Bump the npm_and_yarn group across 1 directory with 17 updates by dependabot[bot] · Pull Request #103 · qwd/Icons

dependabot · 2026-09-02T02:22:15Z

Bumps the npm_and_yarn group with 16 updates in the / directory:

Package	From	To
postcss	`8.5.4`	`8.5.26`
svgo	`3.3.2`	`3.3.5`
svgo	`2.8.0`	`2.8.4`
vnu-jar	`21.6.11`	`26.2.1`
@tootallnate/once	`2.0.0`	`2.0.1`
@xhmikosr/decompress	`10.0.1`	`10.2.2`
js-yaml	`4.1.1`	`4.3.2`
brace-expansion	`1.1.12`	`1.1.18`
brace-expansion	`2.0.2`	`2.1.4`
fast-uri	`3.0.6`	`3.1.6`
flatted	`3.3.3`	`3.4.4`
handlebars	`4.7.8`	`4.7.9`
ip-address	`9.0.5`	`10.7.0`
lodash	`4.17.21`	`4.18.1`
postcss-selector-parser	`6.1.2`	`6.1.4`
shell-quote	`1.8.3`	`1.10.0`
tar	`6.2.1`	`7.5.22`
undici	`7.10.0`	`7.29.0`

Updates postcss from 8.5.4 to 8.5.26

Release notes

Sourced from postcss's releases.

8.5.26

Fixed list.split() regression (by @lazerg).

Track symlinks in path protection in source map loading (by @drengir1).

8.5.25

Fixed 8.5.17 visitor regression.

Fixed list.split() for non-string values (by @amir-rezaei).

8.5.24

Preserve the BOM after the processing (by @hdimer).

8.5.23

Do not load source map without opts.from for security reasons.

8.5.22

Fixed custom property losing semicolon before a comment (by @sarathfrancis90).

8.5.21

Fixed childless at-rule losing semicolon before comment (by @sarathfrancis90).

Fixed docs (by @isker).

8.5.20

Fixed missing space if AtRule#params is set after (by @sarathfrancis90).

Fixed mixing AST error on warnings (by @MahinAnowar).

8.5.19

Fixed cleaning before for new nodes inserted to Root (by @MahinAnowar).

8.5.18

Restricted loading previous source maps file to the opts.from folder for security reasons (use unsafeMap: true to disable the check).

8.5.17

Fixed Maximum call stack size exceeded error.

Fixed Prototype hijacking for postcss.fromJSON().

Fixed Input#origin() for unmapped end position (by @chatman-media).

8.5.16

Fixed Input#origin() position (by @mizdra).

Fixed raws after rehydrating a JSON AST (by @sarathfrancis90).

Fixed putting parent-less node in nodes of new node (by @MahinAnowar).

Fixed computing offset in positionBy() (by @greymoth-jp).

Fixed rangeBy() on index: 0 (by @sarathfrancis90).

8.5.15

Fixed declaration parsing performance (by @homanp).

8.5.14

Fixed custom syntax regression (by @43081j).

8.5.13

... (truncated)

Changelog

Sourced from postcss's changelog.

8.5.26

Fixed list.split() regression (by @lazerg).

Track symlinks in path protection in source map loading (by @drengir1).

8.5.25

Fixed 8.5.17 visitor regression.

Fixed list.split() for non-string values (by @amir-rezaei).

8.5.24

Preserve the BOM after the processing (by @hdimer).

8.5.23

Do not load source map without opts.from for security reasons.

8.5.22

Fixed custom property losing semicolon before a comment (by @sarathfrancis90).

8.5.21

Fixed childless at-rule losing semicolon before comment (by @sarathfrancis90).

Fixed docs (by @isker).

8.5.20

Fixed missing space if AtRule#params is set after (by @sarathfrancis90).

Fixed mixing AST error on warnings (by @MahinAnowar).

8.5.19

Fixed cleaning before for new nodes inserted to Root (by @MahinAnowar).

8.5.18

Restricted loading previous source maps file to the opts.from folder for security reasons (use unsafeMap: true to disable the check).

8.5.17

Fixed Maximum call stack size exceeded error.

Fixed Prototype hijacking for postcss.fromJSON().

Fixed Input#origin() for unmapped end position (by @chatman-media).

8.5.16

Fixed Input#origin() position (by @mizdra).

Fixed raws after rehydrating a JSON AST (by @sarathfrancis90).

... (truncated)

Commits

07b2577 Release 8.5.26 version
47de6b9 Update CI
1493a83 Fix Rule#selectors losing the empty selector (#2129)
180db16 Typo
29e9e00 Resolve symlinks before the previous-source-map containment check (#2125)
3ba8f84 Update dependencies
87e72f6 Update lock file
caaeeb9 Upgrade nanoid to fix infinite loop on zero size (#2124)
3609b6f Explain how to type plugin options
fbad419 docs: show ESM and TypeScript plugin declaration (#2118)
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for postcss since your current version.

Updates svgo from 3.3.2 to 3.3.5

Release notes

Sourced from svgo's releases.

v3.3.5

What's Changed

Security

Backport the removeScriptElement hardening from SVGO v4 in #2269:

reject executable data: URLs and legacy vbscript: URLs

sanitize executable HTML inside <foreignObject> elements

handle namespace-prefixed SVG anchors and URL schemes containing ASCII tabs or newlines

This addresses GHSA-4vpr-x523-8j87 and GHSA-w27v-7q3p-w38r for the v3 release line.

Support

SVGO v3 is not officially supported; please consider upgrading to SVGO v4. This security fix has been backported, but there is no commitment to backport more complex changes in the future.

See the migration guide from v3 to v4.

v3.3.4

What's Changed

Security

removeScriptElement, remove JavaScript URIs case-insensitively and make <script> handling namespace aware. By @SethFalco

Support

SVGO v3 is not officially supported, please consider upgrading to SVGO v4 instead. We've backported this fix as there are security implications, but there is no commitment to do this for more complex changes in future.

Consider reading our Migration Guide from v3 to v4 which should ease the process.

v3.3.3

What's Changed

Dependencies

Migrates from our unsupported fork of sax (@trysound/sax) to the upstream version of sax (sax).

Bug Fixes

No longer throws error when encountering comments in DTD.

Metrics

Before and after of the browser bundle of each respective version:

v3.3.2 v3.3.3 Delta

svgo.browser.js 910.9 kB 912.9 kB ⬆️ 2 kB

... (truncated)

Commits

4380590 ci: configure v3 publish tag in package metadata (#2271)
4c84fe7 ci: publish v3 with npm trusted publishing (#2270)
994a9f0 fix(removeScriptElement): backport security hardening to v3 (#2269)
72a2388 Merge commit from fork
bbab162 deps: upgrade to sax v1.5.0
See full diff in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for svgo since your current version.

Updates svgo from 2.8.0 to 2.8.4

Release notes

Sourced from svgo's releases.

v3.3.5

What's Changed

Security

Backport the removeScriptElement hardening from SVGO v4 in #2269:

reject executable data: URLs and legacy vbscript: URLs

sanitize executable HTML inside <foreignObject> elements

handle namespace-prefixed SVG anchors and URL schemes containing ASCII tabs or newlines

This addresses GHSA-4vpr-x523-8j87 and GHSA-w27v-7q3p-w38r for the v3 release line.

Support

SVGO v3 is not officially supported; please consider upgrading to SVGO v4. This security fix has been backported, but there is no commitment to backport more complex changes in the future.

See the migration guide from v3 to v4.

v3.3.4

What's Changed

Security

removeScriptElement, remove JavaScript URIs case-insensitively and make <script> handling namespace aware. By @SethFalco

Support

SVGO v3 is not officially supported, please consider upgrading to SVGO v4 instead. We've backported this fix as there are security implications, but there is no commitment to do this for more complex changes in future.

Consider reading our Migration Guide from v3 to v4 which should ease the process.

v3.3.3

What's Changed

Dependencies

Migrates from our unsupported fork of sax (@trysound/sax) to the upstream version of sax (sax).

Bug Fixes

No longer throws error when encountering comments in DTD.

Metrics

Before and after of the browser bundle of each respective version:

v3.3.2 v3.3.3 Delta

svgo.browser.js 910.9 kB 912.9 kB ⬆️ 2 kB

... (truncated)

Commits

4380590 ci: configure v3 publish tag in package metadata (#2271)
4c84fe7 ci: publish v3 with npm trusted publishing (#2270)
994a9f0 fix(removeScriptElement): backport security hardening to v3 (#2269)
72a2388 Merge commit from fork
bbab162 deps: upgrade to sax v1.5.0
See full diff in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for svgo since your current version.

Updates vnu-jar from 21.6.11 to 26.2.1

Release notes

Sourced from vnu-jar's releases.

latest

[!IMPORTANT] The release named “latest” is “production-ready” and is the only release you want to use. This project no longer does “major” version-numbered releases. Release 20.6.30 (30 June 2020) was the final such release. For a changelog of the latest changes, see https://github.com/validator/validator/commits/latest/.

Commits

See full diff in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for vnu-jar since your current version.

Install script changes

This version adds postinstall script that runs during installation. Review the package contents before updating.

Updates @tootallnate/once from 2.0.0 to 2.0.1

Release notes

Sourced from @tootallnate/once's releases.

v2.0.1

Patch Changes

a1e5e2d: Fix promise hang when AbortSignal is aborted

Changelog

Sourced from @tootallnate/once's changelog.

2.0.1

Patch Changes

a1e5e2d: Fix promise hang when AbortSignal is aborted

Commits

bcbb21d ci: fix OIDC publishing — Node 24, npm latest, provenance
dc24387 Version Packages (2.x) (#12)
b8a6f80 CI: test all Node versions on Linux only
dabcc0f ci: drop EOL Node.js 14.x/16.x, add 22.x
b464efc Update CI: modern Node versions, fix macOS ARM64 compat
a1e5e2d Fix promise hang when AbortSignal is aborted
See full diff in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @tootallnate/once since your current version.

Updates @xhmikosr/decompress from 10.0.1 to 10.2.2

Release notes

Sourced from @xhmikosr/decompress's releases.

v10.2.2

Security

10.x backport of the 11.1.4 path-traversal fix (bypass of GHSA-mp2f-45pm-3cg9) - a symlink chain could write/read files outside the output directory, potentially leading to RCE.

Affected: <= 10.2.1

Resolve link/directory targets with realpath before the containment check

Re-validate created symlinks resolve inside the output dir (catches self-referential chains)

Refuse hardlinks that target a symlink

Write files with O_NOFOLLOW

Reject duplicate entry paths

Full changelog: XhmikosR/decompress@v10.2.1...v10.2.2

v10.2.1

Backport the v11.1.3 security fixes to v10.x:

Validate symlink and hardlink targets against the output directory

Replace the prefix-based containment check with path.relative, fixing a sibling-directory bypass

Strip setuid, setgid, and sticky bits from extracted files

Advisory: GHSA-mp2f-45pm-3cg9 (CVE-2026-53486)

Full Changelog: XhmikosR/decompress@v10.2.0...v10.2.1

v10.2.0

What's Changed

Replace make-dir with fs.mkdir by @XhmikosR in XhmikosR/decompress#2

Full Changelog: XhmikosR/decompress@v10.1.0...v10.2.0

Commits

a2449a9 10.2.2
ee68170 Reject duplicate entry paths
a90980e Write extracted files with O_NOFOLLOW
98b6196 Refuse hardlinks that target a symlink
5f4b2f6 Validate created symlinks resolve inside the output directory
f0bc108 Use realpath for containment checks (native for links, graceful-fs for dirs)
7363498 Reject unsafe entry paths during extraction
27e85a7 npm audit fix
742ab1a 10.2.1
9b6e12e npm audit fix
Additional commits viewable in compare view

Updates js-yaml from 4.1.1 to 4.3.2

Changelog

Sourced from js-yaml's changelog.

4.3.2 - 2026-08-26

Changed

[backport] Hard-limit merge sequence size to 100.

Security

[backport] Count empty mappings in merge sequences toward maxTotalMergeKeys to limit CPU usage, #797.

4.3.1 - 2026-07-31

Security

[backport] Remove quadratic complexity from !!omap duplicate key detection.

4.3.0 - 2026-06-27

Added

[backport] Added maxTotalMergeKeys (10000) loader option to limit the total number of keys processed by YAML merge (<<) across one load() / loadAll() call.

Fixed

Restore umd builds back to es5.

Removed

[backport] maxMergeSeqLength replaced with maxTotalMergeKeys for limiting YAML merge processing.

[4.2.0] - 2026-06-01

Added

Added docs/safety.md with notes about processing untrusted YAML.

Added maxDepth (100) loader option. Not a problem, but gives a better exception instead of RangeError on stack overflow.

Added maxMergeSeqLength (20) loader option. Not a problem after merge fix, but an additional restriction for safety.

Added sourcemaps to dist/ builds.

Changed

Stop resolving numbers with underscores as numeric scalars, #627.

Switched dev toolchains to Vite / neostandard.

Updated demo.

Reorganized tests.

dist/ files are no longer kept in the repository.

Fixed

Fix parsing of properties on the first implicit block mapping key, #62.

Fix trailing whitespace handling when folding flow scalar lines, #307.

Reject top-level block scalars without content indentation, #280.

Ensure numbers survive round-trip, #737.

Fix test coverage for issue #221.

Fix flow scalar trailing whitespace folding, #307.

... (truncated)

Commits

79ca68d 4.3.2 released
d90b661 Backport merge limits from v5.4.1
86e91b8 4.3.1 released
c3cc4b0 Backport quadratic complexity fix for !!omap
33d05b5 4.3.0 released
663bfab Drop demo publish, to not override new v5 one.
1cb8c7b Add v4-legacy tag for publish
02f27af Restore umd builds back to es5
8be84ed Fix es5 compatibility
59423c6 Replace maxMergeSeqLength option with maxTotalMergeKeys (more robust). Ba...
Additional commits viewable in compare view

Updates brace-expansion from 1.1.12 to 1.1.18

Release notes

Sourced from brace-expansion's releases.

v1.1.15

Backport v5.0.6 change to v1 (#111) 0b09384

juliangruber/brace-expansion@v1.1.14...v1.1.15

Commits

758fcd6 1.1.18
27fbeed Merge commit from fork
5c57cc2 1.1.17
d757f1d npm ignore .claude
cb4b9e4 fix: backport GHSA-mh99-v99m-4gvg (#129)
447763a 1.1.16
d74e630 fix: v1 backport for CVE-2026-13149 (#122)
2203f4f 1.1.15
0b09384 Backport v5.0.6 change to v1 (#111)
10c05fc 1.1.14
Additional commits viewable in compare view

Updates brace-expansion from 2.0.2 to 2.1.4

Release notes

Sourced from brace-expansion's releases.

v1.1.15

Backport v5.0.6 change to v1 (#111) 0b09384

juliangruber/brace-expansion@v1.1.14...v1.1.15

Commits

758fcd6 1.1.18
27fbeed Merge commit from fork
5c57cc2 1.1.17
d757f1d npm ignore .claude
cb4b9e4 fix: backport GHSA-mh99-v99m-4gvg (#129)
447763a 1.1.16
d74e630 fix: v1 backport for CVE-2026-13149 (#122)
2203f4f 1.1.15
0b09384 Backport v5.0.6 change to v1 (#111)
10c05fc 1.1.14
Additional commits viewable in compare view

Updates fast-uri from 3.0.6 to 3.1.6

Release notes

Sourced from fast-uri's releases.

v3.1.6

⚠️ Security Warning

This release addresses the following high-severity security advisories:

GHSA-5jgf-p345-68v8 — host confusion via skipped IDN canonicalization on scheme-relative references

GHSA-fph4-wmhf-6fwf — server-side request forgery via repeated hostname percent-decoding

GHSA-f65p-4m7j-42xc — server-side request forgery via malformed IPv6 normalization

GHSA-jqff-g426-hqxp — host confusion via percent-encoded scheme normalization

Users of the v3.x release line should upgrade to v3.1.6.

Full Changelog: fastify/fast-uri@v3.1.5...v3.1.6

v3.1.5

⚠️ Security Warning

Fix for GHSA-7p8r-x3mc-p8w7

Full Changelog: fastify/fast-uri@v3.1.4...v3.1.5

v3.1.4

⚠️ Security Release

Fix for GHSA-v2hh-gcrm-f6hx

Full Changelog: fastify/fast-uri@v3.1.3...v3.1.4

v3.1.3

⚠️ Security Release

Fixes: GHSA-4c8g-83qw-93j6

Full Changelog: fastify/fast-uri@v3.1.2...v3.1.3

v3.1.2

⚠️ Security Release

Fix for GHSA-v39h-62p7-jpjc

What's Changed

Handle malformed fragment decoding as a parse error by @mcollina in fastify/fast-uri#171

Full Changelog: fastify/fast-uri@v3.1.1...v3.1.2

v3.1.1

⚠️ Security Release

Fix for GHSA-q3j6-qgpj-74h6

... (truncated)

Commits

6f970b2 Bumped v3.1.6
d941579 fix: never run IDN canonicalization on bracketed IP literals
c0f0279 test: adapt decoded-scheme handler assertion to 3.x (no mailto scheme)
37f3417 Merge commit from fork
607bfbe Merge commit from fork
ae92a4c Merge commit from fork
444ecda Merge commit from fork
f1138cf fix: handle malformed URNs without throwing (#211)
4ebffaa fix: preserve malformed URN input (#210)
0819d5f fix: preserve URI component case in equality (#207)
Additional commits viewable in compare view

Updates flatted from 3.3.3 to 3.4.4

Commits

e6f5ca7 3.4.4
47f14fa removed E_STRICT from PHP
4050568 fixced go-lang issues in CI
4303f4d Merge pull request #101 from mfinelli/gocriticfixes
106735b updated package-lock.json
670a1bd 3.4.3
50a61a9 Fix #104 - allow null as replacer value
8aa64f4 solved crytical errors over dependencies
b85577f Fix go-critic errors
bb8c63c Merge pull request #100 from WebReflection/WebReflection-patch-1
Additional commits viewable in compare view

Updates handlebars from 4.7.8 to 4.7.9

Release notes

Sourced from handlebars's releases.

v4.7.9

fix: enable shell mode for spawn to resolve Windows EINVAL issue - e0137c2

fix type "RuntimeOptions" also accepting string partials - eab1d14

feat(types): set hash to be a Record<string, any> - de4414d

fix non-contiguous program indices - 4512766

refactor: rename i to startPartIndex - e497a35

security: fix security issues - 68d8df5

GHSA-2w6w-674q-4c4q

GHSA-3mfm-83xf-c92r

GHSA-xhpv-hc6g-r9c6

GHSA-xjpj-3mr7-gcpf

GHSA-9cx6-37pm-9jff

GHSA-2qvq-rjwj-gvw9

GHSA-7rx3-28cr-v5wh

GHSA-442j-39wm-28r2

Commits

Changelog

Sourced from handlebars's changelog.

v4.7.9 - March 26th, 2026

fix: enable shell mode for spawn to resolve Windows EINVAL issue - e0137c2

fix type "RuntimeOptions" also accepting string partials - eab1d14

feat(types): set hash to be a Record<string, any> - de4414d

fix non-contiguous program indices - 4512766

refactor: rename i to startPartIndex - e497a35

security: fix security issues - 68d8df5

Commits

Commits

dce542c v4.7.9
8a41389 Update release notes
68d8df5 Fix security issues
b2a0831 Fix browser tests
9f98c16 Fix release script
45443b4 Revert "Improve partial indenting performance"
8841a5f Fix CI errors with linting
e0137c2 fix: enable shell mode for spawn to resolve Windows EINVAL issue
e914d60 Improve rendering performance
7de4b41 Upgrade GitHub Actions checkout and setup-node on 4.x branch
Additional commits viewable in compare view

Updates ip-address from 9.0.5 to 10.7.0

Release notes

Sourced from ip-address's releases.

v10.7.0

What's Changed

Add offset() and nextNetwork(), accept prefix-length ip6.arpa names, correct the IPv6 end-address docs by @beaugunderson in beaugunderson/ip-address#225

Full Changelog: beaugunderson/ip-address@v10.6.0...v10.7.0

v10.6.0

What's Changed

Add isGlobal() and pin the classifiers to the IANA special-purpose registries by @beaugunderson in beaugunderson/ip-address#224

Full Changelog: beaugunderson/ip-address@v10.5.1...v10.6.0

v10.5.1

Full Changelog: beaugunderson/ip-address@v10.5.0...v10.5.1

v10.5.0

What's Changed

Honor the fromURL graceful-failure contract for non-IPv6 hosts by @beaugunderson in beaugunderson/ip-address#218

Correct the documentation where it disagreed with the library by @beaugunderson in beaugunderson/ip-address#219

Full Changelog: beaugunderson/ip-address@v10.4.0...v10.5.0

v10.4.0

What's Changed

Add GitHub Actions CI by @beaugunderson in beaugunderson/ip-address#213

Keep the package loadable on node 12, and enforce it by @beaugunderson in beaugunderson/ip-address#216

Validate the byte arrays Address6 is given by @beaugunderson in beaugunderson/ip-address#217

Full Changelog: beaugunderson/ip-address@v10.3.1...v10.4.0

v10.3.1

Full Changelog: beaugunderson/ip-address@v10.3.0...v10.3.1

v10.3.0

Full Changelog: beaugunderson/ip-address@v10.2.2...v10.3.0

v10.2.2

Full Changelog: beaugunderson/ip-address@v10.2.1...v10.2.2

v10.2.1

Full Changelog: beaugunderson/ip-address@v10.2.0...v10.2.1

Commits

2b7cab5 10.7.0
87fae23 Add offset() and nextNetwork(), accept prefix-length ip6.arpa names, correct ...
42c1f8b 10.6.0
fb12583 Add isGlobal() and pin the classifiers to the IANA special-purpose registries...
38b02d7 10.5.1
d03e960 Merge commit from fork
ab3dc88 Merge commit from fork
ef98e0a 10.5.0
9fd1110 Correct the documentation where it disagreed with the library (#219)
d478737 Honor the fromURL graceful-failure contract for non-IPv6 hosts (#218)
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for ip-address since your current version.

Install script changes

This version adds prepare script that runs during installation. Review the package contents before updating.

Updates lodash from 4.17.21 to 4.18.1

Release notes

Sourced from lodash's releases.

4.18.1

Bugs

Fixes a ReferenceError issue in lodash lodash-es lodash-amd and lodash.template when using the template and fromPairs functions from the modular builds. See lodash/lodash#6167

These defects were related to how lodash distributions are built from the main branch using https://github.com/lodash-archive/lodash-cli. When internal dependencies change inside lodash functions, equivalent updates need to be made to a mapping in the lodash-cli. (hey, it was ahead of its time once upon a time!). We know this, but we missed it in the last release. It's the kind of thing that passes in CI, but fails bc the build is not the same thing you tested.

There is no diff on main for this, but you can see the diffs for each of the npm packages on their respective branches:

lodash: lodash/lodash@4.18.0-npm...4.18.1-npm

lodash-es: lodash/lodash@4.18.0-es...4.18.1-es

lodash-amd: lodash/lodash@4.18.0-amd...4.18.1-amd

lodash.templatelodash/lodash@4.18.0-npm-packages...4.18.1-npm-packages

4.18.0

v4.18.0

Full Changelog: lodash/lodash@4.17.23...4.18.0

Security

_.unset / _.omit: Fixed prototype pollution via constructor/prototype path traversal (GHSA-f23m-r3pf-42rh, fe8d32e). Previously, array-wrapped path segments and primitive roots could bypass the existing guards, allowing deletion of properties from built-in prototypes. Now constructor and prototype are blocked unconditionally as non-terminal path keys, matching baseSet. Calls that previously returned true and deleted the property now return false and leave the target untouched.

_.template: Fixed code injection via imports keys (GHSA-r5fr-rjxr-66jc, CVE-2026-4800, 879aaa9). Fixes an incomplete patch for CVE-2021-23337. The variable option was validated against reForbiddenIdentifierChars but importsKeys was left unguarded, allowing code injection via the same Function() constructor sink. imports keys containing forbidden identifier characters now throw "Invalid imports option passed into _.template".

Docs

Add security notice for _.template in threat model and API docs (#6099)

Document lower > upper behavior in _.random (#6115)

Fix quotes in _.compact jsdoc (#6090)

lodash.* modular packages

Diff

We have also regenerated and published a select number of the lodash.* modular packages.

These modular packages had fallen out of sync significantly from the minor/patch updates to lodash. Specifically, we have brought the following packages up to parity w/ the latest lodash release because they have had CVEs on them in the past:

lodash.orderby

lodash.tonumber

lodash.trim

lodash.trimend

lodash.sortedindexby

lodash.zipobjectdeep

lodash.unset

lodash.omit

lodash.template

Commits

cb0b9b9 release(patch): bump main to 4.18.1 (#6177)
75535f5 chore: prune stale advisory refs (#6170)
62e91bc docs: remove n_ Node.js < 6 REPL note from README (#6165)
59be2de release(minor): bump to 4.18.0 (#6161)
af63457 fix: broken tests for _.template 879aaa9
1073a76 fix: linting issues
879aaa9 fix: validate imports keys in _.template
fe8d32e fix: block prototype pollution in baseUnset via constructor/prototype traversal
18ba0a3 refactor(fromPairs): use baseAssignValue for consistent assignment (#6153)
b819080 ci: add dist sync validation workflow (#6137)
Additional commits viewable in compare view

Updates postcss-selector-parser from 6.1.2 to 6.1.4

Release notes

Sourced from postcss-selector-parser's releases.

6.1.4

fix: tolerate non-node children when serializing selectors

6.1.3

Fix CVE-2026-9358 (NVD) / SNYK-JS-POSTCSSSELECTORPARSER-16873882 via backport of (#316 by @MoOx)

Changelog

Sourced from postcss-selector-parser's changelog.

Changelog of postcss-selector-parser

7.1.5 - 2026-08-07

fix: don't treat a non-prefix token before | as a namespace (#324 by @spokodev)

fix: preserve whitespace before a * namespace in attribute selectors (#325 by @spokodev)

fix: TypeError on unclosed [, ( and trailing | (#330 by @theRizwan)

7.1.4 - 2026-06-11

fix: tolerate non-node children when serializing selectors

7.1.3 - 2026-06-11

Improve fix CVE-2026-9358 (NVD) / SNYK-JS-POSTCSSSELECTORPARSER-16873882 (clone/...
Description has been truncated

Bumps the npm_and_yarn group with 16 updates in the / directory: | Package | From | To | | --- | --- | --- | | [postcss](https://github.com/postcss/postcss) | `8.5.4` | `8.5.26` | | [svgo](https://github.com/svg/svgo) | `3.3.2` | `3.3.5` | | [svgo](https://github.com/svg/svgo) | `2.8.0` | `2.8.4` | | [vnu-jar](https://github.com/validator/validator) | `21.6.11` | `26.2.1` | | [@tootallnate/once](https://github.com/TooTallNate/once) | `2.0.0` | `2.0.1` | | [@xhmikosr/decompress](https://github.com/XhmikosR/decompress) | `10.0.1` | `10.2.2` | | [js-yaml](https://github.com/nodeca/js-yaml) | `4.1.1` | `4.3.2` | | [brace-expansion](https://github.com/juliangruber/brace-expansion) | `1.1.12` | `1.1.18` | | [brace-expansion](https://github.com/juliangruber/brace-expansion) | `2.0.2` | `2.1.4` | | [fast-uri](https://github.com/fastify/fast-uri) | `3.0.6` | `3.1.6` | | [flatted](https://github.com/WebReflection/flatted) | `3.3.3` | `3.4.4` | | [handlebars](https://github.com/handlebars-lang/handlebars.js) | `4.7.8` | `4.7.9` | | [ip-address](https://github.com/beaugunderson/ip-address) | `9.0.5` | `10.7.0` | | [lodash](https://github.com/lodash/lodash) | `4.17.21` | `4.18.1` | | [postcss-selector-parser](https://github.com/postcss/postcss-selector-parser) | `6.1.2` | `6.1.4` | | [shell-quote](https://github.com/ljharb/shell-quote) | `1.8.3` | `1.10.0` | | [tar](https://github.com/isaacs/node-tar) | `6.2.1` | `7.5.22` | | [undici](https://github.com/nodejs/undici) | `7.10.0` | `7.29.0` | Updates `postcss` from 8.5.4 to 8.5.26 - [Release notes](https://github.com/postcss/postcss/releases) - [Changelog](https://github.com/postcss/postcss/blob/main/CHANGELOG.md) - [Commits](postcss/postcss@8.5.4...8.5.26) Updates `svgo` from 3.3.2 to 3.3.5 - [Release notes](https://github.com/svg/svgo/releases) - [Commits](svg/svgo@v3.3.2...v3.3.5) Updates `svgo` from 2.8.0 to 2.8.4 - [Release notes](https://github.com/svg/svgo/releases) - [Commits](svg/svgo@v3.3.2...v3.3.5) Updates `vnu-jar` from 21.6.11 to 26.2.1 - [Release notes](https://github.com/validator/validator/releases) - [Commits](https://github.com/validator/validator/commits) Updates `@tootallnate/once` from 2.0.0 to 2.0.1 - [Release notes](https://github.com/TooTallNate/once/releases) - [Changelog](https://github.com/TooTallNate/once/blob/v2.0.1/CHANGELOG.md) - [Commits](TooTallNate/once@2.0.0...v2.0.1) Updates `@xhmikosr/decompress` from 10.0.1 to 10.2.2 - [Release notes](https://github.com/XhmikosR/decompress/releases) - [Commits](XhmikosR/decompress@v10.0.1...v10.2.2) Updates `js-yaml` from 4.1.1 to 4.3.2 - [Changelog](https://github.com/nodeca/js-yaml/blob/4.3.2/CHANGELOG.md) - [Commits](nodeca/js-yaml@4.1.1...4.3.2) Updates `brace-expansion` from 1.1.12 to 1.1.18 - [Release notes](https://github.com/juliangruber/brace-expansion/releases) - [Commits](juliangruber/brace-expansion@v1.1.12...v1.1.18) Updates `brace-expansion` from 2.0.2 to 2.1.4 - [Release notes](https://github.com/juliangruber/brace-expansion/releases) - [Commits](juliangruber/brace-expansion@v1.1.12...v1.1.18) Updates `fast-uri` from 3.0.6 to 3.1.6 - [Release notes](https://github.com/fastify/fast-uri/releases) - [Commits](fastify/fast-uri@v3.0.6...v3.1.6) Updates `flatted` from 3.3.3 to 3.4.4 - [Commits](WebReflection/flatted@v3.3.3...v3.4.4) Updates `handlebars` from 4.7.8 to 4.7.9 - [Release notes](https://github.com/handlebars-lang/handlebars.js/releases) - [Changelog](https://github.com/handlebars-lang/handlebars.js/blob/v4.7.9/release-notes.md) - [Commits](handlebars-lang/handlebars.js@v4.7.8...v4.7.9) Updates `ip-address` from 9.0.5 to 10.7.0 - [Release notes](https://github.com/beaugunderson/ip-address/releases) - [Commits](beaugunderson/ip-address@v9.0.5...v10.7.0) Updates `lodash` from 4.17.21 to 4.18.1 - [Release notes](https://github.com/lodash/lodash/releases) - [Commits](lodash/lodash@4.17.21...4.18.1) Updates `postcss-selector-parser` from 6.1.2 to 6.1.4 - [Release notes](https://github.com/postcss/postcss-selector-parser/releases) - [Changelog](https://github.com/postcss/postcss-selector-parser/blob/main/CHANGELOG.md) - [Commits](postcss/postcss-selector-parser@v6.1.2...6.1.4) Updates `shell-quote` from 1.8.3 to 1.10.0 - [Changelog](https://github.com/ljharb/shell-quote/blob/main/CHANGELOG.md) - [Commits](ljharb/shell-quote@v1.8.3...v1.10.0) Updates `tar` from 6.2.1 to 7.5.22 - [Release notes](https://github.com/isaacs/node-tar/releases) - [Changelog](https://github.com/isaacs/node-tar/blob/main/CHANGELOG.md) - [Commits](isaacs/node-tar@v6.2.1...v7.5.22) Updates `undici` from 7.10.0 to 7.29.0 - [Release notes](https://github.com/nodejs/undici/releases) - [Commits](nodejs/undici@v7.10.0...v7.29.0) Updates `yauzl` from 3.2.0 to 3.4.0 - [Commits](thejoshwolfe/yauzl@3.2.0...3.4.0) --- updated-dependencies: - dependency-name: postcss dependency-version: 8.5.26 dependency-type: direct:development dependency-group: npm_and_yarn - dependency-name: svgo dependency-version: 3.3.5 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: svgo dependency-version: 2.8.4 dependency-type: direct:development dependency-group: npm_and_yarn - dependency-name: vnu-jar dependency-version: 26.2.1 dependency-type: direct:development dependency-group: npm_and_yarn - dependency-name: "@tootallnate/once" dependency-version: 2.0.1 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: "@xhmikosr/decompress" dependency-version: 10.2.2 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: js-yaml dependency-version: 4.3.2 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: brace-expansion dependency-version: 1.1.18 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: brace-expansion dependency-version: 2.1.4 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: fast-uri dependency-version: 3.1.6 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: flatted dependency-version: 3.4.4 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: handlebars dependency-version: 4.7.9 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: ip-address dependency-version: 10.7.0 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: lodash dependency-version: 4.18.1 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: postcss-selector-parser dependency-version: 6.1.4 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: shell-quote dependency-version: 1.10.0 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: tar dependency-version: 7.5.22 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: undici dependency-version: 7.29.0 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: yauzl dependency-version: 3.4.0 dependency-type: indirect dependency-group: npm_and_yarn ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Sep 2, 2026

Navigation Menu

Uh oh!

Bump the npm_and_yarn group across 1 directory with 17 updates - #103

Bump the npm_and_yarn group across 1 directory with 17 updates#103
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/npm_and_yarn-142ceea12b

dependabot Bot commented on behalf of github Sep 2, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Uh oh!

Conversation

dependabot Bot commented on behalf of github Sep 2, 2026

8.5.26

8.5.25

8.5.24

8.5.23

8.5.22

8.5.21

8.5.20

8.5.19

8.5.18

8.5.17

8.5.16

8.5.15

8.5.14

8.5.13

8.5.26

8.5.25

8.5.24

8.5.23

8.5.22

8.5.21

8.5.20

8.5.19

8.5.18

8.5.17

8.5.16

v3.3.5

What's Changed

Security

Support

v3.3.4

What's Changed

Security

Support

v3.3.3

What's Changed

Dependencies

Bug Fixes

Metrics

v3.3.5

What's Changed

Security

Support

v3.3.4

What's Changed

Security

Support

v3.3.3

What's Changed

Dependencies

Bug Fixes

Metrics

latest

v2.0.1

Patch Changes

2.0.1

Patch Changes

v10.2.2

Security

v10.2.1

v10.2.0

What's Changed

4.3.2 - 2026-08-26

Changed

Security

4.3.1 - 2026-07-31

Security

4.3.0 - 2026-06-27

Added

Fixed

Removed

[4.2.0] - 2026-06-01

Added

Changed

Fixed

v1.1.15

v1.1.15

v3.1.6

`lodash.*` modular packages

Changelog of `postcss-selector-parser`