Skip to content

SWI-3723 [Snyk] Security upgrade lodash from 4.17.21 to 4.18.1#3

Merged
jgutierrezglez merged 1 commit into
mainfrom
snyk-fix-8acf1f81a85a7a9a4ac86b077f5849b5
Apr 13, 2026
Merged

SWI-3723 [Snyk] Security upgrade lodash from 4.17.21 to 4.18.1#3
jgutierrezglez merged 1 commit into
mainfrom
snyk-fix-8acf1f81a85a7a9a4ac86b077f5849b5

Conversation

@bwappsec

@bwappsec bwappsec commented Apr 8, 2026

Copy link
Copy Markdown

snyk-top-banner

Snyk has created this PR to fix 2 vulnerabilities in the yarn dependencies of this project.

Snyk changed the following file(s):

  • package.json
  • yarn.lock

Note for zero-installs users

If you are using the Yarn feature zero-installs that was introduced in Yarn V2, note that this PR does not update the .yarn/cache/ directory meaning this code cannot be pulled and immediately developed on as one would expect for a zero-install project - you will need to run yarn to update the contents of the ./yarn/cache directory.
If you are not using zero-install you can ignore this as your flow should likely be unchanged.

Vulnerabilities that will be fixed with an upgrade:

Issue Score
high severity Arbitrary Code Injection
SNYK-JS-LODASH-15869625
  240  
medium severity Prototype Pollution
SNYK-JS-LODASH-15869619
  115  

Breaking Change Risk

Merge Risk: Medium

Notice: This assessment is enhanced by AI.


Important

  • Check the changes in this PR to ensure they won't cause issues with your project.
  • Max score is 1000. Note that the real score may have changed since the PR was raised.
  • This PR was automatically created by Snyk using the credentials of a real user.

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report
📜 Customise PR templates
🛠 Adjust project settings
📚 Read about Snyk's upgrade logic


Learn how to fix vulnerabilities with free interactive lessons:

🦉 Prototype Pollution
🦉 Arbitrary Code Injection

@bwappsec

bwappsec commented Apr 8, 2026

Copy link
Copy Markdown
Author

Merge Risk: Medium

This minor upgrade of lodash introduces security fixes that alter the behavior of several functions, which could impact existing code.

Key Changes:

  • _.unset / _.omit: A fix for a prototype pollution vulnerability (GHSA-f23m-r3pf-42rh) changes the return value. Calls that attempt to traverse constructor or prototype will now return false and not delete the property, whereas they might have returned true previously.
  • _.template: A fix for a code injection vulnerability (GHSA-r5fr-rjxr-66jc) adds stricter validation. An error will now be thrown if the imports option contains invalid characters.

Risk Assessment:
These changes, while important for security, are behavioral modifications. Applications that rely on the previous (and unsafe) behavior of these functions may require verification to ensure they operate as expected.

Recommendation: Review and test any usage of _.unset, _.omit, and _.template to ensure compatibility with the new, more secure behavior.

Source: GitHub Releases

Notice 🤖: This content was augmented using artificial intelligence. AI-generated content may contain errors and should be reviewed for accuracy before use.

@bwappsec

bwappsec commented Apr 8, 2026

Copy link
Copy Markdown
Author

Snyk checks have passed. No issues have been found so far.

Status Scan Engine Critical High Medium Low Total (0)
Open Source Security 0 0 0 0 0 issues
Licenses 0 0 0 0 0 issues
Code Security 0 0 0 0 0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

@bwappsec bwappsec changed the title [Snyk] Security upgrade lodash from 4.17.21 to 4.18.1 SWI-3723 [Snyk] Security upgrade lodash from 4.17.21 to 4.18.1 Apr 8, 2026
@jgutierrezglez jgutierrezglez merged commit 693279f into main Apr 13, 2026
4 checks passed
@jgutierrezglez jgutierrezglez deleted the snyk-fix-8acf1f81a85a7a9a4ac86b077f5849b5 branch April 13, 2026 10:44
jgutierrezglez added a commit that referenced this pull request Apr 13, 2026
Brings in all upstream changes from tj-actions/changed-files up to
commit 2bb1357 (jest bump tj-actions#2822).

Conflict resolution:
- README.md: took upstream version
- yarn.lock: took upstream version, then ran yarn install to honour
  Bandwidth's lodash ^4.18.1 and yaml ^2.8.3 security pins
  (auto-merged from Bandwidth snyk PRs #2 and #3)

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants