Skip to content

chore: upgrade lodash#836

Merged
Kikobeats merged 7 commits into
masterfrom
lodash
May 11, 2026
Merged

chore: upgrade lodash#836
Kikobeats merged 7 commits into
masterfrom
lodash

Conversation

@Kikobeats
Copy link
Copy Markdown
Member

@Kikobeats Kikobeats commented May 9, 2026

closes #835


Note

Medium Risk
Moderate risk due to a lodash version bump across multiple packages and a small API surface change in metascraper-telegram (injectable getIframe) that could affect scraping behavior if misused.

Overview
Upgrades lodash usage across several packages (including removing it where unused in metascraper-audio/metascraper-video, and bumping to ~4.18.0 in others).

Makes the test suite less flaky by skipping YouTube media-provider tests on CI, replacing several broad snapshots with targeted assertions (Instagram, manifest, multiple integration fixtures), and loosening logo checks to accept null or any valid http(s) URL.

Extends metascraper-telegram to accept an optional getIframe implementation (typed in index.d.ts and wired into memoization) and adjusts its tests to run fully offline via fixtures; also updates the package test script to run serially without worker threads.

Reviewed by Cursor Bugbot for commit c154283. Bugbot is set up for automated code reviews on this repo. Configure here.

Copy link
Copy Markdown

@cursor cursor Bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Cursor Bugbot has reviewed your changes and found 1 potential issue.

Fix All in Cursor

Bugbot Autofix prepared a fix for the issue found in the latest run.

  • ✅ Fixed: Upgrading unused lodash dependency in two packages
    • Removed unused lodash dependency from both metascraper-audio and metascraper-video package.json files as it was replaced with native loops in PR #811 but never cleaned up.

Create PR

Or push these changes by commenting:

@cursor push 3e8e96ec22
Preview (3e8e96ec22)
diff --git a/packages/metascraper-audio/package.json b/packages/metascraper-audio/package.json
--- a/packages/metascraper-audio/package.json
+++ b/packages/metascraper-audio/package.json
@@ -24,7 +24,6 @@
   ],
   "dependencies": {
     "@metascraper/helpers": "workspace:*",
-    "lodash": "~4.18.0",
     "p-reflect": "~2.1.0"
   },
   "devDependencies": {

diff --git a/packages/metascraper-video/package.json b/packages/metascraper-video/package.json
--- a/packages/metascraper-video/package.json
+++ b/packages/metascraper-video/package.json
@@ -24,7 +24,6 @@
   ],
   "dependencies": {
     "@metascraper/helpers": "workspace:*",
-    "lodash": "~4.18.0",
     "p-reflect": "~2.1.0"
   },
   "devDependencies": {

You can send follow-ups to the cloud agent here.

Reviewed by Cursor Bugbot for commit 33fe8a8. Configure here.

Comment thread packages/metascraper-audio/package.json Outdated
@coveralls
Copy link
Copy Markdown
Collaborator

Coverage Status

Coverage is 94.079%lodash into master. No base build found for master.

@Kikobeats Kikobeats merged commit 3995bea into master May 11, 2026
83 of 84 checks passed
@Kikobeats Kikobeats deleted the lodash branch May 11, 2026 05:37
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

[metascraper-logo-favicon] Vulnerable lodash version 4.17.23

2 participants