Skip to content

[SECURITY] Update dependency lodash to v4.17.23 [SECURITY]#151

Closed
nautilus-renovate-3[bot] wants to merge 1 commit intomainfrom
renovate/npm-lodash-vulnerability
Closed

[SECURITY] Update dependency lodash to v4.17.23 [SECURITY]#151
nautilus-renovate-3[bot] wants to merge 1 commit intomainfrom
renovate/npm-lodash-vulnerability

Conversation

@nautilus-renovate-3
Copy link
Copy Markdown

This PR contains the following updates:

Package Change Age Adoption Passing Confidence
lodash (source) 4.17.214.17.23 age adoption passing confidence

GitHub Vulnerability Alerts

CVE-2025-13465

Impact

Lodash versions 4.0.0 through 4.17.22 are vulnerable to prototype pollution in the _.unset and _.omit functions. An attacker can pass crafted paths which cause Lodash to delete methods from global prototypes.

The issue permits deletion of properties but does not allow overwriting their original behavior.

Patches

This issue is patched on 4.17.23.


Configuration

📅 Schedule: Branch creation - "" in timezone Europe/Berlin, Automerge - At any time (no schedule defined).

🚦 Automerge: Enabled.

Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.


  • If you want to rebase/retry this PR, check this box

This PR has been generated by Renovate Bot.

@nautilus-renovate-3 nautilus-renovate-3 Bot force-pushed the renovate/npm-lodash-vulnerability branch from f48f87c to a0ea13c Compare February 25, 2026 11:01
@LemonaOna LemonaOna closed this Mar 26, 2026
@nautilus-renovate-3
Copy link
Copy Markdown
Author

Renovate Ignore Notification

Because you closed this PR without merging, Renovate will ignore this update (^4.17.21). You will get a PR once a newer version is released. To ignore this dependency forever, add it to the ignoreDeps array of your Renovate config.

If you accidentally closed this PR, or if you changed your mind: rename this PR to get a fresh replacement PR.

@nautilus-renovate-3 nautilus-renovate-3 Bot deleted the renovate/npm-lodash-vulnerability branch March 26, 2026 15:01
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant