work outside of node #129, thanks to @styfle

Add sideEffects to package.json #128, thanks to @frandiox

Removed os, make compatible browser environment. See #124, thanks to @gwsbhqt

3.0.1

Fixes

... (truncated)

Commits

81cba8d Publish 2.3.2
fc1f6b6 Merge commit from fork
eec17ae Merge commit from fork
78f8ca4 Merge pull request #156 from micromatch/backport-144
3f4f10e Merge pull request #144 from Jason3S/jdent-object-properties
See full diff in compare view

Updates @nestjs/core from 11.0.3 to 11.1.18

Release notes

Sourced from @nestjs/core's releases.

v11.1.18 (2026-04-03)

Bug fixes

microservices

#16675 fix(microservices): preserve packet headers in nats serializer (@wwenrr)

core

#16683 fix(core): prevent injector hang when design:paramtypes is missing (@Youmoo)

#16637 fix(core): dependency injection edge case with moduleref.create (@JakobStaudinger)

nestjs/nest#16686 fix(core): sanitize sse message

Dependencies

core, platform-express, platform-fastify

#16679 fix(deps): update dependency path-to-regexp to v8.4.2 (@renovate[bot])

platform-fastify

#16623 fix(deps): update dependency fastify to v5.8.4 (@renovate[bot])

platform-ws

#16618 chore(deps): bump ws from 8.19.0 to 8.20.0 (@dependabot[bot])

common

#16619 chore(deps): bump file-type from 21.3.3 to 21.3.4 (@dependabot[bot])

Committers: 6

Ankit San (@ankitbelal)

Jakob Staudinger (@JakobStaudinger)

Kamil Mysliwiec (@kamilmysliwiec)

Krishna Chaitanya (@Krishnachaitanyakc)

MK (@wwenrr)

youmoo (@Youmoo)

v11.1.17 (2026-03-16)

Enhancements

microservices

#16218 feat(microservices): add redis driver identification (@vchomakov)

Bugs

platform-fastify

auto-run middleware for HEAD requests as fastify redirects them to GET handlers (effectively skipping middleware execution) nestjs/nest@cbdf737 (@kamilmysliwiec)

Dependencies

common

#16567 fix(deps): update dependency file-type to v21.3.2 (@renovate[bot])

platform-fastify

#16533 fix(deps): update dependency fastify to v5.8.2 (@renovate[bot])

Committers: 3

Rohan Santhosh Kumar (@Rohan5commit)

Vasil Chomakov (@vchomakov)

Kamil Mysliwiec (@kamilmysliwiec)

... (truncated)

Commits

3c1cc5f chore(release): publish v11.1.18 release
0f962c7 fix(core): sanitize sse message
94aa424 Merge pull request #16679 from nestjs/renovate/path-to-regexp-8.x
368691c fix(core): prevent injector hang when design:paramtypes is missing
25d4fde fix(deps): update dependency path-to-regexp to v8.4.2
5c0b11e fix(deps): update dependency path-to-regexp to v8.4.1
f7d4460 Merge pull request #16637 from JakobStaudinger/moduleref-create-transient-sco...
d0a9dc9 fix(deps): update dependency path-to-regexp to v8.4.0
4677434 feat(core): export IEntryNestModule type
7493b94 fix(core): dependency injection edge case with moduleref.create
Additional commits viewable in compare view

Updates astro from 5.5.5 to 5.18.1

Release notes

Sourced from astro's releases.

astro@5.18.1

Patch Changes

Updated dependencies [c2cd371]:

@astrojs/internal-helpers@0.7.6

@astrojs/markdown-remark@6.3.11

Changelog

Sourced from astro's changelog.

5.18.1

Patch Changes

Updated dependencies [c2cd371]:

@astrojs/internal-helpers@0.7.6

@astrojs/markdown-remark@6.3.11

5.18.0

Minor Changes
#15589 b7dd447 Thanks @qzio! - Adds a new security.actionBodySizeLimit option to configure the maximum size of Astro Actions request bodies.

This lets you increase the default 1 MB limit when your actions need to accept larger payloads. For example, actions that handle file uploads or large JSON payloads can now opt in to a higher limit.

If you do not set this option, Astro continues to enforce the 1 MB default to help prevent abuse.
// astro.config.mjs
export default defineConfig({
  security: {
    actionBodySizeLimit: 10 * 1024 * 1024, // set to 10 MB
  },
});
Patch Changes

#15594 efae11c Thanks @qzio! - Fix X-Forwarded-Proto validation when allowedDomains includes both protocol and hostname fields. The protocol check no longer fails due to hostname mismatch against the hardcoded test URL.

5.17.3

Patch Changes

#15564 522f880 Thanks @matthewp! - Add a default body size limit for server actions to prevent oversized requests from exhausting memory.

#15569 e01e98b Thanks @matthewp! - Respect image allowlists when inferring remote image sizes and reject remote redirects.

5.17.2

Patch Changes

c13b536 Thanks @matthewp! - Improves Host header handling for SSR deployments behind proxies

5.17.1

Patch Changes

#15334 d715f1f Thanks @florian-lefebvre! - BREAKING CHANGE to the experimental Fonts API only

... (truncated)

Commits

434d9cc [ci] release (#15829)
c2cd371 fix(helpers): Backport remote patterns segments fix (#15828)
011f061 [ci] release (#15597)
efae11c fix: X-Forwarded-Proto rejected when allowedDomains includes protocol… (#15594)
751ccf0 Update actionBodySizeLimit changeset and make minor (#15600)
b7dd447 make actionBodySizeLimit configurable (#15589)
e0f1a2b [ci] release (#15571)
522f880 Limit action request body size (#15564)
436962a chore: Upgrade Vite and esbuild (#15554)
e01e98b Respect remote image allowlists (#15569)
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by [GitHub Actions](https://www.npmjs.com/~GitHub Actions), a new releaser for astro since your current version.

Updates happy-dom from 17.0.3 to 20.8.9

Release notes

Sourced from happy-dom's releases.

v20.8.9

👷‍♂️ Patch fixes

Fixes issue where cookies from the current origin was being forwarded to the target origin in fetch requests - By @capricorn86 in task #2117

A security advisory (GHSA-w4gp-fjgq-3q4g) was reported for this security vulnerability. Big thanks to @r74tech for reporting this!

v20.8.8

👷‍♂️ Patch fixes

Fixes issue where export names can be interpolated as executable code in ESM - By @capricorn86 in task #2113

A security advisory (GHSA-6q6h-j7hj-3r64) has been reported that shows a security vulnerability where it may be possible to escape the VM context and get access to process level functionality in unsafe environments using CommonJS. Big thanks to @tndud042713 for reporting this!

v20.8.7

👷‍♂️ Patch fixes

Replace implementing Node.js Console with common IConsole interface to support latest version of Bun - By @YevheniiKotyrlo in task #1845

v20.8.6

👷‍♂️ Patch fixes

Request.formData() should honor "Content-Type" header - By @brianhelba in task #2106

v20.8.5

👷‍♂️ Patch fixes

Fixes error thrown when modifying DOM structure in connectedCallback() - By @capricorn86 in task #2110

v20.8.4

👷‍♂️ Patch fixes

Replace ConsoleConstructor import with indexed access type - By @YevheniiKotyrlo in task #1845

v20.8.3

👷‍♂️ Patch fixes

Throw error if event is not of type Event in EventTarget.dispatchEvent() - By @capricorn86 in task #2054

v20.8.2

👷‍♂️ Patch fixes

Resets Event.cancelBubble and Event.defaultPrevented when calling Event.initEvent() - By @capricorn86 in task #2090

v20.8.1

👷‍♂️ Patch fixes

Make "inert" attribute block focus interactions - By @coffeeandwork in task #1422

v20.8.0

🎨 Features

Adds support for setPointerCapture, hasPointerCapture, and releasePointerCapture to Element - By @coffeeandwork in task #1733

v20.7.2

👷‍♂️ Patch fixes

Properly decode CSS escape sequences in attribute selector values - By @silverwind

v20.7.1

👷‍♂️ Patch fixes

Fixes issue related to parsing direct descendants (>) and universal (*) query selectors - By @Cherry in task #2078

... (truncated)

Commits

68324c2 fix: #2117 Fixes issue related to cookies from the current origin being for...
5437fdf fix: #2113 Fixes issue where export names can be interpolated as executable...
7e97acb fix: #1845 Replace implementing Node js Console with common IConsole interf...
3373929 fix: #2106 Request.formData() should honor Content-Type header (#2107)
55c17ba fix: #2110 Fixes error thrown when modifying DOM structure in connectedCall...
82a0888 fix: #1845 Replace ConsoleConstructor import with indexed access type (#2095)
5998eea fix: #2054 Throw error if event is not of type Event in dispatchEvent (#2092)
7a11238 fix: #2090 Resets cancelBubble and defaultPrevented when calling initEvent ...
7d27984 fix: #1422 Make inert attribute block focus interactions (#2083)
53e4ec9 feat: #1733 Adds support for setPointerCapture, hasPointerCapture, and rele...
Additional commits viewable in compare view

Updates hono from 4.7.2 to 4.12.12

Release notes

Sourced from hono's releases.

v4.12.12

Security fixes

This release includes fixes for the following security issues:

Middleware bypass via repeated slashes in serveStatic

Affects: Serve Static middleware. Fixes a path normalization inconsistency where repeated slashes (//) could bypass route-based middleware protections and allow access to protected static files. GHSA-wmmm-f939-6g9c

Path traversal in toSSG() allows writing files outside the output directory

Affects: toSSG() for Static Site Generation. Fixes a path traversal issue where crafted ssgParams values could write files outside the configured output directory. GHSA-xf4j-xp2r-rqqx

Incorrect IP matching in ipRestriction() for IPv4-mapped IPv6 addresses

Affects: IP Restriction Middleware. Fixes improper handling of IPv4-mapped IPv6 addresses (e.g. ::ffff:127.0.0.1) that could cause allow/deny rules to be bypassed. GHSA-xpcf-pg52-r92g

Missing validation of cookie name on write path in setCookie()

Affects: setCookie(), serialize(), and serializeSigned() from hono/cookie. Fixes missing validation of cookie names on the write path, preventing inconsistent handling between parsing and serialization. GHSA-26pp-8wgv-hjvm

Non-breaking space prefix bypass in cookie name handling in getCookie()

Affects: getCookie() from hono/cookie. Fixes a discrepancy in cookie name handling that could allow attacker-controlled cookies to override legitimate ones and bypass prefix protections. GHSA-r5rp-j6wh-rvv4

Users who use Serve Static, Static Site Generation, Cookie utilities, or IP restriction middleware are strongly encouraged to upgrade to this version.

v4.12.11

What's Changed

feat(css): add classNameSlug option to createCssContext by @flow-pie in honojs/hono#4834

New Contributors

@flow-pie made their first contribution in honojs/hono#4834

Full Changelog: honojs/hono@v4.12.10...v4.12.11

v4.12.10

What's Changed

test(router): fix Simple capturing group test by @yusukebe in honojs/hono#4838

docs: fix impaired -> inspired typo in benchmark READMEs by @Abhi3975 in honojs/hono#4843

fix(jsx/dom): apply select value after children are rendered by @usualoma in honojs/hono#4847

fix(compress): convert strong ETag to weak ETag when compressing by @usualoma in honojs/hono#4848

docs(ip-restriction): add clear JSDoc examples and param types by @VISHNU7KASIREDDY in honojs/hono#4851

New Contributors

@Abhi3975 made their first contribution in honojs/hono#4843

@VISHNU7KASIREDDY made their first contribution in honojs/hono#4851

... (truncated)

Commits

c37ba26 4.12.12
cc067c8 Merge commit from fork
a586cd7 Merge commit from fork
48fa223 Merge commit from fork
b470278 Merge commit from fork
9aff14b Merge commit from fork
2c403c6 4.12.11
f82aba8 feat(css): add classNameSlug option to createCssContext (#4834)
9f374a5 4.12.10
a8c56a6 docs(ip-restriction): add clear JSDoc examples and param types (#4851)
Additional commits viewable in compare view

Updates lodash from 4.17.21 to 4.18.1

Release notes

Sourced from lodash's releases.

4.18.1

Bugs

Fixes a ReferenceError issue in lodash lodash-es lodash-amd and lodash.template when using the template and fromPairs functions from the modular builds. See lodash/lodash#6167

These defects were related to how lodash distributions are built from the main branch using https://github.com/lodash-archive/lodash-cli. When internal dependencies change inside lodash functions, equivalent updates need to be made to a mapping in the lodash-cli. (hey, it was ahead of its time once upon a time!). We know this, but we missed it in the last release. It's the kind of thing that passes in CI, but fails bc the build is not the same thing you tested.

There is no diff on main for this, but you can see the diffs for each of the npm packages on their respective branches:

lodash: lodash/lodash@4.18.0-npm...4.18.1-npm

lodash-es: lodash/lodash@4.18.0-es...4.18.1-es

lodash-amd: lodash/lodash@4.18.0-amd...4.18.1-amd

lodash.templatelodash/lodash@4.18.0-npm-packages...4.18.1-npm-packages

4.18.0

v4.18.0

Full Changelog: lodash/lodash@4.17.23...4.18.0

Security

_.unset / _.omit: Fixed prototype pollution via constructor/prototype path traversal (GHSA-f23m-r3pf-42rh, fe8d32e). Previously, array-wrapped path segments and primitive roots could bypass the existing guards, allowing deletion of properties from built-in prototypes. Now constructor and prototype are blocked unconditionally as non-terminal path keys, matching baseSet. Calls that previously returned true and deleted the property now return false and leave the target untouched.

_.template: Fixed code injection via imports keys (GHSA-r5fr-rjxr-66jc, CVE-2026-4800, 879aaa9). Fixes an incomplete patch for CVE-2021-23337. The variable option was validated against reForbiddenIdentifierChars but importsKeys was left unguarded, allowing code injection via the same Function() constructor sink. imports keys containing forbidden identifier characters now throw "Invalid imports option passed into _.template".

Docs

Add security notice for _.template in threat model and API docs (#6099)

Document lower > upper behavior in _.random (#6115)

Fix quotes in _.compact jsdoc (#6090)

lodash.* modular packages

Diff

We have also regenerated and published a select number of the lodash.* modular packages.

These modular packages had fallen out of sync significantly from the minor/patch updates to lodash. Specifically, we have brought the following packages up to parity w/ the latest lodash release because they have had CVEs on them in the past:

lodash.orderby

lodash.tonumber

lodash.trim

lodash.trimend

lodash.sortedindexby

lodash.zipobjectdeep

lodash.unset

lodash.omit

lodash.template

Commits

cb0b9b9 release(patch): bump main to 4.18.1 (#6177)
75535f5 chore: prune stale advisory refs (#6170)
62e91bc docs: remove n_ Node.js < 6 REPL note from README (#6165)
59be2de release(minor): bump to 4.18.0 (#6161)
af63457 fix: broken tests for _.template 879aaa9
1073a76 fix: linting issues
879aaa9 fix: validate imports keys in _.template
fe8d32e fix: block prototype pollution in baseUnset via constructor/prototype traversal
18ba0a3 refactor(fromPairs): use baseAssignValue for consistent assignment (#6153)
b819080 ci: add dist sync validation workflow (#6137)
Additional commits viewable in compare view

Updates nodemailer from 6.9.3 to 8.0.5

Release notes

Sourced from nodemailer's releases.

v8.0.5

8.0.5 (2026-04-07)

Bug Fixes

decode SMTP server responses as UTF-8 at line boundary (95876b1)

sanitize CRLF in transport name option to prevent SMTP command injection (GHSA-vvjj-xcjg-gr5g) (0a43876)

v8.0.4

8.0.4 (2026-03-25)

Bug Fixes

sanitize envelope size to prevent SMTP command injection (2d7b971)

v8.0.3

8.0.3 (2026-03-18)

Bug Fixes

clean up addressparser and fix group name fallback producing undefined (9d55877)

fix cookie bugs, remove dead code, and improve hot-path efficiency (e8c8b92)

refactor smtp-connection for clarity and add Node.js 6 syntax compat test (c5b48ea)

remove familySupportCache that broke DNS resolution tests (c803d90)

v8.0.2

8.0.2 (2026-03-09)

Bug Fixes

merge fragmented display names with unquoted commas in addressparser (fe27f7f)

v8.0.1

8.0.1 (2026-02-07)

Bug Fixes

absorb TLS errors during socket teardown (7f8dde4)

absorb TLS errors during socket teardown (381f628)

Add Gmail Workspace service configuration (#1787) (dc97ede)

v8.0.0

8.0.0 (2026-02-04)

... (truncated)

Changelog

Sourced from nodemailer's changelog.

8.0.5 (2026-04-07)

Bug Fixes

decode SMTP server responses as UTF-8 at line boundary (95876b1)

sanitize CRLF in transport name option to prevent SMTP command injection (GHSA-vvjj-xcjg-gr5g) (0a43876)

8.0.4 (2026-03-25)

Bug Fixes

sanitize envelope size to prevent SMTP command injection (2d7b971)

8.0.3 (2026-03-18)

Bug Fixes

clean up addressparser and fix group name fallback producing undefined (9d55877)

fix cookie bugs, remove dead code, and improve hot-path efficiency (e8c8b92)

refactor smtp-connection for clarity and add Node.js 6 syntax compat test (c5b48ea)

remove familySupportCache that broke DNS resolution tests (c803d90)

8.0.2 (2026-03-09)

Bug Fixes

merge fragmented display names with unquoted commas in addressparser (fe27f7f)

8.0.1 (2026-02-07)

Bug Fixes

absorb TLS errors during socket teardown (7f8dde4)

absorb TLS errors during socket teardown (381f628)

Add Gmail Workspace service configuration (#1787) (dc97ede)

8.0.0 (2026-02-04)

⚠ BREAKING CHANGES

Error code 'NoAuth' renamed to 'ENOAUTH'

Bug Fixes

... (truncated)

Commits

202cfb3 chore(master): release 8.0.5 (#1809)
b634abf docs: add CLAUDE.md with project conventions and release process
95876b1 fix: decode SMTP server responses as UTF-8 at line boundary
0a43876 fix: sanitize CRLF in transport name option to prevent SMTP command injection...
08e59e6 chore: update dev dependencies
2d31975 chore(master): release 8.0.4 (#1806)
2d7b971 fix: sanitize envelope size to prevent SMTP command injection
4e702e9 chore(master): release 8.0.3 (#1804)
c803d90 fix: remove familySupportCache that broke DNS resolution tests
e8c8b92 fix: fix cookie bugs, remove dead code, and improve hot-path efficiency
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by [GitHub Actions](https://www.npmjs.com/~GitHub Actions), a new releaser for nodemailer since your current version.

Updates brace-expansion from 2.0.1 to 2.0.3

Commits

73b5459 2.0.3
311ac0d Backport fix for GHSA-f886-m6hf-6m8v to v2 (#96)
See full diff in compare view

Updates lodash from 4.17.21 to 4.18.1

Release notes

Sourced from lodash's releases.

4.18.1

Bugs

Fixes a ReferenceError issue in lodash lodash-es lodash-amd and lodash.template when using the template and fromPairs functions from the modular builds. See lodash/lodash#6167

These defects were related to how lodash distributions are built from the main branch using https://github.com/lodash-archive/lodash-cli. When internal dependencies change inside lodash functions, equivalent updates need to be made to a mapping in the lodash-cli. (hey, it was ahead of its time once upon a time!). We know this, but we missed it in the last release. It's the kind of thing that passes in CI, but fails bc the build is not the same thing you tested.

There is no diff on main for this, but you can see the diffs for each of the npm packages on their respective branches:

lodash: lodash/lodash@4.18.0-npm...4.18.1-npm

lodash-es: lodash/lodash@4.18.0-es...4.18.1-es

lodash-amd: lodash/lodash@4.18.0-amd...4.18.1-amd

lodash.templatelodash/lodash@4.18.0-npm-packages...4.18.1-npm-packages

4.18.0

v4.18.0

Full Changelog: lodash/lodash@4.17.23...4.18.0

Security

_.unset / _.omit: Fixed prototype pollution via constructor/prototype path traversal (GHSA-f23m-r3pf-42rh, fe8d32e). Previously, array-wrapped path segments and primitive roots could bypass the existing guards, allowing deletion of properties from built-in prototypes. Now constructor and prototype are blocked unconditionally as non-terminal path keys, matching baseSet. Calls that previously returned true and deleted the property now return false and leave the target untouched.

_.template: Fixed code injection via imports keys (GHSA-r5fr-rjxr-66jc, CVE-2026-4800, 879aaa9). Fixes an incomplete patch for CVE-2021-23337. The variable option was validated against reForbiddenIdentifierChars but importsKeys was left unguarded, allowing code injection via the same Function() constructor sink. imports keys containing forbidden identifier characters now throw "Invalid imports option passed into _.template".

Docs

Add security notice for _.template in threat model and API docs (#6099)

Document lower > upper behavior in _.random (#6115)

Fix quotes in _.compact jsdoc (#6090)

lodash.* modular packages

Diff

We have also regenerated and published a select number of the lodash.* modular packages.

These modular packages had fallen out of sync significantly from the minor/patch updates to lodash. Specifically, we have brought the following packages up to parity w/ the latest lodash release because they have had CVEs on them in the past:

lodash.orderby

lodash.tonumber

lodash.trim

lodash.trimend

lodash.sortedindexby

lodash.zipobjectdeep

lodash.unset

lodash.omit

lodash.template

Commits

cb0b9b9 release(patch): bump main to 4.18.1 (#6177)
75535f5 chore: prune stale advisory refs (#6170)
62e91bc docs: remove n_ Node.js < 6 REPL note from README (#6165)
59be2de release(minor): bump to 4.18.0 (#6161)
af63457 fix: broken tests for _.template 879aaa9
1073a76 fix: linting issues
879aaa9 fix: validate imports keys in _.template
fe8d32e fix: block prototype pollution in baseUnset via constructor/prototype traversal
18ba0a3 refactor(fromPairs): use baseAssignValue for consistent assignment (#6153)
b819080 ci: add dist sync validation workflow (#6137)
Additional commits viewable in compare view

Updates brace-expansion from 1.1.11 to 1.1.13

Commits

73b5459 2.0.3
311ac0d Backport fix for GHSA-f886-m6hf-6m8v to v2 (#96)
See full diff in compare view

Updates handlebars from 4.0.11 to 4.7.9

Release notes

Sourced from handlebars's releases.

v4.7.9

fix: enable shell mode for spawn to resolve Windows EINVAL issue - e0137c2

fix type "RuntimeOptions" also accepting string partials - eab1d14

feat(types): set hash to be a Record<string, any> - de4414d

fix non...
Description has been truncated

Bumps the npm_and_yarn group with 2 updates in the /compiler/internal/vm/debugger/tools/lldb-dap/extension directory: [brace-expansion](https://github.com/juliangruber/brace-expansion) and [picomatch](https://github.com/micromatch/picomatch). Bumps the npm_and_yarn group with 6 updates in the /compiler/internal/vm/foundation/test directory: | Package | From | To | | --- | --- | --- | | [@nestjs/core](https://github.com/nestjs/nest/tree/HEAD/packages/core) | `11.0.3` | `11.1.18` | | [astro](https://github.com/withastro/astro/tree/HEAD/packages/astro) | `5.5.5` | `5.18.1` | | [happy-dom](https://github.com/capricorn86/happy-dom) | `17.0.3` | `20.8.9` | | [hono](https://github.com/honojs/hono) | `4.7.2` | `4.12.12` | | [lodash](https://github.com/lodash/lodash) | `4.17.21` | `4.18.1` | | [nodemailer](https://github.com/nodemailer/nodemailer) | `6.9.3` | `8.0.5` | Bumps the npm_and_yarn group with 1 update in the /compiler/internal/vm/foundation/test/cli/install/migration/contoso-test directory: [brace-expansion](https://github.com/juliangruber/brace-expansion). Bumps the npm_and_yarn group with 1 update in the /compiler/internal/vm/foundation/test/cli/install/migration/missing-resolved-properties directory: [lodash](https://github.com/lodash/lodash). Bumps the npm_and_yarn group with 2 updates in the /compiler/internal/vm/foundation/test/cli/install/migration/yarn/yarn-cli-repo directory: [brace-expansion](https://github.com/juliangruber/brace-expansion) and [handlebars](https://github.com/handlebars-lang/handlebars.js). Bumps the npm_and_yarn group with 2 updates in the /compiler/internal/vm/foundation/test/integration/vite-build/the-test-app directory: [nodemailer](https://github.com/nodemailer/nodemailer) and [vite](https://github.com/vitejs/vite/tree/HEAD/packages/vite). Bumps the npm_and_yarn group with 1 update in the /compiler/internal/vm/foundation/test/js/third_party/astro directory: [astro](https://github.com/withastro/astro/tree/HEAD/packages/astro). Bumps the npm_and_yarn group with 4 updates in the /compiler/internal/vm/libconsepts/dynamic_bitset/doc directory: [brace-expansion](https://github.com/juliangruber/brace-expansion), [picomatch](https://github.com/micromatch/picomatch), [handlebars](https://github.com/handlebars-lang/handlebars.js) and [convict](https://github.com/mozilla/node-convict). Bumps the npm_and_yarn group with 1 update in the /compiler/internal/vm/libconsepts/msm/doc directory: [picomatch](https://github.com/micromatch/picomatch). Bumps the npm_and_yarn group with 4 updates in the /compiler/internal/vm/libconsepts/openmethod/doc directory: [brace-expansion](https://github.com/juliangruber/brace-expansion), [picomatch](https://github.com/micromatch/picomatch), [handlebars](https://github.com/handlebars-lang/handlebars.js) and [convict](https://github.com/mozilla/node-convict). Bumps the npm_and_yarn group with 4 updates in the /compiler/internal/vm/libconsepts/redis/doc directory: [brace-expansion](https://github.com/juliangruber/brace-expansion), [picomatch](https://github.com/micromatch/picomatch), [handlebars](https://github.com/handlebars-lang/handlebars.js) and [convict](https://github.com/mozilla/node-convict). Bumps the npm_and_yarn group with 4 updates in the /compiler/internal/vm/libconsepts/unordered/doc directory: [brace-expansion](https://github.com/juliangruber/brace-expansion), [picomatch](https://github.com/micromatch/picomatch), [handlebars](https://github.com/handlebars-lang/handlebars.js) and [convict](https://github.com/mozilla/node-convict). Bumps the npm_and_yarn group with 4 updates in the /compiler/internal/vm/libconsepts/url/doc directory: [brace-expansion](https://github.com/juliangruber/brace-expansion), [picomatch](https://github.com/micromatch/picomatch), [handlebars](https://github.com/handlebars-lang/handlebars.js) and [convict](https://github.com/mozilla/node-convict). Updates `brace-expansion` from 2.0.2 to 2.0.3 - [Release notes](https://github.com/juliangruber/brace-expansion/releases) - [Commits](juliangruber/brace-expansion@v2.0.2...v2.0.3) Updates `brace-expansion` from 1.1.12 to 1.1.13 - [Release notes](https://github.com/juliangruber/brace-expansion/releases) - [Commits](juliangruber/brace-expansion@v2.0.2...v2.0.3) Updates `picomatch` from 2.3.1 to 2.3.2 - [Release notes](https://github.com/micromatch/picomatch/releases) - [Changelog](https://github.com/micromatch/picomatch/blob/master/CHANGELOG.md) - [Commits](micromatch/picomatch@2.3.1...2.3.2) Updates `@nestjs/core` from 11.0.3 to 11.1.18 - [Release notes](https://github.com/nestjs/nest/releases) - [Commits](https://github.com/nestjs/nest/commits/v11.1.18/packages/core) Updates `astro` from 5.5.5 to 5.18.1 - [Release notes](https://github.com/withastro/astro/releases) - [Changelog](https://github.com/withastro/astro/blob/astro@5.18.1/packages/astro/CHANGELOG.md) - [Commits](https://github.com/withastro/astro/commits/astro@5.18.1/packages/astro) Updates `happy-dom` from 17.0.3 to 20.8.9 - [Release notes](https://github.com/capricorn86/happy-dom/releases) - [Commits](capricorn86/happy-dom@v17.0.3...v20.8.9) Updates `hono` from 4.7.2 to 4.12.12 - [Release notes](https://github.com/honojs/hono/releases) - [Commits](honojs/hono@v4.7.2...v4.12.12) Updates `lodash` from 4.17.21 to 4.18.1 - [Release notes](https://github.com/lodash/lodash/releases) - [Commits](lodash/lodash@4.17.21...4.18.1) Updates `nodemailer` from 6.9.3 to 8.0.5 - [Release notes](https://github.com/nodemailer/nodemailer/releases) - [Changelog](https://github.com/nodemailer/nodemailer/blob/master/CHANGELOG.md) - [Commits](nodemailer/nodemailer@v6.9.3...v8.0.5) Updates `brace-expansion` from 2.0.1 to 2.0.3 - [Release notes](https://github.com/juliangruber/brace-expansion/releases) - [Commits](juliangruber/brace-expansion@v2.0.2...v2.0.3) Updates `lodash` from 4.17.21 to 4.18.1 - [Release notes](https://github.com/lodash/lodash/releases) - [Commits](lodash/lodash@4.17.21...4.18.1) Updates `brace-expansion` from 1.1.11 to 1.1.13 - [Release notes](https://github.com/juliangruber/brace-expansion/releases) - [Commits](juliangruber/brace-expansion@v2.0.2...v2.0.3) Updates `handlebars` from 4.0.11 to 4.7.9 - [Release notes](https://github.com/handlebars-lang/handlebars.js/releases) - [Changelog](https://github.com/handlebars-lang/handlebars.js/blob/v4.7.9/release-notes.md) - [Commits](handlebars-lang/handlebars.js@v4.0.11...v4.7.9) Updates `nodemailer` from 6.10.1 to 8.0.5 - [Release notes](https://github.com/nodemailer/nodemailer/releases) - [Changelog](https://github.com/nodemailer/nodemailer/blob/master/CHANGELOG.md) - [Commits](nodemailer/nodemailer@v6.9.3...v8.0.5) Updates `vite` from 5.4.21 to 8.0.7 - [Release notes](https://github.com/vitejs/vite/releases) - [Changelog](https://github.com/vitejs/vite/blob/main/packages/vite/CHANGELOG.md) - [Commits](https://github.com/vitejs/vite/commits/v8.0.7/packages/vite) Updates `astro` from 5.5.5 to 5.18.1 - [Release notes](https://github.com/withastro/astro/releases) - [Changelog](https://github.com/withastro/astro/blob/astro@5.18.1/packages/astro/CHANGELOG.md) - [Commits](https://github.com/withastro/astro/commits/astro@5.18.1/packages/astro) Updates `brace-expansion` from 1.1.12 to 1.1.13 - [Release notes](https://github.com/juliangruber/brace-expansion/releases) - [Commits](juliangruber/brace-expansion@v2.0.2...v2.0.3) Updates `picomatch` from 2.3.1 to 2.3.2 - [Release notes](https://github.com/micromatch/picomatch/releases) - [Changelog](https://github.com/micromatch/picomatch/blob/master/CHANGELOG.md) - [Commits](micromatch/picomatch@2.3.1...2.3.2) Updates `picomatch` from 4.0.2 to 4.0.4 - [Release notes](https://github.com/micromatch/picomatch/releases) - [Changelog](https://github.com/micromatch/picomatch/blob/master/CHANGELOG.md) - [Commits](micromatch/picomatch@2.3.1...2.3.2) Updates `handlebars` from 4.7.8 to 4.7.9 - [Release notes](https://github.com/handlebars-lang/handlebars.js/releases) - [Changelog](https://github.com/handlebars-lang/handlebars.js/blob/v4.7.9/release-notes.md) - [Commits](handlebars-lang/handlebars.js@v4.0.11...v4.7.9) Updates `convict` from 6.2.4 to 6.2.5 - [Changelog](https://github.com/mozilla/node-convict/blob/master/CHANGELOG.md) - [Commits](https://github.com/mozilla/node-convict/commits) Updates `picomatch` from 2.3.1 to 2.3.2 - [Release notes](https://github.com/micromatch/picomatch/releases) - [Changelog](https://github.com/micromatch/picomatch/blob/master/CHANGELOG.md) - [Commits](micromatch/picomatch@2.3.1...2.3.2) Updates `brace-expansion` from 1.1.12 to 1.1.13 - [Release notes](https://github.com/juliangruber/brace-expansion/releases) - [Commits](juliangruber/brace-expansion@v2.0.2...v2.0.3) Updates `picomatch` from 2.3.1 to 2.3.2 - [Release notes](https://github.com/micromatch/picomatch/releases) - [Changelog](https://github.com/micromatch/picomatch/blob/master/CHANGELOG.md) - [Commits](micromatch/picomatch@2.3.1...2.3.2) Updates `picomatch` from 4.0.3 to 4.0.4 - [Release notes](https://github.com/micromatch/picomatch/releases) - [Changelog](https://github.com/micromatch/picomatch/blob/master/CHANGELOG.md) - [Commits](micromatch/picomatch@2.3.1...2.3.2) Updates `handlebars` from 4.7.8 to 4.7.9 - [Release notes](https://github.com/handlebars-lang/handlebars.js/releases) - [Changelog](https://github.com/handlebars-lang/handlebars.js/blob/v4.7.9/release-notes.md) - [Commits](handlebars-lang/handlebars.js@v4.0.11...v4.7.9) Updates `convict` from 6.2.4 to 6.2.5 - [Changelog](https://github.com/mozilla/node-convict/blob/master/CHANGELOG.md) - [Commits](https://github.com/mozilla/node-convict/commits) Updates `brace-expansion` from 1.1.12 to 1.1.13 - [Release notes](https://github.com/juliangruber/brace-expansion/releases) - [Commits](juliangruber/brace-expansion@v2.0.2...v2.0.3) Updates `picomatch` from 2.3.1 to 2.3.2 - [Release notes](https://github.com/micromatch/picomatch/releases) - [Changelog](https://github.com/micromatch/picomatch/blob/master/CHANGELOG.md) - [Commits](micromatch/picomatch@2.3.1...2.3.2) Updates `picomatch` from 4.0.2 to 4.0.4 - [Release notes](https://github.com/micromatch/picomatch/releases) - [Changelog](https://github.com/micromatch/picomatch/blob/master/CHANGELOG.md) - [Commits](micromatch/picomatch@2.3.1...2.3.2) Updates `handlebars` from 4.7.8 to 4.7.9 - [Release notes](https://github.com/handlebars-lang/handlebars.js/releases) - [Changelog](https://github.com/handlebars-lang/handlebars.js/blob/v4.7.9/release-notes.md) - [Commits](handlebars-lang/handlebars.js@v4.0.11...v4.7.9) Updates `convict` from 6.2.4 to 6.2.5 - [Changelog](https://github.com/mozilla/node-convict/blob/master/CHANGELOG.md) - [Commits](https://github.com/mozilla/node-convict/commits) Updates `brace-expansion` from 1.1.12 to 1.1.13 - [Release notes](https://github.com/juliangruber/brace-expansion/releases) - [Commits](juliangruber/brace-expansion@v2.0.2...v2.0.3) Updates `picomatch` from 2.3.1 to 2.3.2 - [Release notes](https://github.com/micromatch/picomatch/releases) - [Changelog](https://github.com/micromatch/picomatch/blob/master/CHANGELOG.md) - [Commits](micromatch/picomatch@2.3.1...2.3.2) Updates `picomatch` from 4.0.3 to 4.0.4 - [Release notes](https://github.com/micromatch/picomatch/releases) - [Changelog](https://github.com/micromatch/picomatch/blob/master/CHANGELOG.md) - [Commits](micromatch/picomatch@2.3.1...2.3.2) Updates `handlebars` from 4.7.8 to 4.7.9 - [Release notes](https://github.com/handlebars-lang/handlebars.js/releases) - [Changelog](https://github.com/handlebars-lang/handlebars.js/blob/v4.7.9/release-notes.md) - [Commits](handlebars-lang/handlebars.js@v4.0.11...v4.7.9) Updates `convict` from 6.2.4 to 6.2.5 - [Changelog](https://github.com/mozilla/node-convict/blob/master/CHANGELOG.md) - [Commits](https://github.com/mozilla/node-convict/commits) Updates `brace-expansion` from 1.1.12 to 1.1.13 - [Release notes](https://github.com/juliangruber/brace-expansion/releases) - [Commits](juliangruber/brace-expansion@v2.0.2...v2.0.3) Updates `picomatch` from 2.3.1 to 2.3.2 - [Release notes](https://github.com/micromatch/picomatch/releases) - [Changelog](https://github.com/micromatch/picomatch/blob/master/CHANGELOG.md) - [Commits](micromatch/picomatch@2.3.1...2.3.2) Updates `picomatch` from 4.0.3 to 4.0.4 - [Release notes](https://github.com/micromatch/picomatch/releases) - [Changelog](https://github.com/micromatch/picomatch/blob/master/CHANGELOG.md) - [Commits](micromatch/picomatch@2.3.1...2.3.2) Updates `handlebars` from 4.7.8 to 4.7.9 - [Release notes](https://github.com/handlebars-lang/handlebars.js/releases) - [Changelog](https://github.com/handlebars-lang/handlebars.js/blob/v4.7.9/release-notes.md) - [Commits](handlebars-lang/handlebars.js@v4.0.11...v4.7.9) Updates `convict` from 6.2.4 to 6.2.5 - [Changelog](https://github.com/mozilla/node-convict/blob/master/CHANGELOG.md) - [Commits](https://github.com/mozilla/node-convict/commits) --- updated-dependencies: - dependency-name: brace-expansion dependency-version: 2.0.3 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: brace-expansion dependency-version: 1.1.13 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: picomatch dependency-version: 2.3.2 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: "@nestjs/core" dependency-version: 11.1.18 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: astro dependency-version: 5.18.1 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: happy-dom dependency-version: 20.8.9 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: hono dependency-version: 4.12.12 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: lodash dependency-version: 4.18.1 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: nodemailer dependency-version: 8.0.5 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: brace-expansion dependency-version: 2.0.3 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: lodash dependency-version: 4.18.1 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: brace-expansion dependency-version: 1.1.13 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: handlebars dependency-version: 4.7.9 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: nodemailer dependency-version: 8.0.5 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: vite dependency-version: 8.0.7 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: astro dependency-version: 5.18.1 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: brace-expansion dependency-version: 1.1.13 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: picomatch dependency-version: 2.3.2 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: picomatch dependency-version: 4.0.4 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: handlebars dependency-version: 4.7.9 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: convict dependency-version: 6.2.5 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: picomatch dependency-version: 2.3.2 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: brace-expansion dependency-version: 1.1.13 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: picomatch dependency-version: 2.3.2 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: picomatch dependency-version: 4.0.4 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: handlebars dependency-version: 4.7.9 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: convict dependency-version: 6.2.5 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: brace-expansion dependency-version: 1.1.13 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: picomatch dependency-version: 2.3.2 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: picomatch dependency-version: 4.0.4 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: handlebars dependency-version: 4.7.9 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: convict dependency-version: 6.2.5 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: brace-expansion dependency-version: 1.1.13 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: picomatch dependency-version: 2.3.2 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: picomatch dependency-version: 4.0.4 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: handlebars dependency-version: 4.7.9 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: convict dependency-version: 6.2.5 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: brace-expansion dependency-version: 1.1.13 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: picomatch dependency-version: 2.3.2 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: picomatch dependency-version: 4.0.4 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: handlebars dependency-version: 4.7.9 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: convict dependency-version: 6.2.5 dependency-type: indirect dependency-group: npm_and_yarn ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update Javascript code labels Apr 8, 2026

This was referenced Apr 8, 2026

Bump the npm_and_yarn group across 12 directories with 10 updates #53

Closed

Bump the npm_and_yarn group across 13 directories with 10 updates #54

Closed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Bump the npm_and_yarn group across 13 directories with 11 updates#55

Bump the npm_and_yarn group across 13 directories with 11 updates#55
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/compiler/internal/vm/debugger/tools/lldb-dap/extension/npm_and_yarn-c8ad4cb3df

dependabot Bot commented on behalf of github Apr 8, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

dependabot Bot commented on behalf of github Apr 8, 2026

2.3.2

What's Changed

Release history

4.0.0 (2024-02-07)

Fixes

Changed

3.0.1

Fixes

v11.1.18 (2026-04-03)

Bug fixes

Dependencies

Committers: 6

v11.1.17 (2026-03-16)

Enhancements

Bugs

Dependencies

Committers: 3

astro@5.18.1

Patch Changes

5.18.1

Patch Changes

5.18.0

Minor Changes

Patch Changes

5.17.3

Patch Changes

5.17.2

Patch Changes

5.17.1

Patch Changes

v20.8.9

👷‍♂️ Patch fixes

v20.8.8

👷‍♂️ Patch fixes

v20.8.7

👷‍♂️ Patch fixes

v20.8.6

👷‍♂️ Patch fixes

v20.8.5

👷‍♂️ Patch fixes

v20.8.4

👷‍♂️ Patch fixes

v20.8.3

👷‍♂️ Patch fixes

v20.8.2

👷‍♂️ Patch fixes

v20.8.1

👷‍♂️ Patch fixes

v20.8.0

🎨 Features

v20.7.2

👷‍♂️ Patch fixes

v20.7.1

👷‍♂️ Patch fixes

v4.12.12

Security fixes

Middleware bypass via repeated slashes in serveStatic

Path traversal in toSSG() allows writing files outside the output directory

Incorrect IP matching in ipRestriction() for IPv4-mapped IPv6 addresses

Missing validation of cookie name on write path in setCookie()

Non-breaking space prefix bypass in cookie name handling in getCookie()

v4.12.11

What's Changed

New Contributors

v4.12.10

What's Changed

New Contributors

4.18.1

Bugs

4.18.0

v4.18.0

Security

Docs

lodash.* modular packages

v8.0.5

8.0.5 (2026-04-07)

Bug Fixes

v8.0.4

`lodash.*` modular packages

`lodash.*` modular packages