Skip to content

chore(deps): bump the production-dependencies group across 1 directory with 8 updates#1824

Open
dependabot[bot] wants to merge 1 commit intomasterfrom
dependabot/npm_and_yarn/production-dependencies-5ada9ab44c
Open

chore(deps): bump the production-dependencies group across 1 directory with 8 updates#1824
dependabot[bot] wants to merge 1 commit intomasterfrom
dependabot/npm_and_yarn/production-dependencies-5ada9ab44c

Conversation

@dependabot
Copy link
Copy Markdown
Contributor

@dependabot dependabot bot commented on behalf of github Apr 7, 2026 •
edited
Loading

Bumps the production-dependencies group with 8 updates in the / directory:

Package From To
@diplodoc/liquid 1.4.0 1.5.0
@diplodoc/translation 1.7.19 1.7.21
@inquirer/prompts 8.3.2 8.4.0
execa 9.6.0 9.6.1
js-yaml 4.1.0 4.1.1
katex 0.16.9 0.16.45
lodash 4.17.21 4.18.1
tapable 2.2.1 2.3.2

Updates @diplodoc/liquid from 1.4.0 to 1.5.0

Release notes

Sourced from @​diplodoc/liquid's releases.

v1.5.0

1.5.0 (2025-12-27)

Features

  • add unit tests to pre-commit hook and fix ESLint warnings (c1b956f)

Bug Fixes

  • add include-component-in-tag: false to release-please config (1da2fcc)
  • correct dependency installation for workspace mode (f78dda0)
  • remove invalid --no-warn-ignored flag from ESLint command (2681934)
  • remove package-name from release-please config (791d990)
  • replace lodash/cloneDeepWith with native implementation (b48d8e0)
  • resolve ESLint issues in cloneDeepWith and vitest.config.mjs (87aab8a)
  • resolve ESLint negated condition warning and vitest.config.mjs parsing (2c16df5)
  • resolve ESLint negated condition warning by inverting condition (7fa3893)
  • resolve ESLint warnings for negated conditions in cloneDeepWith (d2f16a2)
  • resolve prettier issue in lint-staged by passing filenames explicitly (d22a2a3)
  • update CI workflow for workspace compatibility (ecb7a43)
  • update lint-staged config to exclude config files from ESLint (64f6c78)
Changelog

Sourced from @​diplodoc/liquid's changelog.

1.5.0 (2025-12-27)

Features

  • add unit tests to pre-commit hook and fix ESLint warnings (c1b956f)

Bug Fixes

  • add include-component-in-tag: false to release-please config (1da2fcc)
  • correct dependency installation for workspace mode (f78dda0)
  • remove invalid --no-warn-ignored flag from ESLint command (2681934)
  • remove package-name from release-please config (791d990)
  • replace lodash/cloneDeepWith with native implementation (b48d8e0)
  • resolve ESLint issues in cloneDeepWith and vitest.config.mjs (87aab8a)
  • resolve ESLint negated condition warning and vitest.config.mjs parsing (2c16df5)
  • resolve ESLint negated condition warning by inverting condition (7fa3893)
  • resolve ESLint warnings for negated conditions in cloneDeepWith (d2f16a2)
  • resolve prettier issue in lint-staged by passing filenames explicitly (d22a2a3)
  • update CI workflow for workspace compatibility (ecb7a43)
  • update lint-staged config to exclude config files from ESLint (64f6c78)
Commits
  • 40a9a57 chore(master): release 1.5.0
  • 9d9d211 chore: update @​diplodoc/lint to 1.7.2
  • 1da2fcc fix: add include-component-in-tag: false to release-please config
  • 791d990 fix: remove package-name from release-please config
  • 0237498 chore: update @​diplodoc/lint to latest
  • 326ae67 chore: remove prerelease.yaml workflow
  • ee9d862 chore: remove duplicate ci.yml workflow
  • 9782325 chore: update workflows and release-please config from @​diplodoc/lint scaffol...
  • 342d663 chore: update @​diplodoc/lint to 1.7.0
  • 0032cd2 chore: update @​diplodoc/lint to latest version with --no-warn-ignored fix
  • Additional commits viewable in compare view

Updates @diplodoc/translation from 1.7.19 to 1.7.21

Release notes

Sourced from @​diplodoc/translation's releases.

v1.7.21

1.7.21 (2026-04-06)

Bug Fixes

v1.7.20

1.7.20 (2026-04-06)

Bug Fixes

  • img md attributes parsing (45e065b)
  • translation: add json-schema types for typecheck (64df582)
  • update hooks (2606585)
Changelog

Sourced from @​diplodoc/translation's changelog.

1.7.21 (2026-04-06)

Bug Fixes

1.7.20 (2026-04-06)

Bug Fixes

  • img md attributes parsing (45e065b)
  • translation: add json-schema types for typecheck (64df582)
  • update hooks (2606585)
Commits
  • eb51dc4 chore(master): release 1.7.21
  • a7f7601 fix: bump node
  • 4fbd3b0 chore(master): release 1.7.20
  • 2606585 fix: update hooks
  • 45e065b fix: img md attributes parsing
  • cd229d8 chore: Update readme badges
  • 74b5a3f chore: Update workflows
  • 64df582 fix(translation): add json-schema types for typecheck
  • d8e41af chore(translation): align infrastructure and migrate tests to Vitest
  • 67f4ef6 chore: Update infra
  • Additional commits viewable in compare view
Maintainer changes

This version was pushed to npm by [GitHub Actions](https://www.npmjs.com/~GitHub Actions), a new releaser for @​diplodoc/translation since your current version.


Updates @inquirer/prompts from 8.3.2 to 8.4.0

Release notes

Sourced from @​inquirer/prompts's releases.

@​inquirer/prompts@​8.4.0

  • Feat: Added a loading message while validating editor prompt input.
  • Type improvement: Better type inference with checkbox, search and expand prompts.
  • Fix: editor prompt not always properly handling editor path on windows.
Commits
  • e68fe01 chore: Publish new release
  • d05d285 chore: Bump remaining dependencies
  • 1ea1abf chore(deps-dev): Bump turbo from 2.8.21 to 2.9.4 in the build group (#2074)
  • 7caa3b3 chore(deps-dev): Bump the linting group with 3 updates (#2073)
  • e7e0a9f feat(lint): adopt oxlint type-aware linting
  • 3e26b49 fix(@​inquirer/checkbox,search,expand): fix Value type inference (#2072)
  • 5142a9b chore(deps): Bump vite from 8.0.3 to 8.0.5 (#2071)
  • b78ac38 refactor(@​inquirer/external-editor): modernize code style and Promise-based A...
  • 970814e chore(deps-dev): Bump the build group with 3 updates (#2069)
  • ade51c4 chore(deps-dev): Bump @​types/node in the types group (#2070)
  • Additional commits viewable in compare view

Updates execa from 9.6.0 to 9.6.1

Release notes

Sourced from execa's releases.

v9.6.1

  • Fix VerboseOption type not being properly exported (#1215) 7891c39

sindresorhus/execa@v9.6.0...v9.6.1

Commits

Updates js-yaml from 4.1.0 to 4.1.1

Changelog

Sourced from js-yaml's changelog.

[4.1.1] - 2025-11-12

Security

  • Fix prototype pollution issue in yaml merge (<<) operator.
Commits

Updates katex from 0.16.9 to 0.16.45

Release notes

Sourced from katex's releases.

v0.16.45

0.16.45 (2026-04-05)

Bug Fixes

v0.16.44

0.16.44 (2026-03-27)

Bug Fixes

  • remove extra \jot space at bottom of align/gather/etc. (#4184) (3870ee9)

v0.16.43

0.16.43 (2026-03-26)

Bug Fixes

  • use makeEm() consistently to truncate long CSS decimals (#4181) (0967dcc)

v0.16.42

0.16.42 (2026-03-24)

Features

v0.16.41

0.16.41 (2026-03-24)

Bug Fixes

v0.16.40

0.16.40 (2026-03-20)

Bug Fixes

  • css: specify position: relative for .katex (#4170) (020f0d8)

v0.16.39

0.16.39 (2026-03-19)

... (truncated)

Changelog

Sourced from katex's changelog.

0.16.45 (2026-04-05)

Bug Fixes

0.16.44 (2026-03-27)

Bug Fixes

  • remove extra \jot space at bottom of align/gather/etc. (#4184) (3870ee9)

0.16.43 (2026-03-26)

Bug Fixes

  • use makeEm() consistently to truncate long CSS decimals (#4181) (0967dcc)

0.16.42 (2026-03-24)

Features

0.16.41 (2026-03-24)

Bug Fixes

0.16.40 (2026-03-20)

Bug Fixes

  • css: specify position: relative for .katex (#4170) (020f0d8)

0.16.39 (2026-03-19)

Bug Fixes

0.16.38 (2026-03-08)

... (truncated)

Commits
  • 90de979 chore(release): 0.16.45 [ci skip]
  • ee66b78 fix: wrap vcenter mpadded in mrow for valid MathML (#4193)
  • ed12205 refactor: move inline double brushs stroke to helper (#4194)
  • 434d4b8 chore(ci): upgrade to node 24 (#4189)
  • 844a324 chore(deps): bump codecov/codecov-action from 5 to 6 (#4188)
  • 5675226 chore(deps): bump actions/github-script from 7 to 8 (#4179)
  • 34ad75e chore(deps): bump actions/setup-node from 4 to 6 (#4180)
  • 2525c20 chore(deps): bump actions/upload-artifact from 4 to 7 (#4176)
  • 0b7006e chore(release): 0.16.44 [ci skip]
  • 3870ee9 fix: remove extra \jot space at bottom of align/gather/etc. (#4184)
  • Additional commits viewable in compare view

Updates lodash from 4.17.21 to 4.18.1

Release notes

Sourced from lodash's releases.

4.18.1

Bugs

Fixes a ReferenceError issue in lodash lodash-es lodash-amd and lodash.template when using the template and fromPairs functions from the modular builds. See lodash/lodash#6167

These defects were related to how lodash distributions are built from the main branch using https://github.com/lodash-archive/lodash-cli. When internal dependencies change inside lodash functions, equivalent updates need to be made to a mapping in the lodash-cli. (hey, it was ahead of its time once upon a time!). We know this, but we missed it in the last release. It's the kind of thing that passes in CI, but fails bc the build is not the same thing you tested.

There is no diff on main for this, but you can see the diffs for each of the npm packages on their respective branches:

4.18.0

v4.18.0

Full Changelog: lodash/lodash@4.17.23...4.18.0

Security

_.unset / _.omit: Fixed prototype pollution via constructor/prototype path traversal (GHSA-f23m-r3pf-42rh, fe8d32e). Previously, array-wrapped path segments and primitive roots could bypass the existing guards, allowing deletion of properties from built-in prototypes. Now constructor and prototype are blocked unconditionally as non-terminal path keys, matching baseSet. Calls that previously returned true and deleted the property now return false and leave the target untouched.

_.template: Fixed code injection via imports keys (GHSA-r5fr-rjxr-66jc, CVE-2026-4800, 879aaa9). Fixes an incomplete patch for CVE-2021-23337. The variable option was validated against reForbiddenIdentifierChars but importsKeys was left unguarded, allowing code injection via the same Function() constructor sink. imports keys containing forbidden identifier characters now throw "Invalid imports option passed into _.template".

Docs

  • Add security notice for _.template in threat model and API docs (#6099)
  • Document lower > upper behavior in _.random (#6115)
  • Fix quotes in _.compact jsdoc (#6090)

lodash.* modular packages

Diff

We have also regenerated and published a select number of the lodash.* modular packages.

These modular packages had fallen out of sync significantly from the minor/patch updates to lodash. Specifically, we have brought the following packages up to parity w/ the latest lodash release because they have had CVEs on them in the past:

Commits
  • cb0b9b9 release(patch): bump main to 4.18.1 (#6177)
  • 75535f5 chore: prune stale advisory refs (#6170)
  • 62e91bc docs: remove n_ Node.js < 6 REPL note from README (#6165)
  • 59be2de release(minor): bump to 4.18.0 (#6161)
  • af63457 fix: broken tests for _.template 879aaa9
  • 1073a76 fix: linting issues
  • 879aaa9 fix: validate imports keys in _.template
  • fe8d32e fix: block prototype pollution in baseUnset via constructor/prototype traversal
  • 18ba0a3 refactor(fromPairs): use baseAssignValue for consistent assignment (#6153)
  • b819080 ci: add dist sync validation workflow (#6137)
  • Additional commits viewable in compare view

Updates tapable from 2.2.1 to 2.3.2

Release notes

Sourced from tapable's releases.

v2.3.2

Patch Changes

v2.3.1

Patch Changes

v2.3.0

Features

  • [TYPES] Added TypedHookMap type.

v2.2.3

Fixes

  • Async hook catch an error when reject a falsy value
  • [typescript] Support to pass return type for waterfall hooks

v2.2.2

Developer Experience

  • add interceptors type to hook class
Changelog

Sourced from tapable's changelog.

2.3.2

Patch Changes

2.3.1

Patch Changes

Commits
Maintainer changes

This version was pushed to npm by [GitHub Actions](https://www.npmjs.com/~GitHub Actions), a new releaser for tapable since your current version.


Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot dependabot bot added the dependencies Pull requests that update a dependency file label Apr 7, 2026
@dependabot @github
Copy link
Copy Markdown
Contributor Author

dependabot bot commented on behalf of github Apr 7, 2026

Labels

The following labels could not be found: dependabot. Please create it before Dependabot can add it to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

@dependabot dependabot bot requested a review from a team as a code owner April 7, 2026 11:40
@dependabot dependabot bot requested review from reazy015 and removed request for a team April 7, 2026 11:40
@dependabot dependabot bot added the dependencies Pull requests that update a dependency file label Apr 7, 2026
@dependabot dependabot bot force-pushed the dependabot/npm_and_yarn/production-dependencies-5ada9ab44c branch 3 times, most recently from d60f6e6 to e0e6c3c Compare April 13, 2026 09:13
@dependabot dependabot bot force-pushed the dependabot/npm_and_yarn/production-dependencies-5ada9ab44c branch 2 times, most recently from 6a75a8a to a23660e Compare April 17, 2026 16:03
@dependabot
chore(deps): bump the production-dependencies group across 1 director…
1be62ef 
…y with 8 updates

Bumps the production-dependencies group with 8 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [@diplodoc/liquid](https://github.com/diplodoc-platform/liquid) | `1.4.0` | `1.5.0` |
| [@diplodoc/translation](https://github.com/diplodoc-platform/translation) | `1.7.19` | `1.7.21` |
| [@inquirer/prompts](https://github.com/SBoudrias/Inquirer.js) | `8.3.2` | `8.4.0` |
| [execa](https://github.com/sindresorhus/execa) | `9.6.0` | `9.6.1` |
| [js-yaml](https://github.com/nodeca/js-yaml) | `4.1.0` | `4.1.1` |
| [katex](https://github.com/KaTeX/KaTeX) | `0.16.9` | `0.16.45` |
| [lodash](https://github.com/lodash/lodash) | `4.17.21` | `4.18.1` |
| [tapable](https://github.com/webpack/tapable) | `2.2.1` | `2.3.2` |



Updates `@diplodoc/liquid` from 1.4.0 to 1.5.0
- [Release notes](https://github.com/diplodoc-platform/liquid/releases)
- [Changelog](https://github.com/diplodoc-platform/liquid/blob/master/CHANGELOG.md)
- [Commits](diplodoc-platform/liquid@v1.4.0...v1.5.0)

Updates `@diplodoc/translation` from 1.7.19 to 1.7.21
- [Release notes](https://github.com/diplodoc-platform/translation/releases)
- [Changelog](https://github.com/diplodoc-platform/translation/blob/master/CHANGELOG.md)
- [Commits](diplodoc-platform/translation@v1.7.19...v1.7.21)

Updates `@inquirer/prompts` from 8.3.2 to 8.4.0
- [Release notes](https://github.com/SBoudrias/Inquirer.js/releases)
- [Commits](https://github.com/SBoudrias/Inquirer.js/compare/@inquirer/prompts@8.3.2...@inquirer/prompts@8.4.0)

Updates `execa` from 9.6.0 to 9.6.1
- [Release notes](https://github.com/sindresorhus/execa/releases)
- [Commits](sindresorhus/execa@v9.6.0...v9.6.1)

Updates `js-yaml` from 4.1.0 to 4.1.1
- [Changelog](https://github.com/nodeca/js-yaml/blob/master/CHANGELOG.md)
- [Commits](nodeca/js-yaml@4.1.0...4.1.1)

Updates `katex` from 0.16.9 to 0.16.45
- [Release notes](https://github.com/KaTeX/KaTeX/releases)
- [Changelog](https://github.com/KaTeX/KaTeX/blob/main/CHANGELOG.md)
- [Commits](KaTeX/KaTeX@v0.16.9...v0.16.45)

Updates `lodash` from 4.17.21 to 4.18.1
- [Release notes](https://github.com/lodash/lodash/releases)
- [Commits](lodash/lodash@4.17.21...4.18.1)

Updates `tapable` from 2.2.1 to 2.3.2
- [Release notes](https://github.com/webpack/tapable/releases)
- [Changelog](https://github.com/webpack/tapable/blob/main/CHANGELOG.md)
- [Commits](webpack/tapable@v2.2.1...v2.3.2)

---
updated-dependencies:
- dependency-name: "@diplodoc/liquid"
  dependency-version: 1.5.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: "@diplodoc/translation"
  dependency-version: 1.7.21
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
- dependency-name: "@inquirer/prompts"
  dependency-version: 8.4.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: execa
  dependency-version: 9.6.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
- dependency-name: js-yaml
  dependency-version: 4.1.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
- dependency-name: katex
  dependency-version: 0.16.45
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
- dependency-name: lodash
  dependency-version: 4.18.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: tapable
  dependency-version: 2.3.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot bot force-pushed the dependabot/npm_and_yarn/production-dependencies-5ada9ab44c branch from a23660e to 1be62ef Compare April 17, 2026 17:43
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@reazy015 reazy015 Awaiting requested review from reazy015 reazy015 is a code owner automatically assigned from diplodoc-platform/team

At least 1 approving review is required to merge this pull request.

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants