Skip to content

chore(deps): bump lodash, docusaurus-plugin-openapi-docs and docusaurus-theme-openapi-docs - #77

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/multi-c9329a57c7
Open

chore(deps): bump lodash, docusaurus-plugin-openapi-docs and docusaurus-theme-openapi-docs#77
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/multi-c9329a57c7

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Aug 13, 2026

Copy link
Copy Markdown
Contributor

Bumps lodash to 4.18.1 and updates ancestor dependencies lodash, docusaurus-plugin-openapi-docs and docusaurus-theme-openapi-docs. These dependencies need to be updated together.

Updates lodash from 4.17.23 to 4.18.1

Release notes

Sourced from lodash's releases.

4.18.1

Bugs

Fixes a ReferenceError issue in lodash lodash-es lodash-amd and lodash.template when using the template and fromPairs functions from the modular builds. See lodash/lodash#6167

These defects were related to how lodash distributions are built from the main branch using https://github.com/lodash-archive/lodash-cli. When internal dependencies change inside lodash functions, equivalent updates need to be made to a mapping in the lodash-cli. (hey, it was ahead of its time once upon a time!). We know this, but we missed it in the last release. It's the kind of thing that passes in CI, but fails bc the build is not the same thing you tested.

There is no diff on main for this, but you can see the diffs for each of the npm packages on their respective branches:

4.18.0

v4.18.0

Full Changelog: lodash/lodash@4.17.23...4.18.0

Security

_.unset / _.omit: Fixed prototype pollution via constructor/prototype path traversal (GHSA-f23m-r3pf-42rh, fe8d32e). Previously, array-wrapped path segments and primitive roots could bypass the existing guards, allowing deletion of properties from built-in prototypes. Now constructor and prototype are blocked unconditionally as non-terminal path keys, matching baseSet. Calls that previously returned true and deleted the property now return false and leave the target untouched.

_.template: Fixed code injection via imports keys (GHSA-r5fr-rjxr-66jc, CVE-2026-4800, 879aaa9). Fixes an incomplete patch for CVE-2021-23337. The variable option was validated against reForbiddenIdentifierChars but importsKeys was left unguarded, allowing code injection via the same Function() constructor sink. imports keys containing forbidden identifier characters now throw "Invalid imports option passed into _.template".

Docs

  • Add security notice for _.template in threat model and API docs (#6099)
  • Document lower > upper behavior in _.random (#6115)
  • Fix quotes in _.compact jsdoc (#6090)

lodash.* modular packages

Diff

We have also regenerated and published a select number of the lodash.* modular packages.

These modular packages had fallen out of sync significantly from the minor/patch updates to lodash. Specifically, we have brought the following packages up to parity w/ the latest lodash release because they have had CVEs on them in the past:

Commits
  • cb0b9b9 release(patch): bump main to 4.18.1 (#6177)
  • 75535f5 chore: prune stale advisory refs (#6170)
  • 62e91bc docs: remove n_ Node.js < 6 REPL note from README (#6165)
  • 59be2de release(minor): bump to 4.18.0 (#6161)
  • af63457 fix: broken tests for _.template 879aaa9
  • 1073a76 fix: linting issues
  • 879aaa9 fix: validate imports keys in _.template
  • fe8d32e fix: block prototype pollution in baseUnset via constructor/prototype traversal
  • 18ba0a3 refactor(fromPairs): use baseAssignValue for consistent assignment (#6153)
  • b819080 ci: add dist sync validation workflow (#6137)
  • Additional commits viewable in compare view

Updates docusaurus-plugin-openapi-docs from 4.7.1 to 5.2.0

Release notes

Sourced from docusaurus-plugin-openapi-docs's releases.

v5.2.0

5.2.0 (2026-08-11)

Minor release adding support for OpenAPI 3.2 hierarchical tags. You can now group the sidebar by tagParent via groupPathsBy, using the new tags[].parent field to build nested tag hierarchies. Also includes a theme fix that bundles code snippet language icons locally (no more external icon requests) and a batch of dependency updates.

🚀 New Feature

  • feat(plugin): support OpenAPI 3.2 hierarchical tags (tags[].parent) (#1603)

🐛 Bug Fix

  • fix(theme): bundle code snippet language icons locally (#1595)

🤖 Dependencies

  • chore(deps): bump the react group across 1 directory with 2 updates (#1590)
  • chore(deps): bump postman-collection from 5.3.0 to 5.3.1 (#1591)
  • chore(deps): bump fast-uri from 3.1.4 to 3.1.5 (#1594)
  • chore(deps): bump github/codeql-action/init from 4.37.2 to 4.37.3 (#1593)
  • chore(deps): bump github/codeql-action/analyze from 4.37.2 to 4.37.3 (#1592)
  • chore(deps): bump ip-address from 10.2.0 to 10.4.0 (#1589)
  • chore(deps): bump nx from 22.6.2 to 22.7.8 (#1587)
  • chore(deps): bump postcss from 8.5.13 to 8.5.25 (#1583)

v5.1.3

5.1.3 (2026-07-30)

Patch release with two schema-rendering bug fixes: operation pages no longer freeze the browser when a oneOf's branches each declare their own self-referential discriminator (surfaced on specs like PANW DLP Data Profiles), and additionalProperties now renders correctly inside discriminator map variants. Also includes a batch of dependency updates.

🐛 Bug Fix

  • fix(theme): prevent infinite recursion from self-referential discriminators (#1584)
  • fix(theme): handle additionalProperties in map variants (#1561)

🤖 Dependencies

  • chore(deps): bump react-hook-form from 7.81.0 to 7.82.0 (#1581)
  • chore(deps): bump github/codeql-action/analyze from 4.37.0 to 4.37.2 (#1579)
  • chore(deps): bump sass-loader from 16.0.8 to 17.0.0 (#1580)
  • chore(deps): bump actions/checkout from 7.0.0 to 7.0.1 (#1575)
  • chore(deps): bump github/codeql-action/init from 4.37.0 to 4.37.2 (#1582)
  • chore(deps): bump sass from 1.101.0 to 1.101.3 (#1577)
  • chore(deps): bump @docusaurus/* from 3.10.1 to 3.10.2 (#1574)
  • chore(deps): bump svgo from 3.3.3 to 3.3.4 (#1570)
  • chore(deps): bump body-parser from 1.20.4 to 1.20.6 (#1571)
  • chore(deps): bump immutable from 5.1.5 to 5.1.9 (#1572)
  • chore(deps): bump fast-uri from 3.1.2 to 3.1.4 (#1573)
  • chore(deps): bump github/codeql-action/init from 4.36.3 to 4.37.0 (#1564)
  • chore(deps): bump actions/setup-node from 6.4.0 to 7.0.0 (#1566)
  • chore(deps): bump react-hook-form from 7.79.0 to 7.81.0 (#1567)

... (truncated)

Changelog

Sourced from docusaurus-plugin-openapi-docs's changelog.

5.2.0 (2026-08-11)

Minor release adding support for OpenAPI 3.2 hierarchical tags. You can now group the sidebar by tagParent via groupPathsBy, using the new tags[].parent field to build nested tag hierarchies. Also includes a theme fix that bundles code snippet language icons locally (no more external icon requests) and a batch of dependency updates.

🚀 New Feature

  • feat(plugin): support OpenAPI 3.2 hierarchical tags (tags[].parent) (#1603)

🐛 Bug Fix

  • fix(theme): bundle code snippet language icons locally (#1595)

🤖 Dependencies

  • chore(deps): bump the react group across 1 directory with 2 updates (#1590)
  • chore(deps): bump postman-collection from 5.3.0 to 5.3.1 (#1591)
  • chore(deps): bump fast-uri from 3.1.4 to 3.1.5 (#1594)
  • chore(deps): bump github/codeql-action/init from 4.37.2 to 4.37.3 (#1593)
  • chore(deps): bump github/codeql-action/analyze from 4.37.2 to 4.37.3 (#1592)
  • chore(deps): bump ip-address from 10.2.0 to 10.4.0 (#1589)
  • chore(deps): bump nx from 22.6.2 to 22.7.8 (#1587)
  • chore(deps): bump postcss from 8.5.13 to 8.5.25 (#1583)

5.1.3 (2026-07-30)

Patch release with two schema-rendering bug fixes: operation pages no longer freeze the browser when a oneOf's branches each declare their own self-referential discriminator (surfaced on specs like PANW DLP Data Profiles), and additionalProperties now renders correctly inside discriminator map variants. Also includes a batch of dependency updates.

🐛 Bug Fix

  • fix(theme): prevent infinite recursion from self-referential discriminators (#1584)
  • fix(theme): handle additionalProperties in map variants (#1561)

🤖 Dependencies

  • chore(deps): bump react-hook-form from 7.81.0 to 7.82.0 (#1581)
  • chore(deps): bump github/codeql-action/analyze from 4.37.0 to 4.37.2 (#1579)
  • chore(deps): bump sass-loader from 16.0.8 to 17.0.0 (#1580)
  • chore(deps): bump actions/checkout from 7.0.0 to 7.0.1 (#1575)
  • chore(deps): bump github/codeql-action/init from 4.37.0 to 4.37.2 (#1582)
  • chore(deps): bump sass from 1.101.0 to 1.101.3 (#1577)
  • chore(deps): bump @docusaurus/* from 3.10.1 to 3.10.2 (#1574)
  • chore(deps): bump svgo from 3.3.3 to 3.3.4 (#1570)
  • chore(deps): bump body-parser from 1.20.4 to 1.20.6 (#1571)
  • chore(deps): bump immutable from 5.1.5 to 5.1.9 (#1572)
  • chore(deps): bump fast-uri from 3.1.2 to 3.1.4 (#1573)
  • chore(deps): bump github/codeql-action/init from 4.36.3 to 4.37.0 (#1564)
  • chore(deps): bump actions/setup-node from 6.4.0 to 7.0.0 (#1566)
  • chore(deps): bump react-hook-form from 7.79.0 to 7.81.0 (#1567)
  • chore(deps): bump @​redocly/openapi-core from 2.38.0 to 2.39.0 (#1568)
  • chore(deps): bump github/codeql-action/analyze from 4.36.3 to 4.37.0 (#1569)

... (truncated)

Commits
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for docusaurus-plugin-openapi-docs since your current version.


Updates docusaurus-theme-openapi-docs from 4.7.1 to 5.2.0

Release notes

Sourced from docusaurus-theme-openapi-docs's releases.

v5.2.0

5.2.0 (2026-08-11)

Minor release adding support for OpenAPI 3.2 hierarchical tags. You can now group the sidebar by tagParent via groupPathsBy, using the new tags[].parent field to build nested tag hierarchies. Also includes a theme fix that bundles code snippet language icons locally (no more external icon requests) and a batch of dependency updates.

🚀 New Feature

  • feat(plugin): support OpenAPI 3.2 hierarchical tags (tags[].parent) (#1603)

🐛 Bug Fix

  • fix(theme): bundle code snippet language icons locally (#1595)

🤖 Dependencies

  • chore(deps): bump the react group across 1 directory with 2 updates (#1590)
  • chore(deps): bump postman-collection from 5.3.0 to 5.3.1 (#1591)
  • chore(deps): bump fast-uri from 3.1.4 to 3.1.5 (#1594)
  • chore(deps): bump github/codeql-action/init from 4.37.2 to 4.37.3 (#1593)
  • chore(deps): bump github/codeql-action/analyze from 4.37.2 to 4.37.3 (#1592)
  • chore(deps): bump ip-address from 10.2.0 to 10.4.0 (#1589)
  • chore(deps): bump nx from 22.6.2 to 22.7.8 (#1587)
  • chore(deps): bump postcss from 8.5.13 to 8.5.25 (#1583)

v5.1.3

5.1.3 (2026-07-30)

Patch release with two schema-rendering bug fixes: operation pages no longer freeze the browser when a oneOf's branches each declare their own self-referential discriminator (surfaced on specs like PANW DLP Data Profiles), and additionalProperties now renders correctly inside discriminator map variants. Also includes a batch of dependency updates.

🐛 Bug Fix

  • fix(theme): prevent infinite recursion from self-referential discriminators (#1584)
  • fix(theme): handle additionalProperties in map variants (#1561)

🤖 Dependencies

  • chore(deps): bump react-hook-form from 7.81.0 to 7.82.0 (#1581)
  • chore(deps): bump github/codeql-action/analyze from 4.37.0 to 4.37.2 (#1579)
  • chore(deps): bump sass-loader from 16.0.8 to 17.0.0 (#1580)
  • chore(deps): bump actions/checkout from 7.0.0 to 7.0.1 (#1575)
  • chore(deps): bump github/codeql-action/init from 4.37.0 to 4.37.2 (#1582)
  • chore(deps): bump sass from 1.101.0 to 1.101.3 (#1577)
  • chore(deps): bump @docusaurus/* from 3.10.1 to 3.10.2 (#1574)
  • chore(deps): bump svgo from 3.3.3 to 3.3.4 (#1570)
  • chore(deps): bump body-parser from 1.20.4 to 1.20.6 (#1571)
  • chore(deps): bump immutable from 5.1.5 to 5.1.9 (#1572)
  • chore(deps): bump fast-uri from 3.1.2 to 3.1.4 (#1573)
  • chore(deps): bump github/codeql-action/init from 4.36.3 to 4.37.0 (#1564)
  • chore(deps): bump actions/setup-node from 6.4.0 to 7.0.0 (#1566)
  • chore(deps): bump react-hook-form from 7.79.0 to 7.81.0 (#1567)

... (truncated)

Changelog

Sourced from docusaurus-theme-openapi-docs's changelog.

5.2.0 (2026-08-11)

Minor release adding support for OpenAPI 3.2 hierarchical tags. You can now group the sidebar by tagParent via groupPathsBy, using the new tags[].parent field to build nested tag hierarchies. Also includes a theme fix that bundles code snippet language icons locally (no more external icon requests) and a batch of dependency updates.

🚀 New Feature

  • feat(plugin): support OpenAPI 3.2 hierarchical tags (tags[].parent) (#1603)

🐛 Bug Fix

  • fix(theme): bundle code snippet language icons locally (#1595)

🤖 Dependencies

  • chore(deps): bump the react group across 1 directory with 2 updates (#1590)
  • chore(deps): bump postman-collection from 5.3.0 to 5.3.1 (#1591)
  • chore(deps): bump fast-uri from 3.1.4 to 3.1.5 (#1594)
  • chore(deps): bump github/codeql-action/init from 4.37.2 to 4.37.3 (#1593)
  • chore(deps): bump github/codeql-action/analyze from 4.37.2 to 4.37.3 (#1592)
  • chore(deps): bump ip-address from 10.2.0 to 10.4.0 (#1589)
  • chore(deps): bump nx from 22.6.2 to 22.7.8 (#1587)
  • chore(deps): bump postcss from 8.5.13 to 8.5.25 (#1583)

5.1.3 (2026-07-30)

Patch release with two schema-rendering bug fixes: operation pages no longer freeze the browser when a oneOf's branches each declare their own self-referential discriminator (surfaced on specs like PANW DLP Data Profiles), and additionalProperties now renders correctly inside discriminator map variants. Also includes a batch of dependency updates.

🐛 Bug Fix

  • fix(theme): prevent infinite recursion from self-referential discriminators (#1584)
  • fix(theme): handle additionalProperties in map variants (#1561)

🤖 Dependencies

  • chore(deps): bump react-hook-form from 7.81.0 to 7.82.0 (#1581)
  • chore(deps): bump github/codeql-action/analyze from 4.37.0 to 4.37.2 (#1579)
  • chore(deps): bump sass-loader from 16.0.8 to 17.0.0 (#1580)
  • chore(deps): bump actions/checkout from 7.0.0 to 7.0.1 (#1575)
  • chore(deps): bump github/codeql-action/init from 4.37.0 to 4.37.2 (#1582)
  • chore(deps): bump sass from 1.101.0 to 1.101.3 (#1577)
  • chore(deps): bump @docusaurus/* from 3.10.1 to 3.10.2 (#1574)
  • chore(deps): bump svgo from 3.3.3 to 3.3.4 (#1570)
  • chore(deps): bump body-parser from 1.20.4 to 1.20.6 (#1571)
  • chore(deps): bump immutable from 5.1.5 to 5.1.9 (#1572)
  • chore(deps): bump fast-uri from 3.1.2 to 3.1.4 (#1573)
  • chore(deps): bump github/codeql-action/init from 4.36.3 to 4.37.0 (#1564)
  • chore(deps): bump actions/setup-node from 6.4.0 to 7.0.0 (#1566)
  • chore(deps): bump react-hook-form from 7.79.0 to 7.81.0 (#1567)
  • chore(deps): bump @​redocly/openapi-core from 2.38.0 to 2.39.0 (#1568)
  • chore(deps): bump github/codeql-action/analyze from 4.36.3 to 4.37.0 (#1569)

... (truncated)

Commits
  • 3fa7008 Prepare release v5.2.0 (#1604)
  • 12ce651 fix(theme): bundle code snippet language icons locally (#1595)
  • d5af4f2 Prepare release v5.1.3 (#1585)
  • 9c31060 fix(theme): prevent infinite recursion from self-referential discriminators (...
  • 587d9e7 chore(deps): bump sass-loader from 16.0.8 to 17.0.0 (#1580)
  • d6b33f9 Handle additionalProperties in map variants (#1561)
  • 8a6fbd4 chore(deps): bump pako from 2.1.0 to 3.0.1 (#1556)
  • c5e36fe Prepare release v5.1.2 (#1550)
  • 88c7ec7 fix(theme): stop duplicating branch properties in nested anyOf/oneOf renders ...
  • c2bc86d Prepare release v5.1.1 (#1547)
  • Additional commits viewable in compare view
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for docusaurus-theme-openapi-docs since your current version.


Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
    You can disable automated security fix PRs for this repo from the Security Alerts page.

…us-theme-openapi-docs

Bumps [lodash](https://github.com/lodash/lodash) to 4.18.1 and updates ancestor dependencies [lodash](https://github.com/lodash/lodash), [docusaurus-plugin-openapi-docs](https://github.com/PaloAltoNetworks/docusaurus-openapi-docs/tree/HEAD/packages/docusaurus-plugin-openapi-docs) and [docusaurus-theme-openapi-docs](https://github.com/PaloAltoNetworks/docusaurus-openapi-docs/tree/HEAD/packages/docusaurus-theme-openapi-docs). These dependencies need to be updated together.


Updates `lodash` from 4.17.23 to 4.18.1
- [Release notes](https://github.com/lodash/lodash/releases)
- [Commits](lodash/lodash@4.17.23...4.18.1)

Updates `docusaurus-plugin-openapi-docs` from 4.7.1 to 5.2.0
- [Release notes](https://github.com/PaloAltoNetworks/docusaurus-openapi-docs/releases)
- [Changelog](https://github.com/PaloAltoNetworks/docusaurus-openapi-docs/blob/main/CHANGELOG.md)
- [Commits](https://github.com/PaloAltoNetworks/docusaurus-openapi-docs/commits/v5.2.0/packages/docusaurus-plugin-openapi-docs)

Updates `docusaurus-theme-openapi-docs` from 4.7.1 to 5.2.0
- [Release notes](https://github.com/PaloAltoNetworks/docusaurus-openapi-docs/releases)
- [Changelog](https://github.com/PaloAltoNetworks/docusaurus-openapi-docs/blob/main/CHANGELOG.md)
- [Commits](https://github.com/PaloAltoNetworks/docusaurus-openapi-docs/commits/v5.2.0/packages/docusaurus-theme-openapi-docs)

---
updated-dependencies:
- dependency-name: lodash
  dependency-version: 4.18.1
  dependency-type: indirect
- dependency-name: docusaurus-plugin-openapi-docs
  dependency-version: 5.2.0
  dependency-type: direct:production
- dependency-name: docusaurus-theme-openapi-docs
  dependency-version: 5.2.0
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Aug 13, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants