chore(deps): update all non-major dependencies#2136
Open
chrisbbreuer wants to merge 1 commit into
Open
Conversation
❌ Deploy Preview for ts-quick-reaction failed. Why did it fail? →
|
chrisbbreuer
force-pushed
the
buddy-bot/update-non-major-updates
branch
7 times, most recently
from
10912e8 to
8cacb78
Compare
chrisbbreuer
force-pushed
the
buddy-bot/update-non-major-updates
branch
3 times, most recently
from
2066d8d to
0728c6b
Compare
chrisbbreuer
force-pushed
the
buddy-bot/update-non-major-updates
branch
from
0728c6b to
2ea2fdb
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
Package Updates Summary
📦 npm Dependencies
5 packages will be updated
4.17.23->4.18.10.1.4->0.1.60.2.8->0.2.100.15.11->0.15.133.5.0->3.5.34Release Notes
lodash/lodash (lodash)
4.17.23 -> 4.18.1
4.18.1Compare Source
Bugs
Fixes a
ReferenceErrorissue inlodashlodash-eslodash-amdandlodash.templatewhen using thetemplateandfromPairsfunctions from the modular builds. Seelodash/lodash#6167#issuecomment-4165269769These defects were related to how lodash distributions are built from the main branch using https://github.com/lodash-archive/lodash-cli. When internal dependencies change inside lodash functions, equivalent updates need to be made to a mapping in the lodash-cli. (hey, it was ahead of its time once upon a time!). We know this, but we missed it in the last release. It's the kind of thing that passes in CI, but fails bc the build is not the same thing you tested.
There is no diff on main for this, but you can see the diffs for each of the npm packages on their respective branches:
lodash: lodash/lodash@4.18.0-npm...4.18.1-npmlodash-es: lodash/lodash@4.18.0-es...4.18.1-eslodash-amd: https://github....[View full release notes]
Released by jonchurch on 4/1/2026
4.18.0Compare Source
v4.18.0
Full Changelog: lodash/lodash@4.17.23...4.18.0
Security
_.unset/_.omit: Fixed prototype pollution viaconstructor/prototypepath traversal (GHSA-f23m-r3pf-42rh, fe8d32e). Previously, array-wrapped path segments and primitive roots could bypass the existing guards, allowing deletion of properties from built-in prototypes. Nowconstructorandprototypeare blocked unconditionally as non-terminal path keys, matchingbaseSet. Calls that previously returnedtrueand deleted the property now returnfalseand leave the target untouched._.template: Fixed code injection viaimportskeys (GHSA-r5fr-rjxr-66jc, CVE-2026-4800, [879aaa9](lodash/lodash@879aaa931...[View full release notes]
Released by jonchurch on 3/31/2026
stacksjs/bunpress (@stacksjs/bunpress)
0.1.4 -> 0.1.6
v0.1.6Compare Source
Released by github-actions[bot] on 5/24/2026
v0.1.5Compare Source
Released by github-actions[bot] on 5/10/2026
stacksjs/clapp (@stacksjs/clapp)
0.2.8 -> 0.2.10
v0.2.10Compare Source
Released by github-actions[bot] on 5/14/2026
v0.2.9Compare Source
Released by github-actions[bot] on 5/11/2026
stacksjs/bunfig (bunfig)
0.15.11 -> 0.15.13
v0.15.13Compare Source
Released by github-actions[bot] on 5/8/2026
v0.15.12Compare Source
Released by github-actions[bot] on 5/8/2026
v0.15.9Compare Source
Released by github-actions[bot] on 4/29/2026
vuejs/core (vue)
3.5.0 -> 3.5.34
v3.6.0-beta.12Compare Source
For stable releases, please refer to CHANGELOG.md for details.
For pre-releases, please refer to CHANGELOG.md of the
minorbranch.Released by github-actions[bot] on 5/15/2026
v3.6.0-beta.11Compare Source
For stable releases, please refer to CHANGELOG.md for details.
For pre-releases, please refer to CHANGELOG.md of the
minorbranch.Released by github-actions[bot] on 5/7/2026
v3.5.34Compare Source
For stable releases, please refer to CHANGELOG.md for details.
For pre-releases, please refer to CHANGELOG.md of the
minorbranch.Released by github-actions[bot] on 5/6/2026
📊 Package Statistics
Configuration
📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about these updates again.
This PR was generated by Buddy 🤖