[toxakara]

Do not merge. Adds lodash 4.17.20 (GHSA-35jh-r3h4-6jhm, GHSA-29mw-wpgm-hmr9) to check that the dependency-review job blocks it. This PR will be closed without merging and its branch deleted.

[github-actions]

Dependency Review

The following issues were found:

• ❌ 1 vulnerable package(s)
• ✅ 0 package(s) with incompatible licenses
• ✅ 0 package(s) with invalid SPDX license definitions
• ✅ 0 package(s) with unknown licenses.

See the Details below.

Vulnerabilities

package.json

Name	Version	Vulnerability	Severity
lodash	4.17.20	Command Injection in lodash	high
		lodash vulnerable to Code Injection via `_.template` imports key names	high
		Regular Expression Denial of Service (ReDoS) in lodash	moderate
		Lodash has Prototype Pollution Vulnerability in `_.unset` and `_.omit` functions	moderate
		lodash vulnerable to Prototype Pollution via array path bypass in `_.unset` and `_.omit`	moderate

OpenSSF Scorecard

Package	Version	Score	Details
npm/lodash	4.17.20	🟢 6.6	Details Check Score Reason Code-Review 🟢 7 Found 22/30 approved changesets -- score normalized to 7 Dependency-Update-Tool 🟢 10 update tool detected Maintained 🟢 3 2 commit(s) and 2 issue activity found in the last 90 days -- score normalized to 3 Packaging ⚠️ -1 packaging workflow not detected Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Security-Policy 🟢 10 security policy file detected Token-Permissions ⚠️ 0 detected GitHub workflow tokens with excessive permissions Pinned-Dependencies 🟢 4 dependency not pinned by hash detected -- score normalized to 4 Binary-Artifacts 🟢 10 no binaries found in the repo CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected Vulnerabilities ⚠️ 0 120 existing vulnerabilities detected SAST 🟢 9 SAST tool detected but not run on all commits License 🟢 9 license file detected Signed-Releases ⚠️ -1 no releases found Fuzzing 🟢 10 project is fuzzed Branch-Protection ⚠️ -1 internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md CI-Tests 🟢 8 22 out of 25 merged PRs checked by a CI test -- score normalized to 8 Contributors 🟢 10 project has 90 contributing companies or organizations

Scanned Files

• package.json

[toxakara]

Test complete: dependency review failed as intended. Closing without merging.