chore(deps): update all non-major dependencies

4.17.23 -> 4.18.1

4.18.1

Compare Source

Bugs

Fixes a ReferenceError issue in lodash lodash-es lodash-amd and lodash.template when using the template and fromPairs functions from the modular builds. See lodash/lodash#6167#issuecomment-4165269769

These defects were related to how lodash distributions are built from the main branch using https://github.com/lodash-archive/lodash-cli. When internal dependencies change inside lodash functions, equivalent updates need to be made to a mapping in the lodash-cli. (hey, it was ahead of its time once upon a time!). We know this, but we missed it in the last release. It's the kind of thing that passes in CI, but fails bc the build is not the same thing you tested.

There is no diff on main for this, but you can see the diffs for each of the npm packages on their respective branches:

• lodash: https://github.com/lodash/lodash/compare/4.18.0-npm...4.18.1-npm
• lodash-es: https://github.com/lodash/lodash/compare/4.18.0-es...4.18.1-es
• lodash-amd: https://github....

[View full release notes]

Released by jonchurch on 4/1/2026

4.18.0

Compare Source

v4.18.0

Full Changelog: https://github.com/lodash/lodash/compare/4.17.23...4.18.0

Security

_.unset / _.omit: Fixed prototype pollution via constructor/prototype path traversal (GHSA-f23m-r3pf-42rh, fe8d32e). Previously, array-wrapped path segments and primitive roots could bypass the existing guards, allowing deletion of properties from built-in prototypes. Now constructor and prototype are blocked unconditionally as non-terminal path keys, matching baseSet. Calls that previously returned true and deleted the property now return false and leave the target untouched.

_.template: Fixed code injection via imports keys (GHSA-r5fr-rjxr-66jc, CVE-2026-4800, [879aaa9](https://github.com/lodash/lodash/commit/879aaa931...

[View full release notes]

Released by jonchurch on 3/31/2026

19.2.4 -> 19.2.5

v19.2.5

Compare Source

React Server Components

• Add more cycle protections (#36236 by eps1lon and unstubbable)

Released by eps1lon on 4/8/2026

eslint-plugin-react-hooks@5.0.0

Compare Source

This release only contains eslint-plugin-react-hooks. Notably, new violations and support for ESLint v9 were added.

eslint-plugin-react-hooks

• New Violations: Component names now need to start with an uppercase letter instead of a non-lowercase letter. This means _Button or _component are no longer valid. ([kassens](https://github.com/kassens)) in #25162 For example, in

  function _Component() {
    useState()
    ^^^^^^^^ A React Hook "useState" is called in function "_Component" which is neither a Component nor a custom React Hook function.
  }

  _Component should be renamed to Component.

• Add support for ESLint v9. ([eps1lon](https://github.com/eps1lon) in #28773)
• Consider dispatch from useActionState stable. ([eps1lon](https://github.com/eps1lon) in [#29665](`facebook/rea...

[View full release notes]

Released by eps1lon on 10/11/2024

19.2.4 -> 19.2.5

v19.2.5

Compare Source

React Server Components

• Add more cycle protections (#36236 by eps1lon and unstubbable)

Released by eps1lon on 4/8/2026

eslint-plugin-react-hooks@5.0.0

Compare Source

This release only contains eslint-plugin-react-hooks. Notably, new violations and support for ESLint v9 were added.

eslint-plugin-react-hooks

• New Violations: Component names now need to start with an uppercase letter instead of a non-lowercase letter. This means _Button or _component are no longer valid. ([kassens](https://github.com/kassens)) in #25162 For example, in

  function _Component() {
    useState()
    ^^^^^^^^ A React Hook "useState" is called in function "_Component" which is neither a Component nor a custom React Hook function.
  }

  _Component should be renamed to Component.

• Add support for ESLint v9. ([eps1lon](https://github.com/eps1lon) in #28773)
• Consider dispatch from useActionState stable. ([eps1lon](https://github.com/eps1lon) in [#29665](`facebook/rea...

[View full release notes]

Released by eps1lon on 10/11/2024

3.5.30 -> 3.5.32

v3.6.0-beta.10

Compare Source

For stable releases, please refer to CHANGELOG.md for details. For pre-releases, please refer to CHANGELOG.md of the minor branch.

Released by github-actions[bot] on 4/13/2026

v3.5.32

Compare Source

For stable releases, please refer to CHANGELOG.md for details. For pre-releases, please refer to CHANGELOG.md of the minor branch.

Released by github-actions[bot] on 4/3/2026

v3.6.0-beta.9

Compare Source

For stable releases, please refer to CHANGELOG.md for details. For pre-releases, please refer to CHANGELOG.md of the minor branch.

Released by github-actions[bot] on 3/26/2026