You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Fixes a ReferenceError issue in lodashlodash-eslodash-amd and lodash.template when using the template and fromPairs functions from the modular builds. See lodash/lodash#6167
These defects were related to how lodash distributions are built from the main branch using https://github.com/lodash-archive/lodash-cli. When internal dependencies change inside lodash functions, equivalent updates need to be made to a mapping in the lodash-cli. (hey, it was ahead of its time once upon a time!). We know this, but we missed it in the last release. It's the kind of thing that passes in CI, but fails bc the build is not the same thing you tested.
There is no diff on main for this, but you can see the diffs for each of the npm packages on their respective branches:
_.unset / _.omit: Fixed prototype pollution via constructor/prototype path traversal (GHSA-f23m-r3pf-42rh, fe8d32e). Previously, array-wrapped path segments and primitive roots could bypass the existing guards, allowing deletion of properties from built-in prototypes. Now constructor and prototype are blocked unconditionally as non-terminal path keys, matching baseSet. Calls that previously returned true and deleted the property now return false and leave the target untouched.
_.template: Fixed code injection via imports keys (GHSA-r5fr-rjxr-66jc, CVE-2026-4800, 879aaa9). Fixes an incomplete patch for CVE-2021-23337. The variable option was validated against reForbiddenIdentifierChars but importsKeys was left unguarded, allowing code injection via the same Function() constructor sink. imports keys containing forbidden identifier characters now throw "Invalid imports option passed into _.template".
Docs
Add security notice for _.template in threat model and API docs (#6099)
Document lower > upper behavior in _.random (#6115)
We have also regenerated and published a select number of the lodash.* modular packages.
These modular packages had fallen out of sync significantly from the minor/patch updates to lodash. Specifically, we have brought the following packages up to parity w/ the latest lodash release because they have had CVEs on them in the past:
HIGH: Denial of Service in BigInteger.modInverse()
A Denial of Service (DoS) vulnerability exists due to an infinite loop in
the BigInteger.modInverse() function (inherited from the bundled jsbn
library). When modInverse() is called with a zero value as input, the
internal Extended Euclidean Algorithm enters an unreachable exit condition,
causing the process to hang indefinitely and consume 100% CPU.
HIGH: Signature forgery in RSA-PKCS due to ASN.1 extra field.
RSASSA PKCS#1 v1.5 signature verification accepts forged signatures for low
public exponent keys (e=3). Attackers can forge signatures by stuffing
"garbage" bytes within the ASN.1 structure in order to construct a
signature that passes verification, enabling Bleichenbacher style forgery.
This issue is similar to CVE-2022-24771, but adds bytes in an addition
field within the ASN.1 structure, rather than outside of it.
Additionally, forge does not validate that signatures include a minimum of
8 bytes of padding as defined by the specification, providing attackers
additional space to construct Bleichenbacher forgeries.
Reported as part of a U.C. Berkeley security research project by:
HIGH: Signature forgery in Ed25519 due to missing S < L check.
Ed25519 signature verification accepts forged non-canonical signatures
where the scalar S is not reduced modulo the group order (S >= L). A valid
signature and its S + L variant both verify in forge, while Node.js
crypto.verify (OpenSSL-backed) rejects the S + L variant, as defined by the
specification. This class of signature malleability has been exploited in
practice to bypass authentication and authorization logic (see
CVE-2026-25793, CVE-2022-35961). Applications relying on signature
uniqueness (i.e., dedup by signature bytes, replay tracking, signed-object
canonicalization checks) may be bypassed.
Reported as part of a U.C. Berkeley security research project by:
HIGH: basicConstraints bypass in certificate chain verification.
pki.verifyCertificateChain() does not enforce RFC 5280 basicConstraints
requirements when an intermediate certificate lacks both the
basicConstraints and keyUsage extensions. This allows any leaf
certificate (without these extensions) to act as a CA and sign other
certificates, which node-forge will accept as valid.
Reported by Doruk Tan Ozturk (@peaktwilight) - doruk.ch
Migrates from our unsupported fork of sax (@trysound/sax) to the upstream version of sax (sax).
Bug Fixes
No longer throws error when encountering comments in DTD.
Metrics
Before and after of the browser bundle of each respective version:
v3.3.2
v3.3.3
Delta
svgo.browser.js
910.9 kB
912.9 kB
⬆️ 2 kB
Support
SVGO v3 is not officially supported, please consider upgrading to SVGO v4 instead. We've backported this fix as there are security implications, but there is no commitment to do this for more complex changes in future.
CSS @import now inherits the parent module's exportType, so a file configured as "text" correctly creates a style tag when @imported by a "style" parent. (by @xiaoxiaojx in #20838)
Make asset modules available in JS context when referenced from both CSS and a lazily compiled JS chunk. (by @xiaoxiaojx in #20801)
Include missing generator options in hash to ensure persistent cache invalidation when configuration changes (CssGenerator exportsOnly, JsonGenerator JSONParse, WebAssemblyGenerator mangleImports). (by @xiaoxiaojx in #20821)
Fix || default value handling in ProgressPlugin and ManifestPlugin that incorrectly overrode user-provided falsy values (e.g. modules: false, entries: false, entrypoints: false). (by @xiaoxiaojx in #20823)
Fix two ES5-environment regressions in the anonymous default export .name fix-up: the generated code referenced an undeclared __WEBPACK_DEFAULT_EXPORT__ binding causing ReferenceError, and used Reflect.defineProperty which is not available in pre-ES2015 runtimes. The fix-up now references the real assignment target and uses Object.defineProperty / Object.getOwnPropertyDescriptor. (by @xiaoxiaojx in #20796)
Prevent !important from being renamed as a local identifier in CSS modules. (by @xiaoxiaojx in #20798)
Use compiler context instead of module context for CSS modules local ident hashing to avoid hash collisions when files with the same name exist in different directories. (by @xiaoxiaojx in #20799)
v5.106.0
Minor Changes
Add exportType: "style" for CSS modules to inject styles into DOM via HTMLStyleElement, similar to style-loader functionality. (by @xiaoxiaojx in #20579)
Add context option support for VirtualUrlPlugin (by @xiaoxiaojx in #20449)
The context for the virtual module. A string path. Defaults to 'auto', which will try to resolve the context from the module id.
Support custom context path for resolving relative imports in virtual modules
Add examples demonstrating context usage and filename customization
Generate different CssModule instances for different exportType values. (by @xiaoxiaojx in #20590)
Added the localIdentHashFunction option to configure the hash function to be used for hashing. (by @alexander-akait in #20694)
Additionally, the localIdentName option can now be a function.
Added support for destructuring assignment require in cjs, allowing for tree shaking. (by @ahabhgk in #20548)
Added the validate option to enable/disable validation in webpack/plugins/loaders, also implemented API to make it inside plugins. (by @xiaoxiaojx in #20275)
CSS @import now inherits the parent module's exportType, so a file configured as "text" correctly creates a style tag when @imported by a "style" parent. (by @xiaoxiaojx in #20838)
Make asset modules available in JS context when referenced from both CSS and a lazily compiled JS chunk. (by @xiaoxiaojx in #20801)
Include missing generator options in hash to ensure persistent cache invalidation when configuration changes (CssGenerator exportsOnly, JsonGenerator JSONParse, WebAssemblyGenerator mangleImports). (by @xiaoxiaojx in #20821)
Fix || default value handling in ProgressPlugin and ManifestPlugin that incorrectly overrode user-provided falsy values (e.g. modules: false, entries: false, entrypoints: false). (by @xiaoxiaojx in #20823)
Fix two ES5-environment regressions in the anonymous default export .name fix-up: the generated code referenced an undeclared __WEBPACK_DEFAULT_EXPORT__ binding causing ReferenceError, and used Reflect.defineProperty which is not available in pre-ES2015 runtimes. The fix-up now references the real assignment target and uses Object.defineProperty / Object.getOwnPropertyDescriptor. (by @xiaoxiaojx in #20796)
Prevent !important from being renamed as a local identifier in CSS modules. (by @xiaoxiaojx in #20798)
Use compiler context instead of module context for CSS modules local ident hashing to avoid hash collisions when files with the same name exist in different directories. (by @xiaoxiaojx in #20799)
5.106.0
Minor Changes
Add exportType: "style" for CSS modules to inject styles into DOM via HTMLStyleElement, similar to style-loader functionality. (by @xiaoxiaojx in #20579)
Add context option support for VirtualUrlPlugin (by @xiaoxiaojx in #20449)
The context for the virtual module. A string path. Defaults to 'auto', which will try to resolve the context from the module id.
Support custom context path for resolving relative imports in virtual modules
Add examples demonstrating context usage and filename customization
Generate different CssModule instances for different exportType values. (by @xiaoxiaojx in #20590)
Added the localIdentHashFunction option to configure the hash function to be used for hashing. (by @alexander-akait in #20694)
Additionally, the localIdentName option can now be a function.
Added support for destructuring assignment require in cjs, allowing for tree shaking. (by @ahabhgk in #20548)
Added the validate option to enable/disable validation in webpack/plugins/loaders, also implemented API to make it inside plugins. (by @xiaoxiaojx in #20275)
This version was pushed to npm by GitHub Actions, a new releaser for webpack since your current version.
Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.
Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions wil...
The reason will be displayed to describe this comment to others. Learn more.
Pull Request Overview
While Codacy reports this PR as up to standards, this review identifies critical security risks that prevent merging. Multiple dependencies (lodash and webpack) are being updated to versions that do not exist on the public npm registry, indicating a high risk of a dependency confusion attack. Furthermore, the update introduces breaking environment requirements, specifically for Node.js versions, which must be verified against your CI/CD and production environments. All recommended test scenarios for these security-sensitive bumps are currently missing.
About this PR
The update for 'undici' to 7.25.0 includes a strict engine requirement of Node.js >= 20.18.1. Projects running on older LTS releases (e.g., Node 18 or older Node 20 minor versions) will experience installation failures.
Test suggestions
Verify that docusaurus build and dev server start correctly with updated Webpack and transitive dependencies (acorn, enhanced-resolve, tapable).
Validate lodash fix for prototype pollution (GHSA-f23m-r3pf-42rh) via _.unset and _.omit.
Verify node-forge RSA signature verification for Bleichenbacher-style forgery (CVE-2026-33894).
Confirm that SVG optimization (svgo) still functions correctly after migrating from the @trysound/sax fork to upstream sax.
Prompt proposal for missing tests
Consider implementing these tests if applicable:
1. Verify that docusaurus build and dev server start correctly with updated Webpack and transitive dependencies (acorn, enhanced-resolve, tapable).
2. Validate lodash fix for prototype pollution (GHSA-f23m-r3pf-42rh) via _.unset and _.omit.
3. Verify node-forge RSA signature verification for Bleichenbacher-style forgery (CVE-2026-33894).
4. Confirm that SVG optimization (svgo) still functions correctly after migrating from the @trysound/sax fork to upstream sax.
Low confidence findings
The update for 'sax' (used by svgo) requires Node.js >= 11.0.0. While older than the 'undici' requirement, it represents a jump from the previous fork requirements and should be noted for environment compatibility.
The reason will be displayed to describe this comment to others. Learn more.
🔴 HIGH RISK
The version 5.106.2 for webpack is not available on the public npm registry (the current stable version is 5.97.x). Using an unverified and non-existent version poses a severe security risk and will break the build process during dependency installation. Verify the legitimacy of the webpack@5.106.2 update and check if the project registry configuration has been compromised.
The reason will be displayed to describe this comment to others. Learn more.
🔴 HIGH RISK
The version 4.18.1 for lodash does not exist on the official npm registry (the latest stable release is 4.17.21). Referencing non-existent versions in the lockfile typically indicates a dependency confusion attack or a misconfigured private registry, and will lead to build failures. Investigate why the package-lock.json is referencing lodash@4.18.1 and check for potential dependency confusion vulnerabilities.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
dependenciesPull requests that update a dependency filejavascriptPull requests that update javascript code
0 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
dependabot
Bot
added
dependencies
![codacy-production[bot]](https://avatars.githubusercontent.com/in/56611?s=60&v=4){kind=small}
Bumps the npm_and_yarn group with 12 updates in the /docusaurus directory:
1.1.121.1.140.1.120.1.133.1.03.1.21.15.111.16.04.17.214.18.13.1.23.1.51.3.31.4.02.3.12.3.26.14.06.14.23.3.23.3.37.16.07.25.05.104.05.106.2Updates
brace-expansionfrom 1.1.12 to 1.1.14Commits
10c05fc1.1.141afa1b2Add opt-in { max } mitigation to v1 legacy line (#103)2fbb6a2Revert "Backport fix for GHSA-7h2j-956f-4vf2 to v1 (#101)" (#102)0d7652eBackport fix for GHSA-7h2j-956f-4vf2 to v1 (#101)6c353ca1.1.137fd684fBackport fix for GHSA-f886-m6hf-6m8v (#95)Updates
path-to-regexpfrom 0.1.12 to 0.1.13Release notes
Sourced from path-to-regexp's releases.
Changelog
Sourced from path-to-regexp's changelog.
Commits
9fd0c870.1.13 (#425)7ccf02cfix: CVE-2026-4867Maintainer changes
This version was pushed to npm by ulisesgascon, a new releaser for path-to-regexp since your current version.
Updates
fast-urifrom 3.1.0 to 3.1.2Release notes
Sourced from fast-uri's releases.
Commits
919dd8eBumped v3.1.2c65ba57fixup: linting6c86c17Merge commit from forka95158aHandle malformed fragment decoding without throwing (#171)cea547cBumped v3.1.1876ce79Merge commit from forkdcdf690ci: add lock-threads workflow (#169)c860e65build(deps-dev): bump neostandard from 0.12.2 to 0.13.0 (#167)9b4c6dcbuild(deps): bump fastify/workflows/.github/workflows/plugins-ci.yml (#166)85d09a9build(deps): bump fastify/workflows/.github/workflows/plugins-ci-package-mana...Updates
follow-redirectsfrom 1.15.11 to 1.16.0Commits
0c23a22Release version 1.16.0 of the npm package.844c4d3Add sensitiveHeaders option.5e8b8d0ci: add Node.js 24.x to the CI matrix7953e22ci: upgrade GitHub Actions to use setup-node@v6 and checkout@v686dc1f8Sanitizing input.Updates
lodashfrom 4.17.21 to 4.18.1Release notes
Sourced from lodash's releases.
Commits
cb0b9b9release(patch): bump main to 4.18.1 (#6177)75535f5chore: prune stale advisory refs (#6170)62e91bcdocs: remove n_ Node.js < 6 REPL note from README (#6165)59be2derelease(minor): bump to 4.18.0 (#6161)af63457fix: broken tests for _.template 879aaa91073a76fix: linting issues879aaa9fix: validate imports keys in _.templatefe8d32efix: block prototype pollution in baseUnset via constructor/prototype traversal18ba0a3refactor(fromPairs): use baseAssignValue for consistent assignment (#6153)b819080ci: add dist sync validation workflow (#6137)Updates
minimatchfrom 3.1.2 to 3.1.5Commits
7bba9783.1.5bd25942docs: add warning about ReDoS1a9c27cfix partial matching of globstar patterns1a2e0843.1.4ae24656update lockfileb100374limit recursion for **, improve perf considerably26ffeaalockfile update9eca892lock node version to 1400c323b3.1.330486b2update CI matrix and actionsUpdates
node-forgefrom 1.3.3 to 1.4.0Changelog
Sourced from node-forge's changelog.
... (truncated)
Commits
fa385f9Release 1.4.0.07d4e16Update changelog.cb90fd9Update changelog.963e7c5Add unit test for "pseudonym"f0b6f5bAdd pseudonym OID3df48a3Fix missing CVE ID.2e49283Add x509basicConstraintscheck.bdecf11Add canonical signature scaler check for S < L.af094e6Add RSA padding and DigestInfo length checks.796eeb1Improve jsbn fix.Updates
picomatchfrom 2.3.1 to 2.3.2Release notes
Sourced from picomatch's releases.
Changelog
Sourced from picomatch's changelog.
... (truncated)
Commits
81cba8dPublish 2.3.2fc1f6b6Merge commit from forkeec17aeMerge commit from fork78f8ca4Merge pull request #156 from micromatch/backport-1443f4f10eMerge pull request #144 from Jason3S/jdent-object-propertiesUpdates
qsfrom 6.14.0 to 6.14.2Changelog
Sourced from qs's changelog.
Commits
bdcf0c7v6.14.2294db90[readme] document thataddQueryPrefixdoes not add?to empty output5c308e5[readme] clarifyparseArraysandarrayLimitdocumentation6addf8c[Fix]parse: mark overflow objects for indexed notation exceedingarrayLimitcfc108f[Fix]arrayLimitmeans max count, not max index, incombine/merge/`pars...febb644[Fix]parse: throw onarrayLimitexceeded with indexed notation when `thr...f6a7abf[Fix]parse: enforcearrayLimitoncomma-parsed valuesfbc5206[Fix]parse: fix error message to reflect arrayLimit as max index; remove e...1b9a8b4[actions] fix rebase workflow permissions2a35775[meta] fix changelog typo (arrayLength→arrayLimit)Updates
svgofrom 3.3.2 to 3.3.3Release notes
Sourced from svgo's releases.
Commits
bbab162deps: upgrade to sax v1.5.0Updates
undicifrom 7.16.0 to 7.25.0Release notes
Sourced from undici's releases.
... (truncated)
Commits
12d9045Bumped v7.25.0 (#5025)7a6f7feBumped v7.24.8 (#5020)1f85ae4fix: avoid 401 failures for stream-backed request bodies (#4941) (#5006)c661067chore: update v7.x maintenance release flow84f23e2Bumped v7.24.7 (#4947)a770b10ignore AGENTS.md (#4942)6acd19bfix: correctly handle multi-value rawHeaders in fetch (#4938)1da1c74test: skip IPv6 tests when IPv6 is not available (#4939)04cb773fix(types): Fix clone method type declaration to be an instance method rather...5145a7cfix(types): align Response with DOM fetch types (#4867)Updates
webpackfrom 5.104.0 to 5.106.2Release notes
Sourced from webpack's releases.
... (truncated)
Changelog
Sourced from webpack's changelog.
... (truncated)
Commits
0d7e3e0chore(release): new release (#20815)d5df118chore(deps): bump actions/cache in the dependencies group (#20839)5f0874bfix: make asset modules available in JS when referenced from CSS and lazy JS ...b63ab37chore(deps): bump test/test262-cases in the dependencies group (#20792)313dfc5ci: improve time for windows (#20840)a553f61test: update test262 (#20841)1ef747cfix: CSS@importshould inherit parent's exportType over parser config (#20838)485d4cechore(deps): updateopen-cli(#20834)46042b9chore(deps): no outdated strip-ansi (#20835)8c7700bfix: handle@charsetat-rules in CSS modulesMaintainer changes
This version was pushed to npm by GitHub Actions, a new releaser for webpack since your current version.
Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswil...Description has been truncated