build(deps): bump the npm_and_yarn group across 22 directories with 12 updates

[dependabot]

Bumps the npm_and_yarn group with 1 update in the / directory: lodash.
Bumps the npm_and_yarn group with 6 updates in the /app directory:

Package	From	To
lodash	4.17.21	4.18.1
electron	31.2.0	39.8.5
brace-expansion	1.1.12	1.1.13
minimatch	3.1.2	3.1.5
picomatch	2.3.1	2.3.2
vite	7.3.1	7.3.2

Bumps the npm_and_yarn group with 5 updates in the /frontend directory:

Package	From	To
lodash	4.17.23	4.18.1
brace-expansion	1.1.12	1.1.13
flatted	3.3.1	3.4.2
picomatch	2.3.1	2.3.2
picomatch	4.0.2	4.0.4
vite	6.4.1	6.4.2

Bumps the npm_and_yarn group with 8 updates in the /plugins/examples/activity directory:

Package	From	To
lodash	4.17.23	4.18.1
brace-expansion	1.1.11	1.1.13
brace-expansion	2.0.1	2.0.3
minimatch	3.1.2	3.1.5
minimatch	9.0.5	9.0.9
picomatch	2.3.1	2.3.2
picomatch	4.0.2	4.0.4
rollup	4.41.0	4.60.1
vite	6.4.1	6.4.2
yaml	1.10.2	1.10.3
storybook	8.6.15	8.6.18

Bumps the npm_and_yarn group with 9 updates in the /plugins/examples/app-menus directory:

Package	From	To
lodash	4.17.23	4.18.1
brace-expansion	1.1.12	1.1.13
brace-expansion	2.0.2	2.0.3
minimatch	3.1.2	3.1.5
minimatch	9.0.5	9.0.9
picomatch	2.3.1	2.3.2
picomatch	4.0.3	4.0.4
rollup	4.50.1	4.60.1
vite	6.4.1	6.4.2
yaml	1.10.2	1.10.3
yaml	2.8.1	2.8.3
storybook	9.1.17	9.1.20
serialize-javascript	6.0.2	removed

Bumps the npm_and_yarn group with 9 updates in the /plugins/examples/change-logo directory:

Package	From	To
lodash	4.17.23	4.18.1
brace-expansion	1.1.12	1.1.13
brace-expansion	2.0.2	2.0.3
minimatch	3.1.2	3.1.5
minimatch	9.0.5	9.0.9
picomatch	2.3.1	2.3.2
picomatch	4.0.3	4.0.4
rollup	4.50.1	4.60.1
vite	6.4.1	6.4.2
yaml	1.10.2	1.10.3
yaml	2.8.1	2.8.3
storybook	9.1.17	9.1.20
serialize-javascript	6.0.2	removed

Bumps the npm_and_yarn group with 9 updates in the /plugins/examples/cluster-chooser directory:

Package	From	To
lodash	4.17.23	4.18.1
brace-expansion	1.1.12	1.1.13
brace-expansion	2.0.2	2.0.3
minimatch	3.1.2	3.1.5
minimatch	9.0.5	9.0.9
picomatch	2.3.1	2.3.2
picomatch	4.0.3	4.0.4
rollup	4.50.1	4.60.1
vite	6.4.1	6.4.2
yaml	1.10.2	1.10.3
yaml	2.8.1	2.8.3
storybook	9.1.17	9.1.20
serialize-javascript	6.0.2	removed

Bumps the npm_and_yarn group with 9 updates in the /plugins/examples/custom-theme directory:

Package	From	To
lodash	4.17.23	4.18.1
brace-expansion	1.1.12	1.1.13
brace-expansion	2.0.2	2.0.3
minimatch	3.1.2	3.1.5
minimatch	9.0.5	9.0.9
picomatch	2.3.1	2.3.2
picomatch	4.0.3	4.0.4
rollup	4.50.1	4.60.1
vite	6.4.1	6.4.2
yaml	1.10.2	1.10.3
yaml	2.8.1	2.8.3
storybook	9.1.17	9.1.20
serialize-javascript	6.0.2	removed

Bumps the npm_and_yarn group with 9 updates in the /plugins/examples/customizing-map directory:

Package	From	To
lodash	4.17.23	4.18.1
brace-expansion	1.1.12	1.1.13
brace-expansion	2.0.2	2.0.3
minimatch	3.1.2	3.1.5
minimatch	9.0.5	9.0.9
picomatch	2.3.1	2.3.2
picomatch	4.0.3	4.0.4
rollup	4.50.1	4.60.1
vite	6.4.1	6.4.2
yaml	1.10.2	1.10.3
yaml	2.8.1	2.8.3
storybook	9.1.17	9.1.20
serialize-javascript	6.0.2	removed

Bumps the npm_and_yarn group with 9 updates in the /plugins/examples/details-view directory:

Package	From	To
lodash	4.17.23	4.18.1
brace-expansion	1.1.12	1.1.13
brace-expansion	2.0.2	2.0.3
minimatch	3.1.2	3.1.5
minimatch	9.0.5	9.0.9
picomatch	2.3.1	2.3.2
picomatch	4.0.3	4.0.4
rollup	4.50.2	4.60.1
vite	6.4.1	6.4.2
yaml	1.10.2	1.10.3
yaml	2.8.1	2.8.3
storybook	9.1.17	9.1.20
serialize-javascript	6.0.2	removed

Bumps the npm_and_yarn group with 8 updates in the /plugins/examples/dynamic-clusters directory:

Package	From	To
lodash	4.17.23	4.18.1
brace-expansion	1.1.11	1.1.13
brace-expansion	2.0.1	2.0.3
brace-expansion	1.1.12	1.1.13
minimatch	3.1.2	3.1.5
minimatch	9.0.5	9.0.9
picomatch	2.3.1	2.3.2
picomatch	4.0.3	4.0.4
rollup	4.41.0	4.60.1
vite	6.4.1	6.4.2
yaml	1.10.2	1.10.3
yaml	2.8.0	2.8.3
serialize-javascript	6.0.2	removed

Bumps the npm_and_yarn group with 9 updates in the /plugins/examples/headlamp-events directory:

Package	From	To
lodash	4.17.23	4.18.1
brace-expansion	1.1.12	1.1.13
brace-expansion	2.0.2	2.0.3
minimatch	3.1.2	3.1.5
minimatch	9.0.5	9.0.9
picomatch	2.3.1	2.3.2
picomatch	4.0.3	4.0.4
rollup	4.50.1	4.60.1
vite	6.4.1	6.4.2
yaml	1.10.2	1.10.3
yaml	2.8.1	2.8.3
storybook	9.1.17	9.1.20
serialize-javascript	6.0.2	removed

Bumps the npm_and_yarn group with 8 updates in the /plugins/examples/pod-counter directory:

Package	From	To
lodash	4.17.23	4.18.1
brace-expansion	1.1.12	1.1.13
brace-expansion	2.0.2	2.0.3
minimatch	3.1.2	3.1.5
minimatch	9.0.5	9.0.9
picomatch	2.3.1	2.3.2
picomatch	4.0.3	4.0.4
rollup	4.50.1	4.60.1
vite	6.4.1	6.4.2
yaml	1.10.2	1.10.3
yaml	2.8.1	2.8.3
storybook	9.1.17	9.1.20

Bumps the npm_and_yarn group with 7 updates in the /plugins/examples/projects directory:

Package	From	To
lodash	4.17.23	4.18.1
brace-expansion	1.1.11	1.1.13
brace-expansion	2.0.2	2.0.3
picomatch	2.3.1	2.3.2
picomatch	4.0.2	4.0.4
rollup	4.41.0	4.60.1
vite	6.4.1	6.4.2
yaml	1.10.2	1.10.3
storybook	8.6.15	8.6.18

Bumps the npm_and_yarn group with 7 updates in the /plugins/examples/resource-charts directory:

Package	From	To
lodash	4.17.23	4.18.1
brace-expansion	1.1.12	1.1.13
brace-expansion	2.0.2	2.0.3
picomatch	2.3.1	2.3.2
picomatch	4.0.3	4.0.4
rollup	4.50.2	4.60.1
vite	6.4.1	6.4.2
yaml	1.10.2	1.10.3
yaml	2.8.1	2.8.3
storybook	9.1.17	9.1.20

Bumps the npm_and_yarn group with 9 updates in the /plugins/examples/sidebar directory:

Package	From	To
lodash	4.17.23	4.18.1
brace-expansion	1.1.12	1.1.13
brace-expansion	2.0.2	2.0.3
minimatch	3.1.2	3.1.5
minimatch	9.0.5	9.0.9
picomatch	2.3.1	2.3.2
picomatch	4.0.3	4.0.4
rollup	4.50.1	4.60.1
vite	6.4.1	6.4.2
yaml	1.10.2	1.10.3
yaml	2.8.1	2.8.3
storybook	9.1.17	9.1.20
serialize-javascript	6.0.2	removed

Bumps the npm_and_yarn group with 9 updates in the /plugins/examples/tables directory:

Package	From	To
lodash	4.17.23	4.18.1
brace-expansion	1.1.12	1.1.13
brace-expansion	2.0.2	2.0.3
minimatch	3.1.2	3.1.5
minimatch	9.0.5	9.0.9
picomatch	2.3.1	2.3.2
picomatch	4.0.3	4.0.4
rollup	4.50.1	4.60.1
vite	6.4.1	6.4.2
yaml	1.10.2	1.10.3
yaml	2.8.1	2.8.3
storybook	9.1.17	9.1.20
serialize-javascript	6.0.2	removed

Bumps the npm_and_yarn group with 9 updates in the /plugins/examples/ui-panels directory:

Package	From	To
lodash	4.17.23	4.18.1
brace-expansion	1.1.12	1.1.13
brace-expansion	2.0.2	2.0.3
minimatch	3.1.2	3.1.5
minimatch	9.0.5	9.0.9
picomatch	2.3.1	2.3.2
picomatch	4.0.3	4.0.4
rollup	4.50.1	4.60.1
vite	6.4.1	6.4.2
yaml	1.10.2	1.10.3
yaml	2.8.1	2.8.3
storybook	9.1.17	9.1.20
serialize-javascript	6.0.2	removed

Bumps the npm_and_yarn group with 5 updates in the /plugins/headlamp-plugin directory:

Package	From	To
lodash	4.17.23	4.18.1
brace-expansion	1.1.12	1.1.13
picomatch	2.3.1	2.3.2
picomatch	4.0.3	4.0.4
vite	6.4.1	6.4.2
yaml	1.10.2	1.10.3
yaml	2.7.0	2.8.3

Bumps the npm_and_yarn group with 2 updates in the /plugins/pluginctl directory: brace-expansion and picomatch.
Bumps the npm_and_yarn group with 4 updates in the /tools/i18n directory: brace-expansion, minimatch, picomatch and handlebars.
Bumps the npm_and_yarn group with 1 update in the /tools/releaser directory: lodash.

Updates lodash from 4.17.23 to 4.18.1

Release notes

Sourced from lodash's releases.

4.18.1

Bugs

Fixes a ReferenceError issue in lodash lodash-es lodash-amd and lodash.template when using the template and fromPairs functions from the modular builds. See lodash/lodash#6167

These defects were related to how lodash distributions are built from the main branch using https://github.com/lodash-archive/lodash-cli. When internal dependencies change inside lodash functions, equivalent updates need to be made to a mapping in the lodash-cli. (hey, it was ahead of its time once upon a time!). We know this, but we missed it in the last release. It's the kind of thing that passes in CI, but fails bc the build is not the same thing you tested.

There is no diff on main for this, but you can see the diffs for each of the npm packages on their respective branches:

• lodash: lodash/lodash@4.18.0-npm...4.18.1-npm
• lodash-es: lodash/lodash@4.18.0-es...4.18.1-es
• lodash-amd: lodash/lodash@4.18.0-amd...4.18.1-amd
• lodash.templatelodash/lodash@4.18.0-npm-packages...4.18.1-npm-packages

4.18.0

v4.18.0

Full Changelog: lodash/lodash@4.17.23...4.18.0

Security

_.unset / _.omit: Fixed prototype pollution via constructor/prototype path traversal (GHSA-f23m-r3pf-42rh, fe8d32e). Previously, array-wrapped path segments and primitive roots could bypass the existing guards, allowing deletion of properties from built-in prototypes. Now constructor and prototype are blocked unconditionally as non-terminal path keys, matching baseSet. Calls that previously returned true and deleted the property now return false and leave the target untouched.

_.template: Fixed code injection via imports keys (GHSA-r5fr-rjxr-66jc, CVE-2026-4800, 879aaa9). Fixes an incomplete patch for CVE-2021-23337. The variable option was validated against reForbiddenIdentifierChars but importsKeys was left unguarded, allowing code injection via the same Function() constructor sink. imports keys containing forbidden identifier characters now throw "Invalid imports option passed into _.template".

Docs

• Add security notice for _.template in threat model and API docs (#6099)
• Document lower > upper behavior in _.random (#6115)
• Fix quotes in _.compact jsdoc (#6090)

lodash.* modular packages

Diff

We have also regenerated and published a select number of the lodash.* modular packages.

These modular packages had fallen out of sync significantly from the minor/patch updates to lodash. Specifically, we have brought the following packages up to parity w/ the latest lodash release because they have had CVEs on them in the past:

• lodash.orderby
• lodash.tonumber
• lodash.trim
• lodash.trimend
• lodash.sortedindexby
• lodash.zipobjectdeep
• lodash.unset
• lodash.omit
• lodash.template

Commits

• cb0b9b9 release(patch): bump main to 4.18.1 (#6177)
• 75535f5 chore: prune stale advisory refs (#6170)
• 62e91bc docs: remove n_ Node.js < 6 REPL note from README (#6165)
• 59be2de release(minor): bump to 4.18.0 (#6161)
• af63457 fix: broken tests for _.template 879aaa9
• 1073a76 fix: linting issues
• 879aaa9 fix: validate imports keys in _.template
• fe8d32e fix: block prototype pollution in baseUnset via constructor/prototype traversal
• 18ba0a3 refactor(fromPairs): use baseAssignValue for consistent assignment (#6153)
• b819080 ci: add dist sync validation workflow (#6137)
• Additional commits viewable in compare view

Updates lodash from 4.17.21 to 4.18.1

Release notes

Sourced from lodash's releases.

4.18.1

Bugs

Fixes a ReferenceError issue in lodash lodash-es lodash-amd and lodash.template when using the template and fromPairs functions from the modular builds. See lodash/lodash#6167

These defects were related to how lodash distributions are built from the main branch using https://github.com/lodash-archive/lodash-cli. When internal dependencies change inside lodash functions, equivalent updates need to be made to a mapping in the lodash-cli. (hey, it was ahead of its time once upon a time!). We know this, but we missed it in the last release. It's the kind of thing that passes in CI, but fails bc the build is not the same thing you tested.

There is no diff on main for this, but you can see the diffs for each of the npm packages on their respective branches:

• lodash: lodash/lodash@4.18.0-npm...4.18.1-npm
• lodash-es: lodash/lodash@4.18.0-es...4.18.1-es
• lodash-amd: lodash/lodash@4.18.0-amd...4.18.1-amd
• lodash.templatelodash/lodash@4.18.0-npm-packages...4.18.1-npm-packages

4.18.0

v4.18.0

Full Changelog: lodash/lodash@4.17.23...4.18.0

Security

_.unset / _.omit: Fixed prototype pollution via constructor/prototype path traversal (GHSA-f23m-r3pf-42rh, fe8d32e). Previously, array-wrapped path segments and primitive roots could bypass the existing guards, allowing deletion of properties from built-in prototypes. Now constructor and prototype are blocked unconditionally as non-terminal path keys, matching baseSet. Calls that previously returned true and deleted the property now return false and leave the target untouched.

_.template: Fixed code injection via imports keys (GHSA-r5fr-rjxr-66jc, CVE-2026-4800, 879aaa9). Fixes an incomplete patch for CVE-2021-23337. The variable option was validated against reForbiddenIdentifierChars but importsKeys was left unguarded, allowing code injection via the same Function() constructor sink. imports keys containing forbidden identifier characters now throw "Invalid imports option passed into _.template".

Docs

• Add security notice for _.template in threat model and API docs (#6099)
• Document lower > upper behavior in _.random (#6115)
• Fix quotes in _.compact jsdoc (#6090)

lodash.* modular packages

Diff

We have also regenerated and published a select number of the lodash.* modular packages.

These modular packages had fallen out of sync significantly from the minor/patch updates to lodash. Specifically, we have brought the following packages up to parity w/ the latest lodash release because they have had CVEs on them in the past:

• lodash.orderby
• lodash.tonumber
• lodash.trim
• lodash.trimend
• lodash.sortedindexby
• lodash.zipobjectdeep
• lodash.unset
• lodash.omit
• lodash.template

Commits

• cb0b9b9 release(patch): bump main to 4.18.1 (#6177)
• 75535f5 chore: prune stale advisory refs (#6170)
• 62e91bc docs: remove n_ Node.js < 6 REPL note from README (#6165)
• 59be2de release(minor): bump to 4.18.0 (#6161)
• af63457 fix: broken tests for _.template 879aaa9
• 1073a76 fix: linting issues
• 879aaa9 fix: validate imports keys in _.template
• fe8d32e fix: block prototype pollution in baseUnset via constructor/prototype traversal
• 18ba0a3 refactor(fromPairs): use baseAssignValue for consistent assignment (#6153)
• b819080 ci: add dist sync validation workflow (#6137)
• Additional commits viewable in compare view

Updates electron from 31.2.0 to 39.8.5

Release notes

Sourced from electron's releases.

electron v39.8.5

Release Notes for v39.8.5

Fixes

• Fixed a crash in clipboard.readImage() when the clipboard contains malformed image data. #50493 (Also in 40, 41, 42)
• Fixed a crash when calling an offscreen shared texture's release() after the texture object was garbage collected. #50499 (Also in 40, 41, 42)

electron v39.8.4

Release Notes for v39.8.4

Fixes

• Fixed an issue where nodeIntegrationInWorker overrides in setWindowOpenHandler were not honored for child windows sharing a renderer process with their opener. #50468 (Also in 38, 40, 41)
• Fixed crash when handling JavaScript dialogs from windows opened with invalid or empty URLs. #50400 (Also in 40, 41, 42)
• Fixed improper focus tracking in BaseWindow on MacOS. #50338 (Also in 40, 41, 42)
• Fixed window freeze when failing to enter/exit fullscreen on macOS. #50341 (Also in 40, 41, 42)

Other Changes

• Added support for using a proxy during yarn install. #50349 (Also in 40, 41, 42)
• Backported fix for 485935305. #50440
• Backported fix for 489381399. #50443
• Backported fix for chromium:475877320. #50436
• Backported fixes for 484751092, 487117772. #50461

electron v39.8.3

Release Notes for v39.8.3

Fixes

• Added additional ASAR support to additional fs copy methods. #50284 (Also in 40, 41, 42)
• Fixed user resizing of transparent windows on win32 platform. #50300 (Also in 40, 41, 42)

electron v39.8.2

Release Notes for v39.8.2

Other Changes

• Backported fix for b/491421267. #50230

electron v39.8.1

Release Notes for v39.8.1

Fixes

• Added validation to protocol client methods to reject protocol names that do not conform to the RFC 3986 URI scheme grammar. #50156 (Also in 38, 40, 41)
• Fixed an issue on macOS where calling autoUpdater.quitAndInstall() could fail if checkForUpdates() was called again after an update was already downloaded. #50215 (Also in 40, 41)
• Fixed an issue where Chrome Devtools menus may not appear in certain embedded windows. #50136 (Also in 40, 41)
• Fixed an issue where additionalData passed to app.requestSingleInstanceLock on Windows could be truncated or fail to deserialize in the primary instance's second-instance event. #50174 (Also in 38, 40, 41)
• Fixed an issue where screen.getCursorScreenPoint() crashed on Wayland when it was called before a BrowserWindow had been created. #50106 (Also in 40, 41)

... (truncated)

Commits

• 9d2f8cb refactor: remove dead named-window lookup from guest-window-manager (#50498)
• 1173004 fix: crash calling OSR shared texture release() after texture GC'd (#50499)
• be37ade fix: crash in clipboard.readImage() on malformed image data (#50493)
• 7007907 chore: cherry-pick 3 changes from chromium (#50461)
• 2c8b6ee chore: cherry-pick fbfb27470bf6 from chromium (#50436)
• 4c64377 chore: cherry-pick 50b057660b4d from chromium (#50440)
• 0ef0561 fix: read nodeIntegrationInWorker from per-frame WebPreferences (#50122) (#50...
• 64373df chore: cherry-pick 074d472db745 from chromium (#50443)
• 13e4407 fix: don't re-parse URL unnecessarily when handling dialogs (#50400)
• 16a0385 ci: output build cache hit rate as GHA annotation (#50369)
• Additional commits viewable in compare view

Updates brace-expansion from 1.1.12 to 1.1.13

Commits

• 6c353ca 1.1.13
• 7fd684f Backport fix for GHSA-f886-m6hf-6m8v (#95)
• See full diff in compare view

Updates minimatch from 3.1.2 to 3.1.5

Commits

• 7bba978 3.1.5
• bd25942 docs: add warning about ReDoS
• 1a9c27c fix partial matching of globstar patterns
• 1a2e084 3.1.4
• ae24656 update lockfile
• b100374 limit recursion for **, improve perf considerably
• 26ffeaa lockfile update
• 9eca892 lock node version to 14
• 00c323b 3.1.3
• 30486b2 update CI matrix and actions
• Additional commits viewable in compare view

Updates picomatch from 2.3.1 to 2.3.2

Release notes

Sourced from picomatch's releases.

2.3.2

This is a security release fixing several security relevant issues.

What's Changed

• fix: exception when glob pattern contains constructor by @​Jason3S in micromatch/picomatch#144
• Fix for CVE-2026-33671
• Fix for CVE-2026-33672

Full Changelog: micromatch/picomatch@2.3.1...2.3.2

Changelog

Sourced from picomatch's changelog.

Release history

All notable changes to this project will be documented in this file.

The format is based on Keep a Changelog and this project adheres to Semantic Versioning.

• Changelogs are for humans, not machines.
• There should be an entry for every single version.
• The same types of changes should be grouped.
• Versions and sections should be linkable.
• The latest version comes first.
• The release date of each versions is displayed.
• Mention whether you follow Semantic Versioning.

Changelog entries are classified using the following labels (from keep-a-changelog):

• Added for new features.
• Changed for changes in existing functionality.
• Deprecated for soon-to-be removed features.
• Removed for now removed features.
• Fixed for any bug fixes.
• Security in case of vulnerabilities.

4.0.0 (2024-02-07)

Fixes

• Fix bad text values in parse #126, thanks to @​connor4312

Changed

• Remove process global to work outside of node #129, thanks to @​styfle
• Add sideEffects to package.json #128, thanks to @​frandiox
• Removed os, make compatible browser environment. See #124, thanks to @​gwsbhqt

3.0.1

Fixes

... (truncated)

Commits

• 81cba8d Publish 2.3.2
• fc1f6b6 Merge commit from fork
• eec17ae Merge commit from fork
• 78f8ca4 Merge pull request #156 from micromatch/backport-144
• 3f4f10e Merge pull request #144 from Jason3S/jdent-object-properties
• See full diff in compare view

Updates vite from 7.3.1 to 7.3.2

Release notes

Sourced from vite's releases.

v7.3.2

Please refer to CHANGELOG.md for details.

Changelog

Sourced from vite's changelog.

7.3.2 (2026-04-06)

Bug Fixes

• avoid path traversal with optimize deps sourcemap handler (#22161) (09d8c90)
• backport #22159, apply server.fs check to env transport (#22162) (19db0f2)
• check server.fs after stripping query as well (#22160) (f8103cc)

Commits

• cc383e0 release: v7.3.2
• 09d8c90 fix: avoid path traversal with optimize deps sourcemap handler (#22161)
• f8103cc fix: check server.fs after stripping query as well (#22160)
• 19db0f2 fix: backport #22159, apply server.fs check to env transport (#22162)
• See full diff in compare view

Updates lodash from 4.17.23 to 4.18.1

Release notes

Sourced from lodash's releases.

4.18.1

Bugs

Fixes a ReferenceError issue in lodash lodash-es lodash-amd and lodash.template when using the template and fromPairs functions from the modular builds. See lodash/lodash#6167

These defects were related to how lodash distributions are built from the main branch using https://github.com/lodash-archive/lodash-cli. When internal dependencies change inside lodash functions, equivalent updates need to be made to a mapping in the lodash-cli. (hey, it was ahead of its time once upon a time!). We know this, but we missed it in the last release. It's the kind of thing that passes in CI, but fails bc the build is not the same thing you tested.

There is no diff on main for this, but you can see the diffs for each of the npm packages on their respective branches:

• lodash: lodash/lodash@4.18.0-npm...4.18.1-npm
• lodash-es: lodash/lodash@4.18.0-es...4.18.1-es
• lodash-amd: lodash/lodash@4.18.0-amd...4.18.1-amd
• lodash.templatelodash/lodash@4.18.0-npm-packages...4.18.1-npm-packages

4.18.0

v4.18.0

Full Changelog: lodash/lodash@4.17.23...4.18.0

Security

_.unset / _.omit: Fixed prototype pollution via constructor/prototype path traversal (GHSA-f23m-r3pf-42rh, fe8d32e). Previously, array-wrapped path segments and primitive roots could bypass the existing guards, allowing deletion of properties from built-in prototypes. Now constructor and prototype are blocked unconditionally as non-terminal path keys, matching baseSet. Calls that previously returned true and deleted the property now return false and leave the target untouched.

_.template: Fixed code injection via imports keys (GHSA-r5fr-rjxr-66jc, CVE-2026-4800, 879aaa9). Fixes an incomplete patch for CVE-2021-23337. The variable option was validated against reForbiddenIdentifierChars but importsKeys was left unguarded, allowing code injection via the same Function() constructor sink. imports keys containing forbidden identifier characters now throw "Invalid imports option passed into _.template".

Docs

• Add security notice for _.template in threat model and API docs (#6099)
• Document lower > upper behavior in _.random (#6115)
• Fix quotes in _.compact jsdoc (#6090)

lodash.* modular packages

Diff

We have also regenerated and published a select number of the lodash.* modular packages.

These modular packages had fallen out of sync significantly from the minor/patch updates to lodash. Specifically, we have brought the following packages up to parity w/ the latest lodash release because they have had CVEs on them in the past:

• lodash.orderby
• lodash.tonumber
• lodash.trim
• lodash.trimend
• lodash.sortedindexby
• lodash.zipobjectdeep
• lodash.unset
• lodash.omit
• lodash.template

Commits

• cb0b9b9 release(patch): bump main to 4.18.1 (#6177)
• 75535f5 chore: prune stale advisory refs (#6170)
• 62e91bc docs: remove n_ Node.js < 6 REPL note from README (#6165)
• 59be2de release(minor): bump to 4.18.0 (#6161)
• af63457 fix: broken tests for _.template 879aaa9
• 1073a76 fix: linting issues
• 879aaa9 fix: validate imports keys in _.template
• fe8d32e fix: block prototype pollution in baseUnset via constructor/prototype traversal
• 18ba0a3 refactor(fromPairs): use baseAssignValue for consistent assignment (#6153)
• b819080 ci: add dist sync validation workflow (#6137)
• Additional commits viewable in compare view

Updates brace-expansion from 1.1.12 to 1.1.13

Commits

• 6c353ca 1.1.13
• 7fd684f Backport fix for GHSA-f886-m6hf-6m8v (#95)
• See full diff in compare view

Updates flatted from 3.3.1 to 3.4.2

Commits

• 3bf0909 3.4.2
• 885ddcc fix CWE-1321
• 0bdba70 added flatted-view to the benchmark
• 2a02dce 3.4.1
• fba4e8f Merge pull request #89 from WebReflection/python-fix
• 5fe8648 added "when in Rome" also a test for PHP