Skip to content

build(deps): bump lodash, @graphql-codegen/cli, @graphql-codegen/near-operation-file-preset, @graphql-codegen/typed-document-node, @graphql-codegen/typescript, @graphql-codegen/typescript-operations and @graphql-codegen/urql-introspection in /catalog#4814

Open
dependabot[bot] wants to merge 1 commit intomasterfrom
dependabot/npm_and_yarn/catalog/multi-da215c5b99
Open

Conversation

@dependabot
Copy link
Copy Markdown
Contributor

@dependabot dependabot bot commented on behalf of github Apr 8, 2026 •
edited
Loading

Bumps lodash, @graphql-codegen/cli, @graphql-codegen/near-operation-file-preset, @graphql-codegen/typed-document-node, @graphql-codegen/typescript, @graphql-codegen/typescript-operations and @graphql-codegen/urql-introspection. These dependencies needed to be updated together.
Updates lodash from 4.17.21 to 4.18.1

Release notes

Sourced from lodash's releases.

4.18.1

Bugs

Fixes a ReferenceError issue in lodash lodash-es lodash-amd and lodash.template when using the template and fromPairs functions from the modular builds. See lodash/lodash#6167

These defects were related to how lodash distributions are built from the main branch using https://github.com/lodash-archive/lodash-cli. When internal dependencies change inside lodash functions, equivalent updates need to be made to a mapping in the lodash-cli. (hey, it was ahead of its time once upon a time!). We know this, but we missed it in the last release. It's the kind of thing that passes in CI, but fails bc the build is not the same thing you tested.

There is no diff on main for this, but you can see the diffs for each of the npm packages on their respective branches:

4.18.0

v4.18.0

Full Changelog: lodash/lodash@4.17.23...4.18.0

Security

_.unset / _.omit: Fixed prototype pollution via constructor/prototype path traversal (GHSA-f23m-r3pf-42rh, fe8d32e). Previously, array-wrapped path segments and primitive roots could bypass the existing guards, allowing deletion of properties from built-in prototypes. Now constructor and prototype are blocked unconditionally as non-terminal path keys, matching baseSet. Calls that previously returned true and deleted the property now return false and leave the target untouched.

_.template: Fixed code injection via imports keys (GHSA-r5fr-rjxr-66jc, CVE-2026-4800, 879aaa9). Fixes an incomplete patch for CVE-2021-23337. The variable option was validated against reForbiddenIdentifierChars but importsKeys was left unguarded, allowing code injection via the same Function() constructor sink. imports keys containing forbidden identifier characters now throw "Invalid imports option passed into _.template".

Docs

  • Add security notice for _.template in threat model and API docs (#6099)
  • Document lower > upper behavior in _.random (#6115)
  • Fix quotes in _.compact jsdoc (#6090)

lodash.* modular packages

Diff

We have also regenerated and published a select number of the lodash.* modular packages.

These modular packages had fallen out of sync significantly from the minor/patch updates to lodash. Specifically, we have brought the following packages up to parity w/ the latest lodash release because they have had CVEs on them in the past:

Commits
  • cb0b9b9 release(patch): bump main to 4.18.1 (#6177)
  • 75535f5 chore: prune stale advisory refs (#6170)
  • 62e91bc docs: remove n_ Node.js < 6 REPL note from README (#6165)
  • 59be2de release(minor): bump to 4.18.0 (#6161)
  • af63457 fix: broken tests for _.template 879aaa9
  • 1073a76 fix: linting issues
  • 879aaa9 fix: validate imports keys in _.template
  • fe8d32e fix: block prototype pollution in baseUnset via constructor/prototype traversal
  • 18ba0a3 refactor(fromPairs): use baseAssignValue for consistent assignment (#6153)
  • b819080 ci: add dist sync validation workflow (#6137)
  • Additional commits viewable in compare view

Updates @graphql-codegen/cli from 1.21.8 to 6.2.1

Changelog

Sourced from @​graphql-codegen/cli's changelog.

6.2.1

Patch Changes

  • #10618 e804925 Thanks @​PalmerTurley34! - Honor per-output preset importExtension and emitLegacyCommonJSImports config instead of always using the root config values.

6.2.0

Minor Changes

Patch Changes

  • Updated dependencies [8c4db2a]:
    • @​graphql-codegen/plugin-helpers@​6.2.0

6.1.3

Patch Changes

6.1.2

Patch Changes

  • #10590 e173e11 Thanks @​ya2s! - Fix GraphQL Config loading to forward nested extensions.codegen.config options when loading schemas/documents, matching codegen.ts behavior.

6.1.1

Patch Changes

... (truncated)

Commits
  • 590fcfa chore(release): update monorepo packages versions (#10641)
  • e804925 fix(cli): honor per-output preset import config (#10618)
  • fbd8360 chore(release): update monorepo packages versions (#10639)
  • 8c4db2a New feature: schema can be passed pre-parsed to generate() function as GraphQ...
  • 83b74fe chore(release): update monorepo packages versions (#10620)
  • cdf5dc5 Bump graphql tools (#10619)
  • 8ae0fdd chore(release): update monorepo packages versions (#10600)
  • e173e11 fix(cli): forward nested graphql-config loader options (#10590)
  • 62c7618 chore(release): update monorepo packages versions (#10570)
  • 8cb7d43 fix(graphql-codegen-cli): Don't hang when 0 CPUs are found (#10569)
  • Additional commits viewable in compare view
Maintainer changes

This version was pushed to npm by theguild-bot, a new releaser for @​graphql-codegen/cli since your current version.


Updates @graphql-codegen/near-operation-file-preset from 1.18.6 to 5.0.0

Changelog

Sourced from @​graphql-codegen/near-operation-file-preset's changelog.

5.0.0

Major Changes

Patch Changes

4.0.0

Major Changes

3.1.0

Minor Changes

3.0.1

Patch Changes

... (truncated)

Commits
Maintainer changes

This version was pushed to npm by [GitHub Actions](https://www.npmjs.com/~GitHub Actions), a new releaser for @​graphql-codegen/near-operation-file-preset since your current version.


Updates @graphql-codegen/typed-document-node from 1.18.10 to 6.1.7

Changelog

Sourced from @​graphql-codegen/typed-document-node's changelog.

6.1.7

Patch Changes

6.1.6

Patch Changes

  • Updated dependencies [6038634]:
    • @​graphql-codegen/visitor-plugin-common@​6.2.3

6.1.5

Patch Changes

  • Updated dependencies [f588d91]:
    • @​graphql-codegen/visitor-plugin-common@​6.2.2

6.1.4

Patch Changes

  • Updated dependencies [b995ed1]:
    • @​graphql-codegen/visitor-plugin-common@​6.2.1

6.1.3

Patch Changes

  • Updated dependencies [f821e8a, 9e70bcb]:
    • @​graphql-codegen/visitor-plugin-common@​6.2.0
    • @​graphql-codegen/plugin-helpers@​6.1.0

6.1.2

Patch Changes

  • Updated dependencies [51a1a72]:
    • @​graphql-codegen/visitor-plugin-common@​6.1.2

6.1.1

Patch Changes

... (truncated)

Commits
Maintainer changes

This version was pushed to npm by theguild-bot, a new releaser for @​graphql-codegen/typed-document-node since your current version.


Updates @graphql-codegen/typescript from 1.23.0 to 5.0.9

Changelog

Sourced from @​graphql-codegen/typescript's changelog.

5.0.9

Patch Changes

5.0.8

Patch Changes

  • Updated dependencies [6038634]:
    • @​graphql-codegen/visitor-plugin-common@​6.2.3

5.0.7

Patch Changes

  • Updated dependencies [f588d91]:
    • @​graphql-codegen/visitor-plugin-common@​6.2.2

5.0.6

Patch Changes

  • Updated dependencies [b995ed1]:
    • @​graphql-codegen/visitor-plugin-common@​6.2.1

5.0.5

Patch Changes

  • Updated dependencies [f821e8a, 9e70bcb]:
    • @​graphql-codegen/visitor-plugin-common@​6.2.0
    • @​graphql-codegen/plugin-helpers@​6.1.0

5.0.4

Patch Changes

  • Updated dependencies [51a1a72]:
    • @​graphql-codegen/visitor-plugin-common@​6.1.2

5.0.3

Patch Changes

... (truncated)

Commits
Maintainer changes

This version was pushed to npm by theguild-bot, a new releaser for @​graphql-codegen/typescript since your current version.


Updates @graphql-codegen/typescript-operations from 1.18.4 to 5.0.9

Changelog

Sourced from @​graphql-codegen/typescript-operations's changelog.

5.0.9

Patch Changes

5.0.8

Patch Changes

  • #10580 6038634 Thanks @​Georgegriff! - fixed invalid extracted concrete type name on shared interface

  • Updated dependencies [6038634]:

    • @​graphql-codegen/visitor-plugin-common@​6.2.3
    • @​graphql-codegen/typescript@​5.0.8

5.0.7

Patch Changes

  • Updated dependencies [f588d91]:
    • @​graphql-codegen/visitor-plugin-common@​6.2.2
    • @​graphql-codegen/typescript@​5.0.7

5.0.6

Patch Changes

  • Updated dependencies [b995ed1]:
    • @​graphql-codegen/visitor-plugin-common@​6.2.1
    • @​graphql-codegen/typescript@​5.0.6

5.0.5

Patch Changes

  • Updated dependencies [f821e8a, 9e70bcb]:
    • @​graphql-codegen/visitor-plugin-common@​6.2.0
    • @​graphql-codegen/plugin-helpers@​6.1.0
    • @​graphql-codegen/typescript@​5.0.5

5.0.4

Patch Changes

... (truncated)

Commits
  • 1691769 chore(release): update monorepo packages versions (#10027)
  • 61b6a94 Upcoming Release Changes (#10010)
  • 21fbf0d chore(release): update monorepo packages versions (#9947)
  • 83a586a chore(release): update monorepo packages versions (#9847)
  • 920b443 adding allowUndefinedQueryVariables option to typescript-operations plugin (#...
  • ed9c205 fix(typescript-operations): properly handle aliased conditionals (#9842)
  • 8c40cdf chore(release): update monorepo packages versions (#9846)
  • 56882d2 chore(release): update monorepo packages versions (#9837)
  • ebd0817 chore(release): update monorepo packages versions (#9819)
  • eaa3d60 chore(release): update monorepo packages versions (#9812)
  • Additional commits viewable in compare view
Maintainer changes

This version was pushed to npm by theguild-bot, a new releaser for @​graphql-codegen/typescript-operations since your current version.


Updates @graphql-codegen/urql-introspection from 1.3.1 to 4.0.0

Changelog

Sourced from @​graphql-codegen/urql-introspection's changelog.

4.0.0

Major Changes

Patch Changes

3.0.1

Patch Changes

3.0.0

Major Changes

Patch Changes

... (truncated)

Commits
Maintainer changes

This version was pushed to npm by [GitHub Actions](https://www.npmjs.com/~GitHub Actions), a new releaser for @​graphql-codegen/urql-introspection since your current version.

@dependabot dependabot bot added dependencies Pull requests that update a dependency file javascript Pull requests that update Javascript code labels Apr 8, 2026
@dependabot dependabot bot mentioned this pull request Apr 8, 2026
Closed
@dependabot
build(deps): bump lodash, @graphql-codegen/cli, @graphql-codegen/near…
17e913b 
…-operation-file-preset, @graphql-codegen/typed-document-node, @graphql-codegen/typescript, @graphql-codegen/typescript-operations and @graphql-codegen/urql-introspection

Bumps [lodash](https://github.com/lodash/lodash), [@graphql-codegen/cli](https://github.com/dotansimha/graphql-code-generator/tree/HEAD/packages/graphql-codegen-cli), [@graphql-codegen/near-operation-file-preset](https://github.com/dotansimha/graphql-code-generator-community/tree/HEAD/packages/presets/near-operation-file), [@graphql-codegen/typed-document-node](https://github.com/dotansimha/graphql-code-generator/tree/HEAD/packages/plugins/typescript/typed-document-node), [@graphql-codegen/typescript](https://github.com/dotansimha/graphql-code-generator/tree/HEAD/packages/plugins/typescript/typescript), [@graphql-codegen/typescript-operations](https://github.com/dotansimha/graphql-code-generator/tree/HEAD/packages/plugins/typescript/operations) and [@graphql-codegen/urql-introspection](https://github.com/dotansimha/graphql-code-generator-community/tree/HEAD/packages/plugins/other/urql-introspection). These dependencies needed to be updated together.

Updates `lodash` from 4.17.21 to 4.18.1
- [Release notes](https://github.com/lodash/lodash/releases)
- [Commits](lodash/lodash@4.17.21...4.18.1)

Updates `@graphql-codegen/cli` from 1.21.8 to 6.2.1
- [Release notes](https://github.com/dotansimha/graphql-code-generator/releases)
- [Changelog](https://github.com/dotansimha/graphql-code-generator/blob/master/packages/graphql-codegen-cli/CHANGELOG.md)
- [Commits](https://github.com/dotansimha/graphql-code-generator/commits/@graphql-codegen/cli@6.2.1/packages/graphql-codegen-cli)

Updates `@graphql-codegen/near-operation-file-preset` from 1.18.6 to 5.0.0
- [Release notes](https://github.com/dotansimha/graphql-code-generator-community/releases)
- [Changelog](https://github.com/dotansimha/graphql-code-generator-community/blob/main/packages/presets/near-operation-file/CHANGELOG.md)
- [Commits](https://github.com/dotansimha/graphql-code-generator-community/commits/@graphql-codegen/near-operation-file-preset@5.0.0/packages/presets/near-operation-file)

Updates `@graphql-codegen/typed-document-node` from 1.18.10 to 6.1.7
- [Release notes](https://github.com/dotansimha/graphql-code-generator/releases)
- [Changelog](https://github.com/dotansimha/graphql-code-generator/blob/master/packages/plugins/typescript/typed-document-node/CHANGELOG.md)
- [Commits](https://github.com/dotansimha/graphql-code-generator/commits/HEAD/packages/plugins/typescript/typed-document-node)

Updates `@graphql-codegen/typescript` from 1.23.0 to 5.0.9
- [Release notes](https://github.com/dotansimha/graphql-code-generator/releases)
- [Changelog](https://github.com/dotansimha/graphql-code-generator/blob/master/packages/plugins/typescript/typescript/CHANGELOG.md)
- [Commits](https://github.com/dotansimha/graphql-code-generator/commits/@graphql-codegen/typed-document-node@5.0.9/packages/plugins/typescript/typescript)

Updates `@graphql-codegen/typescript-operations` from 1.18.4 to 5.0.9
- [Release notes](https://github.com/dotansimha/graphql-code-generator/releases)
- [Changelog](https://github.com/dotansimha/graphql-code-generator/blob/master/packages/plugins/typescript/operations/CHANGELOG.md)
- [Commits](https://github.com/dotansimha/graphql-code-generator/commits/@graphql-codegen/typed-document-node@5.0.9/packages/plugins/typescript/operations)

Updates `@graphql-codegen/urql-introspection` from 1.3.1 to 4.0.0
- [Release notes](https://github.com/dotansimha/graphql-code-generator-community/releases)
- [Changelog](https://github.com/dotansimha/graphql-code-generator-community/blob/main/packages/plugins/other/urql-introspection/CHANGELOG.md)
- [Commits](https://github.com/dotansimha/graphql-code-generator-community/commits/@graphql-codegen/urql-introspection@4.0.0/packages/plugins/other/urql-introspection)

---
updated-dependencies:
- dependency-name: lodash
  dependency-version: 4.18.1
  dependency-type: direct:production
- dependency-name: "@graphql-codegen/cli"
  dependency-version: 6.2.1
  dependency-type: direct:development
- dependency-name: "@graphql-codegen/near-operation-file-preset"
  dependency-version: 5.0.0
  dependency-type: direct:development
- dependency-name: "@graphql-codegen/typed-document-node"
  dependency-version: 6.1.7
  dependency-type: direct:development
- dependency-name: "@graphql-codegen/typescript"
  dependency-version: 5.0.9
  dependency-type: direct:development
- dependency-name: "@graphql-codegen/typescript-operations"
  dependency-version: 5.0.9
  dependency-type: direct:development
- dependency-name: "@graphql-codegen/urql-introspection"
  dependency-version: 4.0.0
  dependency-type: direct:development
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot bot force-pushed the dependabot/npm_and_yarn/catalog/multi-da215c5b99 branch from 1216938 to 17e913b Compare April 9, 2026 10:28
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update Javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants