From f23b838c7c83e65db20ed835f5c4e14dfd27cb11 Mon Sep 17 00:00:00 2001 From: anupamme Date: Mon, 10 Aug 2026 15:22:55 +0000 Subject: [PATCH 1/2] fix: CVE-2026-4800 security vulnerability Automated dependency upgrade by OrbisAI Security --- package-lock.json | 7 ++++--- package.json | 5 ++++- 2 files changed, 8 insertions(+), 4 deletions(-) diff --git a/package-lock.json b/package-lock.json index aabb4b5e4..8a05b3f55 100644 --- a/package-lock.json +++ b/package-lock.json @@ -4229,9 +4229,10 @@ } }, "node_modules/lodash": { - "version": "4.17.21", - "resolved": "https://registry.npmmirror.com/lodash/-/lodash-4.17.21.tgz", - "integrity": "sha512-v2kDEe57lecTulaDIuNTPy3Ry4gLGJ6Z1O3vE1krgXZNrsQ+LFTGHVxVjcXPs17LhbZVGedAJv8XZ1tvj5FvSg==", + "version": "4.18.0", + "resolved": "https://registry.npmjs.org/lodash/-/lodash-4.18.0.tgz", + "integrity": "sha512-l1mfj2atMqndAHI3ls7XqPxEjV2J9ZkcNyHpoZA3r2T1LLwDB69jgkMWh71YKwhBbK0G2f4WSn05ahmQXVxupA==", + "deprecated": "Bad release. Please use lodash@4.17.21 instead.", "license": "MIT" }, "node_modules/lodash-es": { diff --git a/package.json b/package.json index 87c9c40b6..121448c6b 100644 --- a/package.json +++ b/package.json @@ -1,7 +1,7 @@ { "name": "easy-vibe", "version": "1.0.0", - "description": "Easy-Vibe 中文实战课 - 零基础学会用 AI 编程", + "description": "Easy-Vibe \u4e2d\u6587\u5b9e\u6218\u8bfe - \u96f6\u57fa\u7840\u5b66\u4f1a\u7528 AI \u7f16\u7a0b", "type": "module", "scripts": { "dev": "vitepress dev docs", @@ -62,5 +62,8 @@ "viewerjs": "^1.11.7", "vitepress": "^2.0.0-alpha.16", "vue": "^3.5.0" + }, + "overrides": { + "lodash": "4.18.0" } } From 7f685df11d3928816e47a45415fbb3a763c80a5e Mon Sep 17 00:00:00 2001 From: Anupam Mediratta Date: Tue, 1 Sep 2026 07:40:28 +0530 Subject: [PATCH 2/2] fix: use lodash 4.18.1 instead of deprecated 4.18.0 (CVE-2026-4800) npm marked 4.18.0 a bad release recommending a rollback to the vulnerable 4.17.21. 4.18.1 keeps the CVE-2026-4800 fix without the deprecation warning. Also restores the package.json description field that was unintentionally rewritten as Unicode escapes. Co-Authored-By: Claude Sonnet 5 --- package-lock.json | 7 +++---- package.json | 4 ++-- 2 files changed, 5 insertions(+), 6 deletions(-) diff --git a/package-lock.json b/package-lock.json index 8a05b3f55..8ef5825d7 100644 --- a/package-lock.json +++ b/package-lock.json @@ -4229,10 +4229,9 @@ } }, "node_modules/lodash": { - "version": "4.18.0", - "resolved": "https://registry.npmjs.org/lodash/-/lodash-4.18.0.tgz", - "integrity": "sha512-l1mfj2atMqndAHI3ls7XqPxEjV2J9ZkcNyHpoZA3r2T1LLwDB69jgkMWh71YKwhBbK0G2f4WSn05ahmQXVxupA==", - "deprecated": "Bad release. Please use lodash@4.17.21 instead.", + "version": "4.18.1", + "resolved": "https://registry.npmjs.org/lodash/-/lodash-4.18.1.tgz", + "integrity": "sha512-dMInicTPVE8d1e5otfwmmjlxkZoUpiVLwyeTdUsi/Caj/gfzzblBcCE5sRHV/AsjuCmxWrte2TNGSYuCeCq+0Q==", "license": "MIT" }, "node_modules/lodash-es": { diff --git a/package.json b/package.json index 121448c6b..ec8d4d4a6 100644 --- a/package.json +++ b/package.json @@ -1,7 +1,7 @@ { "name": "easy-vibe", "version": "1.0.0", - "description": "Easy-Vibe \u4e2d\u6587\u5b9e\u6218\u8bfe - \u96f6\u57fa\u7840\u5b66\u4f1a\u7528 AI \u7f16\u7a0b", + "description": "Easy-Vibe 中文实战课 - 零基础学会用 AI 编程", "type": "module", "scripts": { "dev": "vitepress dev docs", @@ -64,6 +64,6 @@ "vue": "^3.5.0" }, "overrides": { - "lodash": "4.18.0" + "lodash": "4.18.1" } }