fix(deps): update all non-major dependencies

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
caniuse-lite	^1.0.30001782 → ^1.0.30001786
lodash (source)	^4.17.23 → ^4.18.1
sass	^1.98.0 → ^1.99.0

---

Release Notes

browserslist/caniuse-lite (caniuse-lite)

v1.0.30001786

Compare Source

v1.0.30001785

Compare Source

v1.0.30001784

Compare Source

lodash/lodash (lodash)

v4.18.1

Compare Source

Bugs

Fixes a ReferenceError issue in lodash lodash-es lodash-amd and lodash.template when using the template and fromPairs functions from the modular builds. See #​6167 (comment)

These defects were related to how lodash distributions are built from the main branch using https://github.com/lodash-archive/lodash-cli. When internal dependencies change inside lodash functions, equivalent updates need to be made to a mapping in the lodash-cli. (hey, it was ahead of its time once upon a time!). We know this, but we missed it in the last release. It's the kind of thing that passes in CI, but fails bc the build is not the same thing you tested.

There is no diff on main for this, but you can see the diffs for each of the npm packages on their respective branches:

lodash: lodash/lodash@4.18.0-npm...4.18.1-npm
lodash-es: lodash/lodash@4.18.0-es...4.18.1-es
lodash-amd: lodash/lodash@4.18.0-amd...4.18.1-amd
lodash.templatelodash/lodash@4.18.0-npm-packages...4.18.1-npm-packages

v4.18.0

Compare Source

v4.18.0

Full Changelog: lodash/lodash@4.17.23...4.18.0

Security

_.unset / _.omit: Fixed prototype pollution via constructor/prototype path traversal (GHSA-f23m-r3pf-42rh, fe8d32e). Previously, array-wrapped path segments and primitive roots could bypass the existing guards, allowing deletion of properties from built-in prototypes. Now constructor and prototype are blocked unconditionally as non-terminal path keys, matching baseSet. Calls that previously returned true and deleted the property now return false and leave the target untouched.

_.template: Fixed code injection via imports keys (GHSA-r5fr-rjxr-66jc, CVE-2026-4800, 879aaa9). Fixes an incomplete patch for CVE-2021-23337. The variable option was validated against reForbiddenIdentifierChars but importsKeys was left unguarded, allowing code injection via the same Function() constructor sink. imports keys containing forbidden identifier characters now throw "Invalid imports option passed into _.template".

Docs

• Add security notice for _.template in threat model and API docs (#​6099)
• Document lower > upper behavior in _.random (#​6115)
• Fix quotes in _.compact jsdoc (#​6090)

lodash.* modular packages

Diff

We have also regenerated and published a select number of the lodash.* modular packages.

These modular packages had fallen out of sync significantly from the minor/patch updates to lodash. Specifically, we have brought the following packages up to parity w/ the latest lodash release because they have had CVEs on them in the past:

• lodash.orderby
• lodash.tonumber
• lodash.trim
• lodash.trimend
• lodash.sortedindexby
• lodash.zipobjectdeep
• lodash.unset
• lodash.omit
• lodash.template

sass/dart-sass (sass)

v1.99.0

Compare Source

• Add support for parent selectors (&) at the root of the document. These are
  emitted as-is in the CSS output, where they're interpreted as the scoping
  root.

• User-defined functions named calc or clamp are no longer forbidden. If
  such a function exists without a namespace in the current module, it will be
  used instead of the built-in calc() or clamp() function.

• User-defined functions whose names begin with - and end with -expression,
  -url, -and, -or, or -not are no longer forbidden. These were
  originally intended to match vendor prefixes, but in practice no vendor
  prefixes for these functions ever existed in real browsers.

• User-defined functions named EXPRESSION, URL, and ELEMENT, those that
  begin with - and end with -ELEMENT, as well as the same names with some
  lowercase letters are now deprecated, These are names conflict with plain CSS
  functions that have special syntax.

  See the Sass website for details.

• In a future release, calls to functions whose names begin with - and end
  with -expression and -url will no longer have special parsing. For now,
  these calls are deprecated if their behavior will change in the future.

  See the Sass website for details.

• Calls to functions whose names begin with - and end with -progid:... are
  deprecated.

  See the Sass website for details.

---

Configuration

📅 Schedule: Branch creation - Between 12:00 AM and 03:59 AM, only on Monday ( * 0-3 * * 1 ) (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.