This PR contains the following updates:
Package Updates Summary
| Type | Count |
|---|---|
| 📦 NPM Packages | 3 |
| Total | 3 |
📦 npm Dependencies
3 packages will be updated
| Package | Change | Age | Adoption | Passing | Confidence |
|---|---|---|---|---|---|
| lodash (source) | 4.17.23 -> 4.18.1 | ||||
| bunfig (source) | 0.15.6 -> 0.15.8 | ||||
| vue (source) | 3.5.32 -> 3.5.33 |
Release Notes
lodash/lodash (lodash)
4.17.23 -> 4.18.1
4.18.1
Bugs
Fixes a ReferenceError issue in lodash lodash-es lodash-amd and lodash.template when using the template and fromPairs functions from the modular builds. See lodash/lodash#6167#issuecomment-4165269769
These defects were related to how lodash distributions are built from the main branch using https://github.com/lodash-archive/lodash-cli. When internal dependencies change inside lodash functions, equivalent updates need to be made to a mapping in the lodash-cli. (hey, it was ahead of its time once upon a time!). We know this, but we missed it in the last release. It's the kind of thing that passes in CI, but fails bc the build is not the same thing you tested.
There is no diff on main for this, but you can see the diffs for each of the npm packages on their respective branches:
lodash: https://github.com/lodash/lodash/compare/4.18.0-npm...4.18.1-npmlodash-es: https://github.com/lodash/lodash/compare/4.18.0-es...4.18.1-eslodash-amd: https://github....
[View full release notes]
Released by jonchurch on 4/1/2026
4.18.0
v4.18.0
Full Changelog: https://github.com/lodash/lodash/compare/4.17.23...4.18.0
Security
_.unset / _.omit: Fixed prototype pollution via constructor/prototype path traversal (GHSA-f23m-r3pf-42rh, fe8d32e). Previously, array-wrapped path segments and primitive roots could bypass the existing guards, allowing deletion of properties from built-in prototypes. Now constructor and prototype are blocked unconditionally as non-terminal path keys, matching baseSet. Calls that previously returned true and deleted the property now return false and leave the target untouched.
_.template: Fixed code injection via imports keys (GHSA-r5fr-rjxr-66jc, CVE-2026-4800, [879aaa9](https://github.com/lodash/lodash/commit/879aaa931...
[View full release notes]
Released by jonchurch on 3/31/2026
stacksjs/bunfig (bunfig)
0.15.6 -> 0.15.8
v0.15.8
Released by github-actions[bot] on 4/27/2026
v0.15.7
Released by github-actions[bot] on 4/27/2026
v0.9.0
🚀 Features
- Add deep env variable support - by chrisbbreuer <samp>(807d9)</samp>
View changes on GitHub
Released by github-actions[bot] on 5/14/2025
vuejs/core (vue)
3.5.32 -> 3.5.33
v3.5.33
For stable releases, please refer to CHANGELOG.md for details.
For pre-releases, please refer to CHANGELOG.md of the minor branch.
Released by github-actions[bot] on 4/22/2026
v3.6.0-beta.10
For stable releases, please refer to CHANGELOG.md for details.
For pre-releases, please refer to CHANGELOG.md of the minor branch.
Released by github-actions[bot] on 4/13/2026
v3.6.0-beta.9
For stable releases, please refer to CHANGELOG.md for details.
For pre-releases, please refer to CHANGELOG.md of the minor branch.
Released by github-actions[bot] on 3/26/2026
📊 Package Statistics
- lodash: 148,063,134 weekly downloads
- bunfig: 71,839 weekly downloads
- vue: 11,506,854 weekly downloads
Configuration
📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about these updates again.
- If you want to rebase/retry this PR, check this box
This PR was generated by Buddy 🤖