Bump the security group across 1 directory with 6 updates

[dependabot]

Bumps the security group with 4 updates in the / directory: lodash, braces, form-data and pug.

Updates lodash from 4.17.10 to 4.18.1

Release notes

Sourced from lodash's releases.

4.18.1

Bugs

Fixes a ReferenceError issue in lodash lodash-es lodash-amd and lodash.template when using the template and fromPairs functions from the modular builds. See lodash/lodash#6167

These defects were related to how lodash distributions are built from the main branch using https://github.com/lodash-archive/lodash-cli. When internal dependencies change inside lodash functions, equivalent updates need to be made to a mapping in the lodash-cli. (hey, it was ahead of its time once upon a time!). We know this, but we missed it in the last release. It's the kind of thing that passes in CI, but fails bc the build is not the same thing you tested.

There is no diff on main for this, but you can see the diffs for each of the npm packages on their respective branches:

• lodash: lodash/lodash@4.18.0-npm...4.18.1-npm
• lodash-es: lodash/lodash@4.18.0-es...4.18.1-es
• lodash-amd: lodash/lodash@4.18.0-amd...4.18.1-amd
• lodash.templatelodash/lodash@4.18.0-npm-packages...4.18.1-npm-packages

4.18.0

v4.18.0

Full Changelog: lodash/lodash@4.17.23...4.18.0

Security

_.unset / _.omit: Fixed prototype pollution via constructor/prototype path traversal (GHSA-f23m-r3pf-42rh, fe8d32e). Previously, array-wrapped path segments and primitive roots could bypass the existing guards, allowing deletion of properties from built-in prototypes. Now constructor and prototype are blocked unconditionally as non-terminal path keys, matching baseSet. Calls that previously returned true and deleted the property now return false and leave the target untouched.

_.template: Fixed code injection via imports keys (GHSA-r5fr-rjxr-66jc, CVE-2026-4800, 879aaa9). Fixes an incomplete patch for CVE-2021-23337. The variable option was validated against reForbiddenIdentifierChars but importsKeys was left unguarded, allowing code injection via the same Function() constructor sink. imports keys containing forbidden identifier characters now throw "Invalid imports option passed into _.template".

Docs

• Add security notice for _.template in threat model and API docs (#6099)
• Document lower > upper behavior in _.random (#6115)
• Fix quotes in _.compact jsdoc (#6090)

lodash.* modular packages

Diff

We have also regenerated and published a select number of the lodash.* modular packages.

These modular packages had fallen out of sync significantly from the minor/patch updates to lodash. Specifically, we have brought the following packages up to parity w/ the latest lodash release because they have had CVEs on them in the past:

• lodash.orderby
• lodash.tonumber
• lodash.trim
• lodash.trimend
• lodash.sortedindexby
• lodash.zipobjectdeep
• lodash.unset
• lodash.omit
• lodash.template

Commits

• cb0b9b9 release(patch): bump main to 4.18.1 (#6177)
• 75535f5 chore: prune stale advisory refs (#6170)
• 62e91bc docs: remove n_ Node.js < 6 REPL note from README (#6165)
• 59be2de release(minor): bump to 4.18.0 (#6161)
• af63457 fix: broken tests for _.template 879aaa9
• 1073a76 fix: linting issues
• 879aaa9 fix: validate imports keys in _.template
• fe8d32e fix: block prototype pollution in baseUnset via constructor/prototype traversal
• 18ba0a3 refactor(fromPairs): use baseAssignValue for consistent assignment (#6153)
• b819080 ci: add dist sync validation workflow (#6137)
• Additional commits viewable in compare view

Updates braces from 2.3.2 to 3.0.3

Changelog

Sourced from braces's changelog.

Release history

All notable changes to this project will be documented in this file.

The format is based on Keep a Changelog and this project adheres to Semantic Versioning.

• Changelogs are for humans, not machines.
• There should be an entry for every single version.
• The same types of changes should be grouped.
• Versions and sections should be linkable.
• The latest version comes first.
• The release date of each versions is displayed.
• Mention whether you follow Semantic Versioning.

Changelog entries are classified using the following labels (from keep-a-changelog):

• Added for new features.
• Changed for changes in existing functionality.
• Deprecated for soon-to-be removed features.
• Removed for now removed features.
• Fixed for any bug fixes.
• Security in case of vulnerabilities.

[3.0.0] - 2018-04-08

v3.0 is a complete refactor, resulting in a faster, smaller codebase, with fewer deps, and a more accurate parser and compiler.

Breaking Changes

• The undocumented .makeRe method was removed
• Require Node.js >= 8.3

Non-breaking changes

• Caching was removed

Commits

• See full diff in compare view

Removes form-data

Updates yargs-parser from 5.0.0 to 20.2.9

Release notes

Sourced from yargs-parser's releases.

yargs-parser yargs-parser-v20.2.9

Bug Fixes

• build: fixed automated release pipeline (1fe9135)

yargs-parser yargs-parser-v20.2.8

Bug Fixes

• deno: force relese for Deno (6687c97)
• locale: Turkish camelize and decamelize issues with toLocaleLowerCase/toLocaleUpperCase (2617303)
• perf: address slow parse when using unknown-options-as-args (#394) (441f059)
• string-utils: detect [0,1] ranged values as numbers (#388) (efcc32c)

yargs-parser yargs-parser-v15.0.3

Bug Fixes

• build: should use releases_created when using manifest (49ea4ef)

yargs-parser yargs-parser-v15.0.2

Bug Fixes

• perf: address slow parse when using unknown-options-as-args (#400) (bc387ec)

Changelog

Sourced from yargs-parser's changelog.

20.2.9 (2021-06-20)

Bug Fixes

• build: fixed automated release pipeline (1fe9135)

20.2.8 (2021-06-20)

Bug Fixes

• locale: Turkish camelize and decamelize issues with toLocaleLowerCase/toLocaleUpperCase (2617303)
• perf: address slow parse when using unknown-options-as-args (#394) (441f059)
• string-utils: detect [0,1] ranged values as numbers (#388) (efcc32c)

20.2.7 (2021-03-10)

Bug Fixes

• deno: force release for Deno (6687c97)

20.2.6 (2021-02-22)

Bug Fixes

• populate--: -- should always be array (#354) (585ae8f)

20.2.5 (2021-02-13)

Bug Fixes

• do not lowercase camel cased string (#348) (5f4da1f)

20.2.4 (2020-11-09)

Bug Fixes

• deno: address import issues in Deno (#339) (3b54e5e)

20.2.3 (2020-10-16)

Bug Fixes

• exports: node 13.0 and 13.1 require the dotted object form with a string fallback (#336) (3ae7242)

... (truncated)

Commits

• 3859e74 chore: release main (#404)
• 1fe9135 fix(build): fixed automated release pipeline
• 9eb9c2f chore: release main (#398)
• 4b9e134 build: should be releases_created
• 441f059 fix(perf): address slow parse when using unknown-options-as-args (#394)
• fb22816 build: switch from master to main
• a0a0814 build: switch to manifest based releases (#396)
• 088481c docs: fix typos in README.md (#379)
• 6877a2d test: add test for optimized output (#373)
• 2cfab05 refactor: quote properties used for meta-programming
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by oss-bot, a new releaser for yargs-parser since your current version.

Install script changes

This version adds prepare script that runs during installation. Review the package contents before updating.

Updates pug from 2.0.3 to 3.0.4

Release notes

Sourced from pug's releases.

pug-code-gen@3.0.4

Bug Fixes

• Ensure doctype option is properly validated (#3468)

pug@3.0.4

Bug Fixes

• Update pug-code-gen to ensure doctype option is properly validated (#3468)

pug-code-gen@3.0.3

Bug Fixes

• Validate templateName and globals are valid JavaScript identifiers to prevent possible remote code execution if un-trusted user input is passed to the compilation options (#3438)

pug@3.0.3

Bug Fixes

• Update pug-code-gen with the following fix: (#3438)

  Validate templateName and globals are valid JavaScript identifiers to prevent possible remote code execution if un-trusted user input is passed to the compilation options

pug-code-gen@3.0.2

Bug Fixes

• Sanitise the pretty option (#3314)

  If a malicious attacker could control the pretty option, it was possible for them to achieve remote code execution on the server rendering the template. All pug users should upgrade as soon as possible, see #3312 for more details.

pug@3.0.2

Bug Fixes

• Serialize Buffers to strings when storing sources for use with compileDebug: true (#3269)

pug-code-gen@3.0.1

Bug Fixes

• Update with to resolve core-js deprecation notice (#3259)

pug-runtime@3.0.1

Bug Fixes

• Properly handle non-string values when rethrowing errors (#3269)

pug@3.0.1

Bug Fixes

• Sanitise the pretty option (#3314)

  If a malicious attacker could control the pretty option, it was possible for them to achieve remote code execution on the server rendering the template. All pug users should upgrade as soon as possible, see #3312 for more details.

... (truncated)

Commits

• c323ed3 ci: fix permissions
• 94d731f fix: doctype option was not validated correctly (#3468)
• 32acfe8 fix: ensure template names are valid identifiers (#3438)
• 4767caf refactor: convert pug-error to TypeScript (#3355)
• a724446 chore: update character-parser (#3354)
• 6cca8f7 docs: fix GitHub format in README (#3335)
• d4b7f60 Properly handle errors originating from included files when compileDebug is e...
• d6f0615 fix capture groups for "each" statements (#3274)
• 73ea7cf fix: keep lexer plugins inside tag interpolation (#3296)
• 29a53c5 fix: Fix pug-lexer parsed escaped interpolations incorrectly (#3299)
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for pug since your current version.

Updates y18n from 3.2.1 to 5.0.8

Release notes

Sourced from y18n's releases.

y18n y18n-v4.0.3

Bug Fixes

• release: 4.x.x should not enforce Node 10 (#126) (1e21a53)

y18n y18n-v4.0.2

Bug Fixes

• security: ensure entry exists for backport (#120) (b22c0df)

Changelog

Sourced from y18n's changelog.

5.0.8 (2021-04-07)

Bug Fixes

• deno: force modern release for Deno (b1c215a)

5.0.7 (2021-04-07)

Bug Fixes

• deno: force release for deno (#121) (d3f2560)

5.0.6 (2021-04-05)

Bug Fixes

• webpack: skip readFileSync if not defined (#117) (6966fa9)

5.0.5 (2020-10-25)

Bug Fixes

• address prototype pollution issue (#108) (a9ac604)

5.0.4 (2020-10-16)

Bug Fixes

• exports: node 13.0 and 13.1 require the dotted object form with a string fallback (#105) (4f85d80)

5.0.3 (2020-10-16)

Bug Fixes

• exports: node 13.0-13.6 require a string fallback (#103) (e39921e)

5.0.2 (2020-10-01)

Bug Fixes

• deno: update types for deno ^1.4.0 (#100) (3834d9a)

5.0.1 (2020-09-05)

... (truncated)

Commits

• 58a9a3c chore: release 5.0.8 (#129)
• b1c215a fix(deno): force modern release for Deno
• e73fb19 chore: release 5.0.7 (#123)
• d3f2560 fix(deno): force release for deno (#121)
• e9fda61 chore: release 5.0.6 (#118)
• 6966fa9 fix(webpack): skip readFileSync if not defined (#117)
• c755582 docs: add entry for v4.0.1 (#114)
• 2d4c56c chore(deps): update dependency standardx to v6 (#110)
• b64ae70 chore: release 5.0.5 (#109)
• a9ac604 fix: address prototype pollution issue (#108)
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by oss-bot, a new releaser for y18n since your current version.

Install script changes

This version adds prepare script that runs during installation. Review the package contents before updating.

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions
  You can disable automated security fix PRs for this repo from the Security Alerts page.