Skip to content

fix(deps): update dependency lodash-es to v4.17.23 [security] - autoclosed#262

Closed
renovate[bot] wants to merge 1 commit intomainfrom
renovate/npm-lodash-es-vulnerability
Closed

fix(deps): update dependency lodash-es to v4.17.23 [security] - autoclosed#262
renovate[bot] wants to merge 1 commit intomainfrom
renovate/npm-lodash-es-vulnerability

Conversation

@renovate
Copy link
Copy Markdown
Contributor

@renovate renovate bot commented Jan 23, 2026

This PR contains the following updates:

Package Change Age Confidence
lodash-es (source) 4.17.224.17.23 age confidence

GitHub Vulnerability Alerts

CVE-2025-13465

Impact

Lodash versions 4.0.0 through 4.17.22 are vulnerable to prototype pollution in the _.unset and _.omit functions. An attacker can pass crafted paths which cause Lodash to delete methods from global prototypes.

The issue permits deletion of properties but does not allow overwriting their original behavior.

Patches

This issue is patched on 4.17.23.


Release Notes

lodash/lodash (lodash-es)

v4.17.23

Compare Source


Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Enabled.

Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.


  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

Signed-off-by: Renovate Bot <bot@renovateapp.com>
@coderabbitai
Copy link
Copy Markdown
Contributor

coderabbitai bot commented Jan 23, 2026

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.


Comment @coderabbitai help to get the list of available commands and usage tips.

@github-actions
Copy link
Copy Markdown
Contributor

github-actions bot commented Jan 23, 2026

Thank you for following the naming conventions! 🙏

@renovate renovate bot changed the title fix(deps): update dependency lodash-es to v4.17.23 [security] fix(deps): update dependency lodash-es to v4.17.23 [security] - autoclosed Feb 2, 2026
@renovate renovate bot closed this Feb 2, 2026
auto-merge was automatically disabled February 2, 2026 11:00

Pull request was closed

@renovate renovate bot deleted the renovate/npm-lodash-es-vulnerability branch February 2, 2026 11:00
@github-actions
Copy link
Copy Markdown
Contributor

github-actions bot commented Mar 4, 2026

This pull request has been automatically locked since there has not been any recent activity after it was closed. Please open a new issue for related bugs.
Please note this issue tracker is not a help forum. We recommend using our GitHub Discussions tab for questions.

@github-actions github-actions bot locked as resolved and limited conversation to collaborators Mar 4, 2026
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants