chore(deps): bump lodash and @nestjs/config #7

Open

dependabot[bot] wants to merge 1 commit from dependabot/npm_and_yarn/multi-8efb0c075f into main

dependabot[bot] commented

2026-05-14 08:46:54 +04:00

(Migrated from github.com)

Bumps lodash to 4.18.1 and updates ancestor dependency @nestjs/config. These dependencies need to be updated together.

Updates lodash from 4.17.23 to 4.18.1

Release notes

Sourced from lodash's releases.

4.18.1

Bugs

Fixes a ReferenceError issue in lodash lodash-es lodash-amd and lodash.template when using the template and fromPairs functions from the modular builds. See lodash/lodash#6167

These defects were related to how lodash distributions are built from the main branch using https://github.com/lodash-archive/lodash-cli. When internal dependencies change inside lodash functions, equivalent updates need to be made to a mapping in the lodash-cli. (hey, it was ahead of its time once upon a time!). We know this, but we missed it in the last release. It's the kind of thing that passes in CI, but fails bc the build is not the same thing you tested.

There is no diff on main for this, but you can see the diffs for each of the npm packages on their respective branches:

lodash: https://github.com/lodash/lodash/compare/4.18.0-npm...4.18.1-npm

lodash-es: https://github.com/lodash/lodash/compare/4.18.0-es...4.18.1-es

lodash-amd: https://github.com/lodash/lodash/compare/4.18.0-amd...4.18.1-amd

lodash.templatehttps://github.com/lodash/lodash/compare/4.18.0-npm-packages...4.18.1-npm-packages

4.18.0

v4.18.0

Full Changelog: https://github.com/lodash/lodash/compare/4.17.23...4.18.0

Security

_.unset / _.omit: Fixed prototype pollution via constructor/prototype path traversal (GHSA-f23m-r3pf-42rh, fe8d32e). Previously, array-wrapped path segments and primitive roots could bypass the existing guards, allowing deletion of properties from built-in prototypes. Now constructor and prototype are blocked unconditionally as non-terminal path keys, matching baseSet. Calls that previously returned true and deleted the property now return false and leave the target untouched.

_.template: Fixed code injection via imports keys (GHSA-r5fr-rjxr-66jc, CVE-2026-4800, 879aaa9). Fixes an incomplete patch for CVE-2021-23337. The variable option was validated against reForbiddenIdentifierChars but importsKeys was left unguarded, allowing code injection via the same Function() constructor sink. imports keys containing forbidden identifier characters now throw "Invalid imports option passed into _.template".

Docs

Add security notice for _.template in threat model and API docs (#6099)

Document lower > upper behavior in _.random (#6115)

Fix quotes in _.compact jsdoc (#6090)

lodash.* modular packages

Diff

We have also regenerated and published a select number of the lodash.* modular packages.

These modular packages had fallen out of sync significantly from the minor/patch updates to lodash. Specifically, we have brought the following packages up to parity w/ the latest lodash release because they have had CVEs on them in the past:

lodash.orderby

lodash.tonumber

lodash.trim

lodash.trimend

lodash.sortedindexby

lodash.zipobjectdeep

lodash.unset

lodash.omit

lodash.template

Commits

cb0b9b9 release(patch): bump main to 4.18.1 (#6177)
75535f5 chore: prune stale advisory refs (#6170)
62e91bc docs: remove n_ Node.js < 6 REPL note from README (#6165)
59be2de release(minor): bump to 4.18.0 (#6161)
af63457 fix: broken tests for _.template 879aaa9
1073a76 fix: linting issues
879aaa9 fix: validate imports keys in _.template
fe8d32e fix: block prototype pollution in baseUnset via constructor/prototype traversal
18ba0a3 refactor(fromPairs): use baseAssignValue for consistent assignment (#6153)
b819080 ci: add dist sync validation workflow (#6137)
Additional commits viewable in compare view

Updates @nestjs/config from 4.0.3 to 4.0.4

Release notes

Sourced from @nestjs/config's releases.

Release 4.0.4

fix(deps): update dependency dotenv to v17.4.1 (6bc5737)

fix(deps): update dependency lodash to v4.18.1 [security] (f31ee98)

Commits

3b5d592 chore(): release v4.0.4
4fbcb03 Merge pull request #2263 from nestjs/renovate/dotenv-17.x
33dae89 Merge pull request #2269 from nestjs/renovate/cimg-node-24.x
0a727c3 Merge pull request #2313 from nestjs/renovate/npm-lodash-vulnerability
6bc5737 fix(deps): update dependency dotenv to v17.4.1
f31ee98 fix(deps): update dependency lodash to v4.18.1 [security]
059314c chore(deps): update dependency typescript-eslint to v8.58.1 (#2315)
0f81e2d chore(deps): update dependency eslint to v10.2.0 (#2314)
e673ab2 chore(deps): update dependency @types/node to v24.12.2 (#2311)
b1ede30 chore(deps): update nest monorepo to v11.1.18 (#2312)
Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
You can disable automated security fix PRs for this repo from the Security Alerts page.

Bumps [lodash](https://github.com/lodash/lodash) to 4.18.1 and updates ancestor dependency [@nestjs/config](https://github.com/nestjs/config). These dependencies need to be updated together. Updates `lodash` from 4.17.23 to 4.18.1 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/lodash/lodash/releases">lodash's releases</a>.</em></p> <blockquote> <h2>4.18.1</h2> <h2>Bugs</h2> <p>Fixes a <code>ReferenceError</code> issue in <code>lodash</code> <code>lodash-es</code> <code>lodash-amd</code> and <code>lodash.template</code> when using the <code>template</code> and <code>fromPairs</code> functions from the modular builds. See <a href="https://redirect.github.com/lodash/lodash/issues/6167#issuecomment-4165269769">lodash/lodash#6167</a></p> <p>These defects were related to how lodash distributions are built from the main branch using <a href="https://github.com/lodash-archive/lodash-cli">https://github.com/lodash-archive/lodash-cli</a>. When internal dependencies change inside lodash functions, equivalent updates need to be made to a mapping in the lodash-cli. (hey, it was ahead of its time once upon a time!). We know this, but we missed it in the last release. It's the kind of thing that passes in CI, but fails bc the build is not the same thing you tested.</p> <p>There is no diff on main for this, but you can see the diffs for each of the npm packages on their respective branches:</p> <ul> <li><code>lodash</code>: <a href="https://github.com/lodash/lodash/compare/4.18.0-npm...4.18.1-npm">https://github.com/lodash/lodash/compare/4.18.0-npm...4.18.1-npm</a></li> <li><code>lodash-es</code>: <a href="https://github.com/lodash/lodash/compare/4.18.0-es...4.18.1-es">https://github.com/lodash/lodash/compare/4.18.0-es...4.18.1-es</a></li> <li><code>lodash-amd</code>: <a href="https://github.com/lodash/lodash/compare/4.18.0-amd...4.18.1-amd">https://github.com/lodash/lodash/compare/4.18.0-amd...4.18.1-amd</a></li> <li><code>lodash.template</code><a href="https://github.com/lodash/lodash/compare/4.18.0-npm-packages...4.18.1-npm-packages">https://github.com/lodash/lodash/compare/4.18.0-npm-packages...4.18.1-npm-packages</a></li> </ul> <h2>4.18.0</h2> <h2>v4.18.0</h2> <p><strong>Full Changelog</strong>: <a href="https://github.com/lodash/lodash/compare/4.17.23...4.18.0">https://github.com/lodash/lodash/compare/4.17.23...4.18.0</a></p> <h3>Security</h3> <p><strong><code>_.unset</code> / <code>_.omit</code></strong>: Fixed prototype pollution via <code>constructor</code>/<code>prototype</code> path traversal (<a href="https://github.com/lodash/lodash/security/advisories/GHSA-f23m-r3pf-42rh">GHSA-f23m-r3pf-42rh</a>, <a href="https://github.com/lodash/lodash/commit/fe8d32eda854377349a4f922ab7655c8e5df9a0b">fe8d32e</a>). Previously, array-wrapped path segments and primitive roots could bypass the existing guards, allowing deletion of properties from built-in prototypes. Now <code>constructor</code> and <code>prototype</code> are blocked unconditionally as non-terminal path keys, matching <code>baseSet</code>. Calls that previously returned <code>true</code> and deleted the property now return <code>false</code> and leave the target untouched.</p> <p><strong><code>_.template</code></strong>: Fixed code injection via <code>imports</code> keys (<a href="https://github.com/lodash/lodash/security/advisories/GHSA-r5fr-rjxr-66jc">GHSA-r5fr-rjxr-66jc</a>, CVE-2026-4800, <a href="https://github.com/lodash/lodash/commit/879aaa93132d78c2f8d20c60279da9f8b21576d6">879aaa9</a>). Fixes an incomplete patch for CVE-2021-23337. The <code>variable</code> option was validated against <code>reForbiddenIdentifierChars</code> but <code>importsKeys</code> was left unguarded, allowing code injection via the same <code>Function()</code> constructor sink. <code>imports</code> keys containing forbidden identifier characters now throw <code>"Invalid imports option passed into _.template"</code>.</p> <h3>Docs</h3> <ul> <li>Add security notice for <code>_.template</code> in threat model and API docs (<a href="https://redirect.github.com/lodash/lodash/pull/6099">#6099</a>)</li> <li>Document <code>lower > upper</code> behavior in <code>_.random</code> (<a href="https://redirect.github.com/lodash/lodash/pull/6115">#6115</a>)</li> <li>Fix quotes in <code>_.compact</code> jsdoc (<a href="https://redirect.github.com/lodash/lodash/pull/6090">#6090</a>)</li> </ul> <h3><code>lodash.*</code> modular packages</h3> <p><a href="https://redirect.github.com/lodash/lodash/pull/6157">Diff</a></p> <p>We have also regenerated and published a select number of the <code>lodash.*</code> modular packages.</p> <p>These modular packages had fallen out of sync significantly from the minor/patch updates to lodash. Specifically, we have brought the following packages up to parity w/ the latest lodash release because they have had CVEs on them in the past:</p> <ul> <li><a href="https://www.npmjs.com/package/lodash.orderby">lodash.orderby</a></li> <li><a href="https://www.npmjs.com/package/lodash.tonumber">lodash.tonumber</a></li> <li><a href="https://www.npmjs.com/package/lodash.trim">lodash.trim</a></li> <li><a href="https://www.npmjs.com/package/lodash.trimend">lodash.trimend</a></li> <li><a href="https://www.npmjs.com/package/lodash.sortedindexby">lodash.sortedindexby</a></li> <li><a href="https://www.npmjs.com/package/lodash.zipobjectdeep">lodash.zipobjectdeep</a></li> <li><a href="https://www.npmjs.com/package/lodash.unset">lodash.unset</a></li> <li><a href="https://www.npmjs.com/package/lodash.omit">lodash.omit</a></li> <li><a href="https://www.npmjs.com/package/lodash.template">lodash.template</a></li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/lodash/lodash/commit/cb0b9b9212521c08e3eafe7c8cb0af1b42b6649e"><code>cb0b9b9</code></a> release(patch): bump main to 4.18.1 (<a href="https://redirect.github.com/lodash/lodash/issues/6177">#6177</a>)</li> <li><a href="https://github.com/lodash/lodash/commit/75535f57883b7225adb96de1cfc1cd4169cfcb51"><code>75535f5</code></a> chore: prune stale advisory refs (<a href="https://redirect.github.com/lodash/lodash/issues/6170">#6170</a>)</li> <li><a href="https://github.com/lodash/lodash/commit/62e91bc6a39c98d85b9ada8c44d40593deaf82a4"><code>62e91bc</code></a> docs: remove n_ Node.js < 6 REPL note from README (<a href="https://redirect.github.com/lodash/lodash/issues/6165">#6165</a>)</li> <li><a href="https://github.com/lodash/lodash/commit/59be2de61f8aa9461c7856533b51d31b7d8babc4"><code>59be2de</code></a> release(minor): bump to 4.18.0 (<a href="https://redirect.github.com/lodash/lodash/issues/6161">#6161</a>)</li> <li><a href="https://github.com/lodash/lodash/commit/af634573030f979194871da7c68f79420992f53d"><code>af63457</code></a> fix: broken tests for _.template 879aaa9</li> <li><a href="https://github.com/lodash/lodash/commit/1073a7693e1727e0cf3641e5f71f75ddcf8de7c0"><code>1073a76</code></a> fix: linting issues</li> <li><a href="https://github.com/lodash/lodash/commit/879aaa93132d78c2f8d20c60279da9f8b21576d6"><code>879aaa9</code></a> fix: validate imports keys in _.template</li> <li><a href="https://github.com/lodash/lodash/commit/fe8d32eda854377349a4f922ab7655c8e5df9a0b"><code>fe8d32e</code></a> fix: block prototype pollution in baseUnset via constructor/prototype traversal</li> <li><a href="https://github.com/lodash/lodash/commit/18ba0a32f42fd02117f096b032f89c984173462d"><code>18ba0a3</code></a> refactor(fromPairs): use baseAssignValue for consistent assignment (<a href="https://redirect.github.com/lodash/lodash/issues/6153">#6153</a>)</li> <li><a href="https://github.com/lodash/lodash/commit/b8190803d48d60b8c80ad45d39125f32fa618cb2"><code>b819080</code></a> ci: add dist sync validation workflow (<a href="https://redirect.github.com/lodash/lodash/issues/6137">#6137</a>)</li> <li>Additional commits viewable in <a href="https://github.com/lodash/lodash/compare/4.17.23...4.18.1">compare view</a></li> </ul> </details> <br /> Updates `@nestjs/config` from 4.0.3 to 4.0.4 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/nestjs/config/releases">@nestjs/config's releases</a>.</em></p> <blockquote> <h2>Release 4.0.4</h2> <ul> <li>fix(deps): update dependency dotenv to v17.4.1 (6bc5737)</li> <li>fix(deps): update dependency lodash to v4.18.1 [security] (f31ee98)</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/nestjs/config/commit/3b5d5921cea0a313c88a9059fddb745d56b90c43"><code>3b5d592</code></a> chore(): release v4.0.4</li> <li><a href="https://github.com/nestjs/config/commit/4fbcb03a9cb7626ad147ac3af232c3fbb5f788ac"><code>4fbcb03</code></a> Merge pull request <a href="https://redirect.github.com/nestjs/config/issues/2263">#2263</a> from nestjs/renovate/dotenv-17.x</li> <li><a href="https://github.com/nestjs/config/commit/33dae891d4bf5c61e4c54dc3daea34c3b70feda1"><code>33dae89</code></a> Merge pull request <a href="https://redirect.github.com/nestjs/config/issues/2269">#2269</a> from nestjs/renovate/cimg-node-24.x</li> <li><a href="https://github.com/nestjs/config/commit/0a727c3ab5fa4d451501f5c3f2dd6a12f4b17eb8"><code>0a727c3</code></a> Merge pull request <a href="https://redirect.github.com/nestjs/config/issues/2313">#2313</a> from nestjs/renovate/npm-lodash-vulnerability</li> <li><a href="https://github.com/nestjs/config/commit/6bc5737752ef718ee1eaa44592860856d97a4dfd"><code>6bc5737</code></a> fix(deps): update dependency dotenv to v17.4.1</li> <li><a href="https://github.com/nestjs/config/commit/f31ee980f3c1ac7205fd6add780ef480f96d451f"><code>f31ee98</code></a> fix(deps): update dependency lodash to v4.18.1 [security]</li> <li><a href="https://github.com/nestjs/config/commit/059314cb1b234bc67d538fbbe21d760cf2e23e8a"><code>059314c</code></a> chore(deps): update dependency typescript-eslint to v8.58.1 (<a href="https://redirect.github.com/nestjs/config/issues/2315">#2315</a>)</li> <li><a href="https://github.com/nestjs/config/commit/0f81e2dd99916e60db795f138598767ab8decc8e"><code>0f81e2d</code></a> chore(deps): update dependency eslint to v10.2.0 (<a href="https://redirect.github.com/nestjs/config/issues/2314">#2314</a>)</li> <li><a href="https://github.com/nestjs/config/commit/e673ab2e808f787b06c71df5e2f7e9c6a2e394d9"><code>e673ab2</code></a> chore(deps): update dependency <code>@types/node</code> to v24.12.2 (<a href="https://redirect.github.com/nestjs/config/issues/2311">#2311</a>)</li> <li><a href="https://github.com/nestjs/config/commit/b1ede30356ba95efca8a17ce2357e4182cbf99f5"><code>b1ede30</code></a> chore(deps): update nest monorepo to v11.1.18 (<a href="https://redirect.github.com/nestjs/config/issues/2312">#2312</a>)</li> <li>Additional commits viewable in <a href="https://github.com/nestjs/config/compare/4.0.3...4.0.4">compare view</a></li> </ul> </details> <br /> Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/Katze-942/node/network/alerts). </details>

This pull request has changes conflicting with the target branch.

package-lock.json
package.json

View command line instructions

Manual merge helper

Use this merge commit message when completing the merge manually.

Merge commit title

Merge pull request 'chore(deps): bump lodash and @nestjs/config' (#7) from dependabot/npm_and_yarn/multi-8efb0c075f into main

Merge commit body

Reviewed-on: https://git.katze-942.ru/katze_942/synapse/pulls/7

Merge pull request 'chore(deps): bump lodash and @nestjs/config' (#7) from dependabot/npm_and_yarn/multi-8efb0c075f into main

Reviewed-on: https://git.katze-942.ru/katze_942/synapse/pulls/7

Checkout

From your project repository, check out a new branch and test the changes.

git fetch -u origin dependabot/npm_and_yarn/multi-8efb0c075f:dependabot/npm_and_yarn/multi-8efb0c075f

git switch dependabot/npm_and_yarn/multi-8efb0c075f

Merge

Merge the changes and update on Forgejo.

Warning: The "Autodetect manual merge" setting is not enabled for this repository, you will have to mark this pull request as manually merged afterwards.

git switch main

git merge --no-ff dependabot/npm_and_yarn/multi-8efb0c075f

git switch dependabot/npm_and_yarn/multi-8efb0c075f

git rebase main

git switch main

git merge --ff-only dependabot/npm_and_yarn/multi-8efb0c075f

git switch dependabot/npm_and_yarn/multi-8efb0c075f

git rebase main

git switch main

git merge --no-ff dependabot/npm_and_yarn/multi-8efb0c075f

git switch main

git merge --squash dependabot/npm_and_yarn/multi-8efb0c075f