Skip to content

Chore: Upgrade lodash to fix securityy vulnerability#216

Closed
SbsCruz wants to merge 2 commits into
mainfrom
chore/lodash-upgrade
Closed

Chore: Upgrade lodash to fix securityy vulnerability#216
SbsCruz wants to merge 2 commits into
mainfrom
chore/lodash-upgrade

Conversation

@SbsCruz

@SbsCruz SbsCruz commented May 26, 2026

Copy link
Copy Markdown
Collaborator

This PR upgrades lodash to version 4.18.1 to fix Code Injection via _.template imports key names

Related Security Alert: Dependabot#225

@SbsCruz SbsCruz requested review from mateopozor02 and suany0805 May 26, 2026 15:50
Comment thread yarn.lock
@SbsCruz

SbsCruz commented Jun 11, 2026

Copy link
Copy Markdown
Collaborator Author

After an investigation on this dependencie, it has been decided to close this PR.

The lodash vulnerability alert is triggered by transitively dependencies brought in by the following packages:

  • all-contributors-cli
  • inquirer
  • semantic-release-yarn

We verified using yarn why lodash that all these parent packages are already running on their latest available versions. The maintainers of these projects have not yet released updates forcing a higher version of lodash (>= 4.18.0).

@SbsCruz SbsCruz closed this Jun 11, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants