Skip to content

fix(deps): vuln major upgrades — 5 packages (major: 3 · unstable: 1 · minor: 1) #28

Closed
gh-worker-campaigns-3e9aa4[bot] wants to merge 1 commit intomainfrom
engraver-auto-version-upgrade/major/npm/3-1776936166
Closed

fix(deps): vuln major upgrades — 5 packages (major: 3 · unstable: 1 · minor: 1) #28
gh-worker-campaigns-3e9aa4[bot] wants to merge 1 commit intomainfrom
engraver-auto-version-upgrade/major/npm/3-1776936166

Conversation

@gh-worker-campaigns-3e9aa4
Copy link
Copy Markdown

@gh-worker-campaigns-3e9aa4 gh-worker-campaigns-3e9aa4 Bot commented Apr 23, 2026

Summary: High-severity security update — 5 packages upgraded (MAJOR changes included)

Manifests changed:

  • . (pnpm)

✅ Action Required: Please review the changes below. If they look good, approve and merge this PR.

Updates

Package From To Type Dep Type Vulnerabilities Fixed
lodash 4.17.21 4.18.1 minor Direct 1 HIGH, 3 MODERATE
@storybook/icons 1.6.0 2.0.1 major Direct -
@storybook/test-runner 0.22.1 0.24.3 unstable Direct -
@types/node 18.19.130 25.6.0 major Direct -
chalk 4.1.2 5.6.2 major Direct -

Packages marked with "-" are updated due to dependency constraints.

Warning

Major Version Upgrade

This update includes major version changes that may contain breaking changes. Please:

  • Review the changelog/release notes for breaking changes
  • Test thoroughly in a staging environment
  • Update any code that depends on changed APIs
  • Ensure all tests pass before merging

Security Details

🚨 Critical & High Severity (1 fixed)
Package CVE Severity Summary Unsafe Version Fixed In
lodash GHSA-r5fr-rjxr-66jc HIGH lodash vulnerable to Code Injection via _.template imports key names 4.17.21 4.18.0
ℹ️ Other Vulnerabilities (3)
Package CVE Severity Summary Unsafe Version Fixed In
lodash GHSA-xxjr-mmjv-4gpg MODERATE Lodash has Prototype Pollution Vulnerability in _.unset and _.omit functions 4.17.21 4.17.23
lodash CVE-2025-13465 MODERATE - 4.17.21 -
lodash GHSA-f23m-r3pf-42rh MODERATE lodash vulnerable to Prototype Pollution via array path bypass in _.unset and _.omit 4.17.21 4.18.0

Review Checklist

Extra review is recommended for this update:

  • Review changes for compatibility with your code
  • Check release notes for breaking changes
  • Run integration tests to verify service behavior
  • Test in staging environment before production
  • Monitor key metrics after deployment
  • Approve and merge this PR

Update Mode: Vulnerability Remediation (High)

🤖 Generated by DataDog Automated Dependency Management System

@campaigner-prod
Copy link
Copy Markdown

campaigner-prod Bot commented Apr 23, 2026

Release Notes

lodash (4.17.21 → 4.18.1) — GitHub Release

4.18.1

Bugs

Fixes a ReferenceError issue in lodash lodash-es lodash-amd and lodash.template when using the template and fromPairs functions from the modular builds. See lodash/lodash#6167 (comment)

These defects were related to how lodash distributions are built from the main branch using https://github.com/lodash-archive/lodash-cli. When internal dependencies change inside lodash functions, equivalent updates need to be made to a mapping in the lodash-cli. (hey, it was ahead of its time once upon a time!). We know this, but we missed it in the last release. It's the kind of thing that passes in CI, but fails bc the build is not the same thing you tested.

There is no diff on main for this, but you can see the diffs for each of the npm packages on their respective branches:

4.18.0

v4.18.0

Full Changelog: lodash/lodash@4.17.23...4.18.0

Security

_.unset / _.omit: Fixed prototype pollution via constructor/prototype path traversal (GHSA-f23m-r3pf-42rh, fe8d32e). Previously, array-wrapped path segments and primitive roots could bypass the existing guards, allowing deletion of properties from built-in prototypes. Now constructor and prototype are blocked unconditionally as non-terminal path keys, matching baseSet. Calls that previously returned true and deleted the property now return false and leave the target untouched.

_.template: Fixed code injection via imports keys (GHSA-r5fr-rjxr-66jc, CVE-2026-4800, 879aaa9). Fixes an incomplete patch for CVE-2021-23337. The variable option was validated against reForbiddenIdentifierChars but importsKeys was left unguarded, allowing code injection via the same Function() constructor sink. imports keys containing forbidden identifier characters now throw "Invalid imports option passed into _.template".

Docs

lodash.* modular packages

Diff

We have also regenerated and published a select number of the lodash.* modular packages.

These modular packages had fallen out of sync significantly from the minor/patch updates to lodas

(truncated)

@storybook/icons (1.6.0 → 2.0.1) — GitHub Release

v2.0.1

Patch Changes

  • d1468a0: fix release script
@storybook/test-runner (0.22.1 → 0.24.3) — GitHub Release

v0.24.3

🐛 Bug Fix

Authors: 1

v0.24.3-next.0

🐛 Bug Fix

Authors: 1

v0.24.2

🐛 Bug Fix

Authors: 1

v0.24.2-next.0

🐛 Bug Fix

Authors: 1

v0.24.1

🐛 Bug Fix

Authors: 3

v0.24.1-next.0

🐛 Bug Fix

Authors: 3

v0.24.0

🚀 Enhancement

🐛 Bug Fix

Authors: 3

v0.24.0-next.4

🐛 Bug Fix

Authors: 1

v0.24.0-next.3

🚀 Enhancement

🐛 Bug Fix

Authors: 2

v0.24.0-next.2

🐛 Bug Fix

Authors: 1

v0.24.0-next.1

🐛 Bug Fix

Authors: 1

v0.24.0-next.0

🚀 Enhancement

🐛 Bug Fix

⚠️ Pushed to next

Authors: 10

(and 6 more releases — view all)

chalk (4.1.2 → 5.6.2) — GitHub Release

v5.6.2

v5.6.0

  • Make WezTerm terminal use true color a8f5bf7

chalk/chalk@v5.5.0...v5.6.0

v5.5.0

chalk/chalk@v5.4.1...v5.5.0

v5.4.1

chalk/chalk@v5.4.0...v5.4.1

v5.4.0

  • Update CIRCLECI environments to return level 3 color support f838120

chalk/chalk@v5.3.0...v5.4.0

v5.3.0

chalk/chalk@v5.2.0...v5.3.0

v5.2.0

chalk/chalk@v5.1.2...v5.2.0

v5.1.2

chalk/chalk@v5.1.1...v5.1.2

v5.1.1

chalk/chalk@v5.1.0...v5.1.1

v5.1.0

chalk/chalk@v5.0.1...v5.1.0

v5.0.1

  • Add main field to package.json for backwards compatibility with some developer tools 85f7e96

chalk/chalk@v5.0.0...v5.0.1

v5.0.0

Breaking

-import chalk from 'chalk';
+import chalkTemplate from 'chalk-template';

-chalk`2 + 3 = {bold ${2 + 3}}`;
+chalkTemplate`2 + 3 = {bold ${2 + 3}}`;

Improvements

chalk/chalk@v4.1.0...v5.0.0

Generated by ADMS Sources: 4 GitHub Releases, 1 not available.

@seberm-6
Copy link
Copy Markdown

seberm-6 commented Apr 23, 2026

Hey, sorry for the noise. This was caused by a bug in our automated dependency update system that incorrectly included upstream changelog content in PR comments, triggering notifications to external contributors. The feature flag has been turned off and we're working on a fix. Sorry about that again.

@campaigner-prod campaigner-prod Bot closed this Apr 23, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

adms-dependency-update adms-high-severity adms-major-update adms-medium-severity adms-mode-all-updates adms-npm campaigner-automated-change

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@seberm-6