chore(deps): bump the all-non-major-updates group with 10 updates

[dependabot]

Bumps the all-non-major-updates group with 10 updates:

Package	From	To
@getflywheel/local-components	17.8.0	17.8.2
graphql	15.10.1	15.10.3
lodash	4.17.21	4.18.1
xterm-addon-fit	0.5.0	0.8.0
@getflywheel/eslint-config-local	1.0.4	1.0.5
@getflywheel/local	9.2.5	9.2.9
@types/enzyme	3.10.18	3.10.19
@types/node	22.18.1	22.20.2
eslint-plugin-import	2.31.0	2.32.0
webpack	5.99.6	5.111.0

Updates @getflywheel/local-components from 17.8.0 to 17.8.2

Commits

• See full diff in compare view

Updates graphql from 15.10.1 to 15.10.3

Release notes

Sourced from graphql's releases.

v15.10.3 (2026-08-28)

Internal 🏠

• #4849 internal: backport release flow to 15.x.x (@​yaacovCR)

Committers: 1

• Yaacov Rydzinski (@​yaacovCR)

Commits

• 268ad9d chore(release): v15.10.3
• d64d087 internal: backport release flow to 15.x.x (#4849)
• 613d00b 15.10.2
• 96135e2 Backport #4631 (#4633)
• See full diff in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for graphql since your current version.

Updates lodash from 4.17.21 to 4.18.1

Release notes

Sourced from lodash's releases.

4.18.1

Bugs

Fixes a ReferenceError issue in lodash lodash-es lodash-amd and lodash.template when using the template and fromPairs functions from the modular builds. See lodash/lodash#6167

These defects were related to how lodash distributions are built from the main branch using https://github.com/lodash-archive/lodash-cli. When internal dependencies change inside lodash functions, equivalent updates need to be made to a mapping in the lodash-cli. (hey, it was ahead of its time once upon a time!). We know this, but we missed it in the last release. It's the kind of thing that passes in CI, but fails bc the build is not the same thing you tested.

There is no diff on main for this, but you can see the diffs for each of the npm packages on their respective branches:

• lodash: lodash/lodash@4.18.0-npm...4.18.1-npm
• lodash-es: lodash/lodash@4.18.0-es...4.18.1-es
• lodash-amd: lodash/lodash@4.18.0-amd...4.18.1-amd
• lodash.templatelodash/lodash@4.18.0-npm-packages...4.18.1-npm-packages

4.18.0

v4.18.0

Full Changelog: lodash/lodash@4.17.23...4.18.0

Security

_.unset / _.omit: Fixed prototype pollution via constructor/prototype path traversal (GHSA-f23m-r3pf-42rh, fe8d32e). Previously, array-wrapped path segments and primitive roots could bypass the existing guards, allowing deletion of properties from built-in prototypes. Now constructor and prototype are blocked unconditionally as non-terminal path keys, matching baseSet. Calls that previously returned true and deleted the property now return false and leave the target untouched.

_.template: Fixed code injection via imports keys (GHSA-r5fr-rjxr-66jc, CVE-2026-4800, 879aaa9). Fixes an incomplete patch for CVE-2021-23337. The variable option was validated against reForbiddenIdentifierChars but importsKeys was left unguarded, allowing code injection via the same Function() constructor sink. imports keys containing forbidden identifier characters now throw "Invalid imports option passed into _.template".

Docs

• Add security notice for _.template in threat model and API docs (#6099)
• Document lower > upper behavior in _.random (#6115)
• Fix quotes in _.compact jsdoc (#6090)

lodash.* modular packages

Diff

We have also regenerated and published a select number of the lodash.* modular packages.

These modular packages had fallen out of sync significantly from the minor/patch updates to lodash. Specifically, we have brought the following packages up to parity w/ the latest lodash release because they have had CVEs on them in the past:

• lodash.orderby
• lodash.tonumber
• lodash.trim
• lodash.trimend
• lodash.sortedindexby
• lodash.zipobjectdeep
• lodash.unset
• lodash.omit
• lodash.template

Commits

• cb0b9b9 release(patch): bump main to 4.18.1 (#6177)
• 75535f5 chore: prune stale advisory refs (#6170)
• 62e91bc docs: remove n_ Node.js < 6 REPL note from README (#6165)
• 59be2de release(minor): bump to 4.18.0 (#6161)
• af63457 fix: broken tests for _.template 879aaa9
• 1073a76 fix: linting issues
• 879aaa9 fix: validate imports keys in _.template
• fe8d32e fix: block prototype pollution in baseUnset via constructor/prototype traversal
• 18ba0a3 refactor(fromPairs): use baseAssignValue for consistent assignment (#6153)
• b819080 ci: add dist sync validation workflow (#6137)
• Additional commits viewable in compare view

Updates xterm-addon-fit from 0.5.0 to 0.8.0

Commits

• 9bd2a1c Implemented the attach addon
• c7f4658 Add fullscreen mode plug in
• 96848a6 Improved textarea handling
• 0997f43 Proper event handling
• e278837 Fix focus on refresh
• See full diff in compare view

Updates @getflywheel/eslint-config-local from 1.0.4 to 1.0.5

Commits

• See full diff in compare view

Maintainer changes

This version was pushed to npm by ray.alovera.fw, a new releaser for @​getflywheel/eslint-config-local since your current version.

Updates @getflywheel/local from 9.2.5 to 9.2.9

Updates @types/enzyme from 3.10.18 to 3.10.19

Commits

• See full diff in compare view

Updates @types/node from 22.18.1 to 22.20.2

Commits

• See full diff in compare view

Updates eslint-plugin-import from 2.31.0 to 2.32.0

Release notes

Sourced from eslint-plugin-import's releases.

v2.32.0

Added

• add enforce-node-protocol-usage rule and import/node-version setting (#3024, thanks [@​GoldStrikeArch] and [@​sevenc-nanashi])
• add TypeScript types (#3097, thanks [@​G-Rath])
• extensions: add `pathGroupOverrides to allow enforcement decision overrides based on specifier (#3105, thanks [@​Xunnamius])
• [order]: add sortTypesGroup option to allow intragroup sorting of type-only imports (#3104, thanks [@​Xunnamius])
• [order]: add newlines-between-types option to control intragroup sorting of type-only imports (#3127, thanks [@​Xunnamius])
• [order]: add consolidateIslands option to collapse excess spacing for aesthetically pleasing imports (#3129, thanks [@​Xunnamius])

Fixed

• [no-unused-modules]: provide more meaningful error message when no .eslintrc is present (#3116, thanks [@​michaelfaith])
• configs: added missing name attribute for eslint config inspector (#3151, thanks [@​NishargShah])
• [order]: ensure arcane imports do not cause undefined behavior (#3128, thanks [@​Xunnamius])
• [order]: resolve undefined property access issue when using named ordering (#3166, thanks [@​Xunnamius])
• enforce-node-protocol-usage: avoid a crash with some TS code (#3173, thanks [@​ljharb])
• [order]: codify invariants from docs into config schema (#3152, thanks [@​Xunnamius])

Changed

• [Docs] extensions, [order]: improve documentation (#3106, thanks [@​Xunnamius])
• [Docs] add flat config guide for using tseslint.config() (#3125, thanks [@​lnuvy])
• [Docs] add missing comma (#3122, thanks [@​RyanGst])
• [readme] Update flatConfig example to include typescript config (#3138, thanks [@​intellix])
• [Refactor] [order]: remove unnecessary negative check (#3167, thanks [@​JounQin])
• [Docs] [no-unused-modules]: add missing double quote (#3191, thanks [@​albertpastrana])
• [Docs] no-restricted-paths: clarify wording and fix errors (#3172, thanks [@​greim])

... (truncated)

Changelog

Sourced from eslint-plugin-import's changelog.

[2.32.0] - 2025-06-20

Added

• add [enforce-node-protocol-usage] rule and import/node-version setting (#3024, thanks [@​GoldStrikeArch] and [@​sevenc-nanashi])
• add TypeScript types (#3097, thanks [@​G-Rath])
• [extensions]: add `pathGroupOverrides to allow enforcement decision overrides based on specifier (#3105, thanks [@​Xunnamius])
• [order]: add sortTypesGroup option to allow intragroup sorting of type-only imports (#3104, thanks [@​Xunnamius])
• [order]: add newlines-between-types option to control intragroup sorting of type-only imports (#3127, thanks [@​Xunnamius])
• [order]: add consolidateIslands option to collapse excess spacing for aesthetically pleasing imports (#3129, thanks [@​Xunnamius])

Fixed

• [no-unused-modules]: provide more meaningful error message when no .eslintrc is present (#3116, thanks [@​michaelfaith])
• configs: added missing name attribute for eslint config inspector (#3151, thanks [@​NishargShah])
• [order]: ensure arcane imports do not cause undefined behavior (#3128, thanks [@​Xunnamius])
• [order]: resolve undefined property access issue when using named ordering (#3166, thanks [@​Xunnamius])
• [enforce-node-protocol-usage]: avoid a crash with some TS code (#3173, thanks [@​ljharb])
• [order]: codify invariants from docs into config schema (#3152, thanks [@​Xunnamius])

Changed

• [Docs] [extensions], [order]: improve documentation (#3106, thanks [@​Xunnamius])
• [Docs] add flat config guide for using tseslint.config() (#3125, thanks [@​lnuvy])
• [Docs] add missing comma (#3122, thanks [@​RyanGst])
• [readme] Update flatConfig example to include typescript config (#3138, thanks [@​intellix])
• [Refactor] [order]: remove unnecessary negative check (#3167, thanks [@​JounQin])
• [Docs] [no-unused-modules]: add missing double quote (#3191, thanks [@​albertpastrana])
• [Docs] no-restricted-paths: clarify wording and fix errors (#3172, thanks [@​greim])

Commits

• 01c9eb0 v2.32.0
• ae57cc1 [Deps] update array-includes, array.prototype.findlastindex, `eslint-modu...
• 9e1ad6b [Fix] order: codify invariants from docs into config schema
• f017790 [Docs] no-restricted-paths: clarify wording and fix errors
• 7d83a57 [Docs] no-unused-modules: add missing double quote
• 519eb94 [utils] v2.12.1
• 71ad145 [actions] split out tests into new vs old eslint
• 9b096c4 [utils] [dev deps] update @arethetypeswrong/cli, @ljharb/tsconfig, `@type...
• da5f6ec [Fix] enforce-node-protocol-usage: avoid a crash with some TS code
• 6e49a58 [Refactor] order: remove unnecessary negative check
• Additional commits viewable in compare view

Updates webpack from 5.99.6 to 5.111.0

Release notes

Sourced from webpack's releases.

v5.111.0

Minor Changes

• Enable output.module by default with futureDefaults on ESM-capable targets. (by @​alexander-akait in #22088)

• Remove experiments.outputModule, set output.module to emit ESM instead. (by @​alexander-akait in #22011)

• Add output.copy to copy files and directories into the output directory. (by @​alexander-akait in #21938)

• Accept a file URL in any spelling Node reads where an absolute path is taken. (by @​alexander-akait in #22012)

• Minify inline CSS and JSON via renderEmbeddedSource, exporting webpack's own. (by @​alexander-akait in #21993)

• Export cssMinify and htmlMinify on css.syntax and html.syntax. (by @​alexander-akait in #21953)

• Make processResult async and let a tap rename the asset it rewrote. (by @​alexander-akait in #21854)

• Lower a CSS spelling a target cannot read and write a color fallback before one. (by @​alexander-akait in #21926)

• Allow optional filesystem cache build dependencies. (by @​xiaoxiaojx in #21849)

• Add output.environment.topLevelAwait and await every async ESM entry. (by @​alexander-akait in #21915)

• Add unusedSymbols and pseudoClasses, and evaluate a CSS color function. (by @​alexander-akait in #21927)

• Drop an implied shorthand slot, fold a math function, tighten color conversion. (by @​alexander-akait in #21929)

• Add module.parser.javascript.specNamespaceObject for spec namespace objects. (by @​alexander-akait in #22049)

• Drop what is already said or only a gone engine reads, add lowerUnsupported. (by @​alexander-akait in #21931)

• Add normalizeUrlAttributes, mergeScripts, boolean and token switches. (by @​alexander-akait in #21960)

• Minify an event handler attribute, and name the production each script body is. (by @​alexander-akait in #21968)

• Add source-map, asset, module, bailout, federation hints; group config checks. (by @​alexander-akait in #21961)

• Lower CSS nesting, :dir() and custom at-rules; gate case folding and escapes. (by @​alexander-akait in #21950)

• Add optimization.minimize.css.mergeDistantRules to join rules across a gap. (by @​alexander-akait in #21969)

Patch Changes

• Minify an embedded body through the embedded path, dropping three html options. (by @​alexander-akait in #21936)

• Take a minified style attribute's answer whatever quoting it needs. (by @​alexander-akait in #21936)

• Name chunk imports in the chunk loader, not at each import site. (by @​alexander-akait in #22076)

• Repair hashed names; under HMR bake hashed url maps and reload moved css names. (by @​alexander-akait in #21916)

... (truncated)

Changelog

Sourced from webpack's changelog.

5.111.0

Minor Changes

• Enable output.module by default with futureDefaults on ESM-capable targets. (by @​alexander-akait in #22088)

• Remove experiments.outputModule, set output.module to emit ESM instead. (by @​alexander-akait in #22011)

• Add output.copy to copy files and directories into the output directory. (by @​alexander-akait in #21938)

• Accept a file URL in any spelling Node reads where an absolute path is taken. (by @​alexander-akait in #22012)

• Minify inline CSS and JSON via renderEmbeddedSource, exporting webpack's own. (by @​alexander-akait in #21993)

• Export cssMinify and htmlMinify on css.syntax and html.syntax. (by @​alexander-akait in #21953)

• Make processResult async and let a tap rename the asset it rewrote. (by @​alexander-akait in #21854)

• Lower a CSS spelling a target cannot read and write a color fallback before one. (by @​alexander-akait in #21926)

• Allow optional filesystem cache build dependencies. (by @​xiaoxiaojx in #21849)

• Add output.environment.topLevelAwait and await every async ESM entry. (by @​alexander-akait in #21915)

• Add unusedSymbols and pseudoClasses, and evaluate a CSS color function. (by @​alexander-akait in #21927)

• Drop an implied shorthand slot, fold a math function, tighten color conversion. (by @​alexander-akait in #21929)

• Add module.parser.javascript.specNamespaceObject for spec namespace objects. (by @​alexander-akait in #22049)

• Drop what is already said or only a gone engine reads, add lowerUnsupported. (by @​alexander-akait in #21931)

• Add normalizeUrlAttributes, mergeScripts, boolean and token switches. (by @​alexander-akait in #21960)

• Minify an event handler attribute, and name the production each script body is. (by @​alexander-akait in #21968)

• Add source-map, asset, module, bailout, federation hints; group config checks. (by @​alexander-akait in #21961)

• Lower CSS nesting, :dir() and custom at-rules; gate case folding and escapes. (by @​alexander-akait in #21950)

• Add optimization.minimize.css.mergeDistantRules to join rules across a gap. (by @​alexander-akait in #21969)

Patch Changes

• Minify an embedded body through the embedded path, dropping three html options. (by @​alexander-akait in #21936)

• Take a minified style attribute's answer whatever quoting it needs. (by @​alexander-akait in #21936)

• Name chunk imports in the chunk loader, not at each import site. (by @​alexander-akait in #22076)

... (truncated)

Commits

• 9256118 chore(release): new release (#21914)
• 3ef9663 refactor: consolidate getter and value format of export fragment (#22100)
• aff7c4c perf: emit less chunk-loading runtime (#22094)
• e954b81 build(html): sweep the HTML printer for spelling-dependent output (#22097)
• da4ad13 fix(css): replace a @​value named in an at-rule prelude only once (#22036)
• df72840 perf(runtime): test the spec namespace cache slot for truthiness (#22098)
• 4c80c99 fix(html): minify an attribute by what it says, not how it was spelled (#22095)
• f6fd097 fix: release stale compilation data from nested children and idle watches (#2...
• 55c9808 refactor(js): own the ECMAScript parser and drop the acorn dependency (#22042)
• e1ab6f2 fix(html): escape a text run the tag after it would fuse with (#22086)
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for webpack since your current version.

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[sonarqube-wp-engine-prod]

Quality Gate passed

Issues
0 New issues
0 Fixed issues
0 Accepted issues

Measures
0 Security Hotspots
No data about Coverage
No data about Duplication

See analysis details on SonarQube