chore(deps): update all non-major dependencies

4.17.23 -> 4.18.1

4.18.1

Compare Source

Bugs

Fixes a ReferenceError issue in lodash lodash-es lodash-amd and lodash.template when using the template and fromPairs functions from the modular builds. See lodash/lodash#6167#issuecomment-4165269769

These defects were related to how lodash distributions are built from the main branch using https://github.com/lodash-archive/lodash-cli. When internal dependencies change inside lodash functions, equivalent updates need to be made to a mapping in the lodash-cli. (hey, it was ahead of its time once upon a time!). We know this, but we missed it in the last release. It's the kind of thing that passes in CI, but fails bc the build is not the same thing you tested.

There is no diff on main for this, but you can see the diffs for each of the npm packages on their respective branches:

• lodash: https://github.com/lodash/lodash/compare/4.18.0-npm...4.18.1-npm
• lodash-es: https://github.com/lodash/lodash/compare/4.18.0-es...4.18.1-es
• lodash-amd: https://github....

[View full release notes]

Released by jonchurch on 4/1/2026

4.18.0

Compare Source

v4.18.0

Full Changelog: https://github.com/lodash/lodash/compare/4.17.23...4.18.0

Security

_.unset / _.omit: Fixed prototype pollution via constructor/prototype path traversal (GHSA-f23m-r3pf-42rh, fe8d32e). Previously, array-wrapped path segments and primitive roots could bypass the existing guards, allowing deletion of properties from built-in prototypes. Now constructor and prototype are blocked unconditionally as non-terminal path keys, matching baseSet. Calls that previously returned true and deleted the property now return false and leave the target untouched.

_.template: Fixed code injection via imports keys (GHSA-r5fr-rjxr-66jc, CVE-2026-4800, [879aaa9](https://github.com/lodash/lodash/commit/879aaa931...

[View full release notes]

Released by jonchurch on 3/31/2026

19.2.4 -> 19.2.5

eslint-plugin-react-hooks@7.1.1

Compare Source

Note: 7.1.0 accidentally removed the component-hook-factories rule, causing errors for users who referenced it in their ESLint config. This is now fixed.

• Add deprecated no-op component-hook-factories rule for backwards compatibility. ([mofeiZ](https://github.com/mofeiZ) in #36307)

Released by mofeiZ on 4/17/2026

eslint-plugin-react-hooks@7.1.0

Compare Source

This release adds ESLint v10 support, improves performance by skipping compilation for non-React files, and includes compiler lint improvements including better set-state-in-effect detection, improved ref validation, and more helpful error reporting.

• Add ESLint v10 support. ([nicolo-ribaudo](https://github.com/nicolo-ribaudo) in #35720)
• Skip compilation for non-React files to improve performance. ([josephsavona](https://github.com/josephsavona) in #35589)
• Fix exhaustive deps bug with Flow type casting. ([jorge-cab](https://github.com/jorge-cab) in #35691)
• Fix useEffectEvent checks in component syntax. ([jbrown215](https://github.com/jbrown215) in #35041)
• Improved set-state-in-effect validation with fewer false negatives. ([[j...

[View full release notes]

Released by mofeiZ on 4/17/2026

v19.2.5

Compare Source

React Server Components

• Add more cycle protections (#36236 by eps1lon and unstubbable)

Released by eps1lon on 4/8/2026

19.2.4 -> 19.2.5

eslint-plugin-react-hooks@7.1.1

Compare Source

Note: 7.1.0 accidentally removed the component-hook-factories rule, causing errors for users who referenced it in their ESLint config. This is now fixed.

• Add deprecated no-op component-hook-factories rule for backwards compatibility. ([mofeiZ](https://github.com/mofeiZ) in #36307)

Released by mofeiZ on 4/17/2026

eslint-plugin-react-hooks@7.1.0

Compare Source

This release adds ESLint v10 support, improves performance by skipping compilation for non-React files, and includes compiler lint improvements including better set-state-in-effect detection, improved ref validation, and more helpful error reporting.

• Add ESLint v10 support. ([nicolo-ribaudo](https://github.com/nicolo-ribaudo) in #35720)
• Skip compilation for non-React files to improve performance. ([josephsavona](https://github.com/josephsavona) in #35589)
• Fix exhaustive deps bug with Flow type casting. ([jorge-cab](https://github.com/jorge-cab) in #35691)
• Fix useEffectEvent checks in component syntax. ([jbrown215](https://github.com/jbrown215) in #35041)
• Improved set-state-in-effect validation with fewer false negatives. ([[j...

[View full release notes]

Released by mofeiZ on 4/17/2026

v19.2.5

Compare Source

React Server Components

• Add more cycle protections (#36236 by eps1lon and unstubbable)

Released by eps1lon on 4/8/2026

3.5.30 -> 3.5.32

v3.6.0-beta.10

Compare Source

For stable releases, please refer to CHANGELOG.md for details. For pre-releases, please refer to CHANGELOG.md of the minor branch.

Released by github-actions[bot] on 4/13/2026

v3.5.32

Compare Source

For stable releases, please refer to CHANGELOG.md for details. For pre-releases, please refer to CHANGELOG.md of the minor branch.

Released by github-actions[bot] on 4/3/2026

v3.6.0-beta.9

Compare Source

For stable releases, please refer to CHANGELOG.md for details. For pre-releases, please refer to CHANGELOG.md of the minor branch.

Released by github-actions[bot] on 3/26/2026