This PR contains the following updates:
Package Updates Summary
| Type | Count |
|---|---|
| 📦 NPM Packages | 2 |
| Total | 2 |
📦 npm Dependencies
2 packages will be updated
| Package | Change | Age | Adoption | Passing | Confidence |
|---|---|---|---|---|---|
| lodash (source) | 4.17.23 -> 4.18.0 | ||||
| vue (source) | 3.5.30 -> 3.5.31 |
Release Notes
lodash/lodash (lodash)
4.17.23 -> 4.18.0
4.18.0
v4.18.0
Full Changelog: https://github.com/lodash/lodash/compare/4.17.23...4.18.0
Security
_.unset / _.omit: Fixed prototype pollution via constructor/prototype path traversal (GHSA-f23m-r3pf-42rh, fe8d32e). Previously, array-wrapped path segments and primitive roots could bypass the existing guards, allowing deletion of properties from built-in prototypes. Now constructor and prototype are blocked unconditionally as non-terminal path keys, matching baseSet. Calls that previously returned true and deleted the property now return false and leave the target untouched.
_.template: Fixed code injection via imports keys (GHSA-r5fr-rjxr-66jc, CVE-2026-4800, [879aaa9](https://github.com/lodash/lodash/commit/879aaa931...
[View full release notes]
Released by jonchurch on 3/31/2026
vuejs/core (vue)
3.5.30 -> 3.5.31
v3.6.0-beta.9
For stable releases, please refer to CHANGELOG.md for details.
For pre-releases, please refer to CHANGELOG.md of the minor branch.
Released by github-actions[bot] on 3/26/2026
v3.5.31
For stable releases, please refer to CHANGELOG.md for details.
For pre-releases, please refer to CHANGELOG.md of the minor branch.
Released by github-actions[bot] on 3/25/2026
v3.6.0-beta.8
For stable releases, please refer to CHANGELOG.md for details.
For pre-releases, please refer to CHANGELOG.md of the minor branch.
Released by github-actions[bot] on 3/16/2026
📊 Package Statistics
- lodash: 139,852,989 weekly downloads
- vue: 11,357,396 weekly downloads
Configuration
📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about these updates again.
- If you want to rebase/retry this PR, check this box
This PR was generated by Buddy 🤖