Bump lodash and @trivago/prettier-plugin-sort-imports

[dependabot]

Bumps lodash to 4.18.1 and updates ancestor dependency @trivago/prettier-plugin-sort-imports. These dependencies need to be updated together.

Updates lodash from 4.17.21 to 4.18.1

Release notes

Sourced from lodash's releases.

4.18.1

Bugs

Fixes a ReferenceError issue in lodash lodash-es lodash-amd and lodash.template when using the template and fromPairs functions from the modular builds. See lodash/lodash#6167

These defects were related to how lodash distributions are built from the main branch using https://github.com/lodash-archive/lodash-cli. When internal dependencies change inside lodash functions, equivalent updates need to be made to a mapping in the lodash-cli. (hey, it was ahead of its time once upon a time!). We know this, but we missed it in the last release. It's the kind of thing that passes in CI, but fails bc the build is not the same thing you tested.

There is no diff on main for this, but you can see the diffs for each of the npm packages on their respective branches:

• lodash: lodash/lodash@4.18.0-npm...4.18.1-npm
• lodash-es: lodash/lodash@4.18.0-es...4.18.1-es
• lodash-amd: lodash/lodash@4.18.0-amd...4.18.1-amd
• lodash.templatelodash/lodash@4.18.0-npm-packages...4.18.1-npm-packages

4.18.0

v4.18.0

Full Changelog: lodash/lodash@4.17.23...4.18.0

Security

_.unset / _.omit: Fixed prototype pollution via constructor/prototype path traversal (GHSA-f23m-r3pf-42rh, fe8d32e). Previously, array-wrapped path segments and primitive roots could bypass the existing guards, allowing deletion of properties from built-in prototypes. Now constructor and prototype are blocked unconditionally as non-terminal path keys, matching baseSet. Calls that previously returned true and deleted the property now return false and leave the target untouched.

_.template: Fixed code injection via imports keys (GHSA-r5fr-rjxr-66jc, CVE-2026-4800, 879aaa9). Fixes an incomplete patch for CVE-2021-23337. The variable option was validated against reForbiddenIdentifierChars but importsKeys was left unguarded, allowing code injection via the same Function() constructor sink. imports keys containing forbidden identifier characters now throw "Invalid imports option passed into _.template".

Docs

• Add security notice for _.template in threat model and API docs (#6099)
• Document lower > upper behavior in _.random (#6115)
• Fix quotes in _.compact jsdoc (#6090)

lodash.* modular packages

Diff

We have also regenerated and published a select number of the lodash.* modular packages.

These modular packages had fallen out of sync significantly from the minor/patch updates to lodash. Specifically, we have brought the following packages up to parity w/ the latest lodash release because they have had CVEs on them in the past:

• lodash.orderby
• lodash.tonumber
• lodash.trim
• lodash.trimend
• lodash.sortedindexby
• lodash.zipobjectdeep
• lodash.unset
• lodash.omit
• lodash.template

Commits

• cb0b9b9 release(patch): bump main to 4.18.1 (#6177)
• 75535f5 chore: prune stale advisory refs (#6170)
• 62e91bc docs: remove n_ Node.js < 6 REPL note from README (#6165)
• 59be2de release(minor): bump to 4.18.0 (#6161)
• af63457 fix: broken tests for _.template 879aaa9
• 1073a76 fix: linting issues
• 879aaa9 fix: validate imports keys in _.template
• fe8d32e fix: block prototype pollution in baseUnset via constructor/prototype traversal
• 18ba0a3 refactor(fromPairs): use baseAssignValue for consistent assignment (#6153)
• b819080 ci: add dist sync validation workflow (#6137)
• Additional commits viewable in compare view

Updates @trivago/prettier-plugin-sort-imports from 2.0.4 to 6.0.2

Release notes

Sourced from @​trivago/prettier-plugin-sort-imports's releases.

v6.0.2

What's Changed

• Fix recognising mandatory prefix built-in imports by @​TomFryersMidsummer in trivago/prettier-plugin-sort-imports#389

New Contributors

• @​TomFryersMidsummer made their first contribution in trivago/prettier-plugin-sort-imports#389

Full Changelog: trivago/prettier-plugin-sort-imports@v6.0.1...v6.0.2

v6.0.1

What's Changed

• ignore eslint errors due to undefined export variables by @​vladislavarsenev in trivago/prettier-plugin-sort-imports#391

Full Changelog: trivago/prettier-plugin-sort-imports@v6.0.0...v6.0.1

v6.0.0

What's Changed

• Update packages and pin babel/types by @​byara in trivago/prettier-plugin-sort-imports#343
• V6 by @​byara and @​vladislavarsenev in trivago/prettier-plugin-sort-imports#385

Full Changelog: trivago/prettier-plugin-sort-imports@v5.2.2...v6.0.0

v5.2.2

Full Changelog: trivago/prettier-plugin-sort-imports@v5.2.1...v5.2.2

v5.2.1

What's Changed

• add svelte 5.x as peer dependency by @​werner-drklein in trivago/prettier-plugin-sort-imports#337

New Contributors

• @​werner-drklein made their first contribution in trivago/prettier-plugin-sort-imports#337

Full Changelog: trivago/prettier-plugin-sort-imports@v5.2.0...v5.2.1

v5.2.0

What's Changed

• fix type import ordering #331 by @​rsslldnphy
• Fix conditional import of prettier-plugin-svelte #332 by @​rsslldnphy

Full Changelog: trivago/prettier-plugin-sort-imports@v5.1.0...v5.2.0

v5.1.0

What's Changed

• Fix svelte packages being required all the time by @​byara in trivago/prettier-plugin-sort-imports#327

Full Changelog: trivago/prettier-plugin-sort-imports@v5.0.1...v5.1.0

... (truncated)

Changelog

Sourced from @​trivago/prettier-plugin-sort-imports's changelog.

6.0.2

Bug fixes

• Fix recognising mandatory prefix built-in imports #389 by @​TomFryersMidsummer - Fixed detection of Node.js built-in modules that are only accessible with the node: prefix (like node:test, node:sqlite) to be correctly recognized when using <BUILTIN_MODULES> placeholder

6.0.1

Bug fixes

• Fix Svelte export snippet parsing #390 - Fixed by adding support for new Svelte snippet syntax

6.0.0

Breaking Changes

• Switch to ESM #366 by @​RobbieTheWagner - The plugin now uses ES modules instead of CommonJS
• Require Node >= 20.x #367 by @​RobbieTheWagner - Drop support for Node.js versions below 20
• Switch to vitest #370 by @​RobbieTheWagner - Replaced Jest with Vitest for better ESM support

New features

• Ember.js gjs/gts support #377 by @​NullVoxPopuli and @​RobbieTheWagner - Add support for Ember.js gjs/gts file formats with namespace and named type imports
• <BUILTIN_MODULES> placeholder #381 by @​sdotson - Add support for sorting Node.js builtin modules to a specific position using <BUILTIN_MODULES> placeholder in importOrder
• <SEPARATOR> placeholder #339 - Add <SEPARATOR> keyword for fine-grained control over import group separation when importOrderSeparation is enabled
• Sort by length option #224 by @​KLewin23 - Add option to sort imports by import statement length
• importOrderExclude option #384 by @​RyderKishan - Add support for excluding specific files from import sorting using glob patterns
• Expand sort-imports-ignore detection #358 by @​ckwalsh - Improved detection of sort-imports-ignore comments throughout the file, not just at line 1

Performance improvements

• Improve removeNodesFromOriginalCode() performance #356 by @​ckwalsh - Replace RegExp logic with string slices for better performance

Refactoring

• Stop rerendering directives #357 by @​ckwalsh - Inject imports instead of re-rendering directives to better preserve whitespace and reduce formatting conflicts
• Stop ignoring exceptions in snapshot tests #355 by @​ckwalsh - Improve test reliability by properly handling exceptions

Chores

• Add pnpm install command to README #361 - Document pnpm installation option

5.2.2

• Update packages and pin babel/types #343 by @​byara

5.2.1

• add svelte 5.x as peer dependency #337 by @​werner-drklein

5.2.0

• fix type import ordering #331 by @​rsslldnphy
• Fix conditional import of prettier-plugin-svelte #332 by @​rsslldnphy

v5.1.0

• Fix svelte packages being required all the time #327 by @​byara

v5.0.1

• Clean up unwanted packages and unpin dependencies #322 by @​byara

... (truncated)

Commits

• d9c690f bump version. update changelog.
• 97214c3 Merge pull request #389 from TomFryersMidsummer/patch-1
• 7235355 Merge branch 'main' into patch-1
• 0c37c9d bump version
• 035e20a Merge pull request #391 from trivago/svelte-snippet-support
• d626e1b ignore eslint errors due to undefined export variables
• 0b1dc59 Fix recognising mandatory prefix built-in imports
• 4886319 6.0.0
• d9b0a89 Merge pull request #386 from trivago/chores
• e2d360f update lockfile
• Additional commits viewable in compare view

Install script changes

This version adds prepare script that runs during installation. Review the package contents before updating.

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.