Upgrades lodash (npm) from 4.17.21 to 4.18.0, which fixes these known vulnerabilities:
| Advisory | Severity | Affected | Fixed in | Summary |
|---|---|---|---|---|
| GHSA-f23m-r3pf-42rh | medium | 4.17.21 | 4.18.0 | lodash vulnerable to Prototype Pollution via array path bypass in _.unset and _.omit |
| GHSA-r5fr-rjxr-66jc | high | 4.17.21 | 4.18.0 | lodash vulnerable to Code Injection via _.template imports key names |
| GHSA-xxjr-mmjv-4gpg | medium | 4.17.21 | 4.17.23 | Lodash has Prototype Pollution Vulnerability in _.unset and _.omit functions |
Lockfiles changed: src/package-lock.json.
Only the version changes. This pull request lands through this branch's required checks like any other. If they fail because code has to change, g1t closes it and puts g1t on an issue to make the change.
Opened by g1t's security updates. Turn them off for this project on its Security page.