From 5daf0ff4ce7d5d6c3f6e112cdb512248cb425870 Mon Sep 17 00:00:00 2001 From: Tanmay Deep Sharma Date: Thu, 12 Mar 2026 12:48:02 +0530 Subject: [PATCH] fix: upgrade lodash to 4.17.23 to remediate CVE-2025-13465 --- package.json | 3 ++- pnpm-lock.yaml | 13 +++++++------ 2 files changed, 9 insertions(+), 7 deletions(-) diff --git a/package.json b/package.json index 0f74d03f4..ab17d2666 100644 --- a/package.json +++ b/package.json @@ -162,7 +162,8 @@ "vite": "5.4.21", "vitest": "3.0.5", "minimatch@<4": "3.1.5", - "minimatch@>=9.0.0 <9.0.7": "9.0.9" + "minimatch@>=9.0.0 <9.0.7": "9.0.9", + "lodash@>=4.0.0 <=4.17.22": "4.17.23" } }, "lint-staged": { diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml index abd4acdeb..949e013cf 100644 --- a/pnpm-lock.yaml +++ b/pnpm-lock.yaml @@ -10,6 +10,7 @@ overrides: vitest: 3.0.5 minimatch@<4: 3.1.5 minimatch@>=9.0.0 <9.0.7: 9.0.9 + lodash@>=4.0.0 <=4.17.22: 4.17.23 importers: @@ -3129,8 +3130,8 @@ packages: lodash.truncate@4.4.2: resolution: {integrity: sha512-jttmRe7bRse52OsWIMDLaXxWqRAmtIUccAQ3garviCqJjafXOfNMO0yMfNpdD6zbGaTU0P5Nz7e7gAT6cKmJRw==} - lodash@4.17.21: - resolution: {integrity: sha512-v2kDEe57lecTulaDIuNTPy3Ry4gLGJ6Z1O3vE1krgXZNrsQ+LFTGHVxVjcXPs17LhbZVGedAJv8XZ1tvj5FvSg==} + lodash@4.17.23: + resolution: {integrity: sha512-LgVTMpQtIopCi79SJeDiP0TfWi5CNEc/L/aRdTh3yIvmZXTnheWpKjSZhnvMl8iXbC1tFg9gdHHDMLoV7CnG+w==} log-symbols@6.0.0: resolution: {integrity: sha512-i24m8rpwhmPIS4zscNzK6MSEhk0DUWa/8iYQWxhffV8jkI4Phvs3F+quL5xvS0gdQR0FyTCMMH33Y78dDTzzIw==} @@ -5531,7 +5532,7 @@ snapshots: js-yaml: 4.1.0 json5: 2.2.3 jsonc-eslint-parser: 2.4.0 - lodash: 4.17.21 + lodash: 4.17.23 parse5: 7.1.2 semver: 7.6.3 synckit: 0.9.1 @@ -8009,7 +8010,7 @@ snapshots: lodash.truncate@4.4.2: {} - lodash@4.17.21: {} + lodash@4.17.23: {} log-symbols@6.0.0: dependencies: @@ -9597,7 +9598,7 @@ snapshots: eslint-visitor-keys: 3.4.3 espree: 9.6.1 esquery: 1.5.0 - lodash: 4.17.21 + lodash: 4.17.23 semver: 7.6.3 transitivePeerDependencies: - supports-color @@ -9789,7 +9790,7 @@ snapshots: yaml-eslint-parser@1.2.3: dependencies: eslint-visitor-keys: 3.4.3 - lodash: 4.17.21 + lodash: 4.17.23 yaml: 2.5.1 yaml@2.5.1: {}