refactor: Bump lodash-es from 4.17.23 to 4.18.1#3314
Merged
Conversation
Bumps [lodash-es](https://github.com/lodash/lodash) from 4.17.23 to 4.18.1. - [Release notes](https://github.com/lodash/lodash/releases) - [Commits](lodash/lodash@4.17.23...4.18.1) --- updated-dependencies: - dependency-name: lodash-es dependency-version: 4.18.1 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependencies
|
I will reformat the title to use the proper commit message syntax. |
parse-github-assistant
Bot
changed the title
Member
|
@coderabbitai review |
✅ Actions performedReview triggered.
|
📝 WalkthroughWalkthroughUpdated the Changes
Estimated code review effort🎯 1 (Trivial) | ⏱️ ~2 minutes 🚥 Pre-merge checks | ✅ 3 | ❌ 2❌ Failed checks (2 warnings)
✅ Passed checks (3 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In `@package-lock.json`:
- Around line 20967-20969: The lockfile contains an entry for lodash-es version
4.18.1 that is not declared in package.json; update them to match by either
adding "lodash-es": "4.18.1" (or an appropriate semver range) to package.json
dependencies/devDependencies (so tools and npm install will persist the lock
entry), or remove the lodash-es section from package-lock.json and then run npm
install (or npm ci) to regenerate the lockfile; locate references to "lodash-es"
in package-lock.json and package.json to make the corresponding change and
ensure package.json and package-lock.json stay in sync.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
Comment on lines
+20967
to
+20969
| "version": "4.18.1", | ||
| "resolved": "https://registry.npmjs.org/lodash-es/-/lodash-es-4.18.1.tgz", | ||
| "integrity": "sha512-J8xewKD/Gk22OZbhpOVSwcs60zhd95ESDwezOFuA3/099925PdHJ7OFHNTGtajL3AlZkykD32HykiMo+BIBI8A==", |
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
python - <<'PY'
import json
from pathlib import Path
pkg = json.loads(Path("package.json").read_text())
lock = json.loads(Path("package-lock.json").read_text())
dep = None
dep_scope = None
for scope in ("dependencies", "devDependencies", "optionalDependencies"):
v = (pkg.get(scope) or {}).get("lodash-es")
if v is not None:
dep, dep_scope = v, scope
break
lock_pkg = ((lock.get("packages") or {}).get("node_modules/lodash-es") or {})
lock_ver = lock_pkg.get("version")
resolved = lock_pkg.get("resolved")
integrity = lock_pkg.get("integrity")
print(f"package.json scope: {dep_scope}")
print(f"package.json lodash-es: {dep}")
print(f"package-lock lodash-es version: {lock_ver}")
print(f"package-lock resolved: {resolved}")
print(f"package-lock integrity present: {bool(integrity)}")
# quick duplicate check in lockfile dependency tree
def walk(obj, path="root"):
if isinstance(obj, dict):
for k,v in obj.items():
if k == "lodash-es" and isinstance(v, dict) and "version" in v:
print(f"found tree entry at {path}.lodash-es -> {v['version']}")
walk(v, f"{path}.{k}")
elif isinstance(obj, list):
for i,v in enumerate(obj):
walk(v, f"{path}[{i}]")
walk(lock.get("dependencies", {}), "dependencies")
PYRepository: parse-community/parse-dashboard
Length of output: 287
Manifest ↔ lockfile mismatch: lodash-es 4.18.1 declared in lock file but not in package.json.
The lockfile entry for lodash-es 4.18.1 at lines 20967-20969 exists in package-lock.json but lodash-es is not declared in package.json's dependencies, devDependencies, or optionalDependencies. Either:
- Add lodash-es to the appropriate section of package.json with the correct version/range, or
- Remove the lodash-es entry from package-lock.json if it is no longer needed
The package-lock.json and package.json must stay in sync.
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.
In `@package-lock.json` around lines 20967 - 20969, The lockfile contains an entry
for lodash-es version 4.18.1 that is not declared in package.json; update them
to match by either adding "lodash-es": "4.18.1" (or an appropriate semver range)
to package.json dependencies/devDependencies (so tools and npm install will
persist the lock entry), or remove the lodash-es section from package-lock.json
and then run npm install (or npm ci) to regenerate the lockfile; locate
references to "lodash-es" in package-lock.json and package.json to make the
corresponding change and ensure package.json and package-lock.json stay in sync.
Contributor
|
🎉 This change has been released in version 9.1.0-alpha.12 |
Contributor
|
🎉 This change has been released in version 9.1.0 |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Bumps lodash-es from 4.17.23 to 4.18.1.
Release notes
Sourced from lodash-es's releases.
Commits
cb0b9b9release(patch): bump main to 4.18.1 (#6177)75535f5chore: prune stale advisory refs (#6170)62e91bcdocs: remove n_ Node.js < 6 REPL note from README (#6165)59be2derelease(minor): bump to 4.18.0 (#6161)af63457fix: broken tests for _.template 879aaa91073a76fix: linting issues879aaa9fix: validate imports keys in _.templatefe8d32efix: block prototype pollution in baseUnset via constructor/prototype traversal18ba0a3refactor(fromPairs): use baseAssignValue for consistent assignment (#6153)b819080ci: add dist sync validation workflow (#6137)Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)You can disable automated security fix PRs for this repo from the Security Alerts page.
Summary by CodeRabbit
lodash-esdependency to version 4.18.1