Skip to content

chore(deps): bump lodash to ^4.18.1 - #2931

Merged
tomek-tursa-sb merged 3 commits into
stoplightio:developfrom
dotboris:lodash-4.18.1
Apr 13, 2026
Merged

chore(deps): bump lodash to ^4.18.1#2931
tomek-tursa-sb merged 3 commits into
stoplightio:developfrom
dotboris:lodash-4.18.1

Conversation

@dotboris

@dotboris dotboris commented Apr 2, 2026

Copy link
Copy Markdown
Contributor

Fixes #2929.

Checklist

  • Tests added / updated
  • Docs added / updated

Does this PR introduce a breaking change?

  • Yes
  • No

Additional context

I've changed the tilde (~) versions to be carets (^) so that minor version bumps won't require PRs like this in the future. I figured this was OK because I saw other cases where ^ was used for lodash.

@dotboris
dotboris requested a review from a team as a code owner April 2, 2026 09:56
barryadk
barryadk previously approved these changes Apr 8, 2026
@bartosz-nowacki

Copy link
Copy Markdown

Hey @dotboris, can you take a look at the errors that came up during the build?

@dotboris

Copy link
Copy Markdown
Contributor Author

I took a quick look and this project is running typescript@4.4.4 which is ~5 years old now. I'm guessing that this is the issue. The new version of @types/lodash must use some new syntax that the old typescript compiler doesn't understand.

"typescript": "4.4.4"

I'll go revert the @types/lodash upgrade since it shouldn't matter too much.

Seems like the old version of `typescript` doesn't handle the updated
types.
@tomek-tursa-sb

Copy link
Copy Markdown
Contributor

@dotboris I'm changing the PR name to match the convention.Otherwise LGTM. Thank you for this contribution 👍

@tomek-tursa-sb tomek-tursa-sb changed the title fix(security): bump lodash to ^4.18.1 chore(deps): bump lodash to ^4.18.1 Apr 13, 2026
@tomek-tursa-sb
tomek-tursa-sb merged commit a078111 into stoplightio:develop Apr 13, 2026
8 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Lodash 4.17 vulnerable versions GHSA-r5fr-rjxr-66jc

4 participants