chore(deps): bump lodash and lodash-contrib#1959
chore(deps): bump lodash and lodash-contrib#1959dependabot[bot] wants to merge 1 commit intodevelopfrom
Conversation
dependabot
bot
added
dependencies
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
| "lodash": "^4.17.21", | ||
| "lodash-contrib": "^4.1200.1", | ||
| "lodash": "^4.17.23", | ||
| "lodash-contrib": "^31001.1.0", |
There was a problem hiding this comment.
Security update introduces vulnerable lodash 3.10.1 dependency
High Severity
The lodash-contrib update from 4.1200.1 to 31001.1.0 introduces lodash@3.10.1 as a nested dependency, which has known security vulnerabilities including prototype pollution (CVE-2019-10744) and command injection (CVE-2021-23337). This negates the security benefit of updating the main lodash package and actually makes the dependency tree less secure than before. The previous lodash-contrib@4.1200.1 used lodash@4.12.x, so this is a significant downgrade in the transitive dependency.
Additional Locations (1)
| "bpmn-moddle": "^6.0.0", | ||
| "i18next": "^15.0.8", | ||
| "jointjs": "^3.1.1", | ||
| "lodash": "^4.17.21", |
There was a problem hiding this comment.
Lodash removed from peerDependencies in lockfile but remains in package.json
Low Severity
The package.json updates lodash in peerDependencies from ^4.17.21 to ^4.17.23, but package-lock.json removes lodash entirely from its peerDependencies section instead of updating it. This inconsistency between the two files means the lockfile no longer accurately reflects the package's peer dependency declarations, which could affect dependency resolution for consumers of this package.
Additional Locations (1)
modeler
|
||||||||||||||||||||||||||||
| Project |
modeler
|
| Branch Review |
dependabot/npm_and_yarn/multi-9767cac4aa
|
| Run status |
|
| Run duration | 06m 17s |
| Commit |
|
| Committer | dependabot[bot] |
| View all properties for this run ↗︎ | |
| Test results | |
|---|---|
Failures
|
0
|
Flaky
|
0
|
Pending
|
83
|
Skipped
|
0
|
Passing
|
310
|
| View all changes introduced in this branch ↗︎ | |
dependabot
bot
force-pushed
the
dependabot/npm_and_yarn/multi-9767cac4aa
branch
2 times, most recently
from
7dbedfa to
c36ae72
Compare
Bumps [lodash](https://github.com/lodash/lodash) and [lodash-contrib](https://github.com/node4good/lodash-contrib). These dependencies needed to be updated together. Updates `lodash` from 4.17.21 to 4.17.23 - [Release notes](https://github.com/lodash/lodash/releases) - [Commits](lodash/lodash@4.17.21...4.17.23) Updates `lodash-contrib` from 4.1200.1 to 31001.1.0 - [Commits](node4good/lodash-contrib@v4.1200.1...v31001.1.0) --- updated-dependencies: - dependency-name: lodash dependency-version: 4.17.23 dependency-type: direct:production - dependency-name: lodash-contrib dependency-version: 31001.1.0 dependency-type: direct:production ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
bot
force-pushed
the
dependabot/npm_and_yarn/multi-9767cac4aa
branch
from
c36ae72 to
bee9f4f
Compare
There was a problem hiding this comment.
Cursor Bugbot has reviewed your changes and found 1 potential issue.
Bugbot Autofix is OFF. To automatically fix reported issues with Cloud Agents, enable Autofix in the Cursor dashboard.
| "license": "MIT", | ||
| "dependencies": { | ||
| "lodash": "4.12.x" | ||
| "lodash": "3.10.1" |
There was a problem hiding this comment.
lodash-contrib downgrade bundles incompatible lodash 3.x internally
High Severity
The lodash-contrib update from 4.1200.1 to 31001.1.0 changes its internal dependency from lodash 4.12.x to lodash 3.10.1, a major version downgrade. The main application uses lodash 4.17.23, but lodash-contrib now bundles a 10-year-old lodash 3.x with different APIs and behaviors. This mismatch could cause subtle runtime bugs when isJSON or other lodash-contrib functions interact with application code expecting lodash 4.x semantics. Additionally, lodash 3.10.1 has known security vulnerabilities fixed in later versions.
Additional Locations (1)
|
Bumps lodash and lodash-contrib. These dependencies needed to be updated together.
Updates
lodashfrom 4.17.21 to 4.17.23Commits
dec55b7Bump main to v4.17.23 (#6088)19c9251fix: setCacheHas JSDoc return type should be boolean (#6071)b5e6729jsdoc: Add -0 and BigInt zeros to _.compact falsey values list (#6062)edadd45Prevent prototype pollution on baseUnset function4879a7adoc: fix autoLink function, conversion of source links (#6056)9648f69chore: removeyarn.lockfile (#6053)dfa407dci: remove legacy configuration files (#6052)156e196feat: add renovate setup (#6039)933e106ci: add pipeline for Bun (#6023)072a807docs: update links related to Open JS Foundation (#5968)Updates
lodash-contribfrom 4.1200.1 to 31001.1.0Commits
a6295eb[util.strings] Update slugify tests to match lodash style8655e8e[util.strings] Port slugify tests to QUnit setupcb3c2c6[util.strings] Add tests for slugify and fix issues3bc3ba5[util.strings] Move regular expressions to one object literald734c84[util.strings] Add error message to strContains throw statement212bd98reworked into CommonJS primary -> browserify for browsers2645d8dupdate author1d0231btravis fixd16414etravis fix8e66967393.0.1Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot mergewill merge this PR after your CI passes on it@dependabot squash and mergewill squash and merge this PR after your CI passes on it@dependabot cancel mergewill cancel a previously requested merge and block automerging@dependabot reopenwill reopen this PR if it is closed@dependabot closewill close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)You can disable automated security fix PRs for this repo from the Security Alerts page.
Note
Medium Risk
Dependency-only change, but
lodash-contrib’s major version shift and its internallodash@3.10.1dependency could introduce subtle runtime differences in any contrib usage.Overview
Bumps runtime deps
lodashto4.17.23andlodash-contribto31001.1.0, and updates thelodashpeer dependency to match.Refreshes
package-lock.jsonwith the new resolved artifacts, includinglodash-contribnow vendoringlodash@3.10.1and dropping optional transitive packages likenode-notifier/growly/shellwordsfrom the lockfile; also loosens the lockfile entry for devDependencyvue-loaderfromlatestto*.Written by Cursor Bugbot for commit bee9f4f. This will update automatically on new commits. Configure here.