Skip to content

Bump the development-dependencies group across 1 directory with 7 updates#581

Closed
dependabot[bot] wants to merge 1 commit intomainfrom
dependabot/npm_and_yarn/development-dependencies-8e14f0435f
Closed

Bump the development-dependencies group across 1 directory with 7 updates#581
dependabot[bot] wants to merge 1 commit intomainfrom
dependabot/npm_and_yarn/development-dependencies-8e14f0435f

Conversation

@dependabot
Copy link
Copy Markdown
Contributor

@dependabot dependabot bot commented on behalf of github Apr 7, 2026 •
edited
Loading

Bumps the development-dependencies group with 7 updates in the / directory:

Package From To
@docusaurus/module-type-aliases 3.9.2 3.10.0
@docusaurus/tsconfig 3.9.2 3.10.0
@docusaurus/types 3.9.2 3.10.0
dotenv 17.3.1 17.4.1
lodash 4.17.23 4.18.1
typescript 5.9.3 6.0.2
typescript-eslint 8.57.1 8.58.0

Updates @docusaurus/module-type-aliases from 3.9.2 to 3.10.0

Release notes

Sourced from @​docusaurus/module-type-aliases's releases.

3.10.0 (2026-04-07)

🚀 New Feature

  • docusaurus-types, docusaurus
    • #11896 feat(core): add future.v4.mdx1CompatDisabledByDefault flag (@​slorber)
    • #11797 feat(core): promote siteConfig.storage to stable + add future.v4.siteStorageNamespacing flag [Claude] (@​slorber)
    • #11571 feat(core): support custom html elements in head tags (@​lebalz)
  • create-docusaurus
    • #11897 feat(create-docusaurus): update init template to .mdx extension and strict MDX syntax (@​slorber)
    • #11696 feat(create-docusaurus): Newly initialized TS sites should use "strict: true" (@​slorber)
    • #11611 feat(create-docusaurus): enable creation in current directory (@​Mcheung7272)
  • Other
    • #11874 feat(ci): improve npm supply chain security - improve Dependabot config (@​slorber)
    • #11712 feat(publish): Use trusted publishing (OIDC) for canary releases (@​slorber)
  • create-docusaurus, docusaurus-bundler, docusaurus-plugin-content-blog, docusaurus-plugin-content-docs, docusaurus-plugin-content-pages, docusaurus-plugin-pwa, docusaurus-types, docusaurus
    • #11802 feat(core): Docusaurus Faster is stable + v4 future flag turns it on by default (@​slorber)
  • docusaurus-mdx-loader, docusaurus-utils, docusaurus
    • #11777 feat(cli): write-heading-ids CLI now supports the --syntax and --migrate options (@​slorber)
  • docusaurus-mdx-loader
    • #11755 feat(mdx-loader): add support for explicit headingId based on MD/MDX comments (@​slorber)
  • docusaurus-theme-live-codeblock, docusaurus-theme-translations
  • docusaurus-theme-classic, docusaurus-theme-common
    • #11734 feat(theme): Split <DocCard>, improve extensibility, better handling of emoji icons, stable classNames (@​slorber)
    • #11733 feat(theme): Use React context for <Tabs>, allow custom <TabItem> components (@​slorber)
  • docusaurus-faster, docusaurus
    • #11715 feat(bundler): upgrade to Rspack 1.7, remove useless experimental feature flags (@​slorber)
  • docusaurus-plugin-content-pages
  • docusaurus-mdx-loader, docusaurus-theme-classic
    • #11642 feat(mdx-loader): add admonitions directive support for class/id shortcuts (@​lebalz)
  • docusaurus-theme-classic
  • docusaurus-theme-search-algolia
  • create-docusaurus, docusaurus-plugin-content-blog, docusaurus-plugin-content-docs, docusaurus-plugin-content-pages, docusaurus-plugin-sitemap, docusaurus-types, docusaurus-utils, docusaurus
    • #11512 feat(core): New siteConfig future.experimental_vcs API + future.experimental_faster.gitEagerVcs flag (@​slorber)

🐛 Bug Fix

  • docusaurus
    • #11844 fix(core): fix url.resolve() Node.js deprecation warning (@​slorber)
    • #11833 fix(core): upgrade serve handler min version to for upgrade users to a secure version (@​BearAlliance)
    • #11763 fix(cli): fix write-heading-ids CLI when no files provided (@​slorber)
    • #11693 fix(core): Remove deprecated experiments.lazyBarrel config for RsPack (@​VedikaGupt)
    • #11604 fix(core): webpack aliases shouldn't be created for test files and typedefs (@​slorber)
    • #11603 fix(core): Fix openBrowser AppleScript support for Arc (@​slorber)
    • #11579 fix(core): in isInternalUrl(), URI protocol scheme detection should implement the spec more strictly (@​slorber)

... (truncated)

Changelog

Sourced from @​docusaurus/module-type-aliases's changelog.

3.10.0 (2026-04-07)

🚀 New Feature

  • docusaurus-types, docusaurus
    • #11896 feat(core): add future.v4.mdx1CompatDisabledByDefault flag (@​slorber)
    • #11797 feat(core): promote siteConfig.storage to stable + add future.v4.siteStorageNamespacing flag [Claude] (@​slorber)
    • #11571 feat(core): support custom html elements in head tags (@​lebalz)
  • create-docusaurus
    • #11897 feat(create-docusaurus): update init template to .mdx extension and strict MDX syntax (@​slorber)
    • #11696 feat(create-docusaurus): Newly initialized TS sites should use "strict: true" (@​slorber)
    • #11611 feat(create-docusaurus): enable creation in current directory (@​Mcheung7272)
  • Other
    • #11874 feat(ci): improve npm supply chain security - improve Dependabot config (@​slorber)
    • #11712 feat(publish): Use trusted publishing (OIDC) for canary releases (@​slorber)
  • create-docusaurus, docusaurus-bundler, docusaurus-plugin-content-blog, docusaurus-plugin-content-docs, docusaurus-plugin-content-pages, docusaurus-plugin-pwa, docusaurus-types, docusaurus
    • #11802 feat(core): Docusaurus Faster is stable + v4 future flag turns it on by default (@​slorber)
  • docusaurus-mdx-loader, docusaurus-utils, docusaurus
    • #11777 feat(cli): write-heading-ids CLI now supports the --syntax and --migrate options (@​slorber)
  • docusaurus-mdx-loader
    • #11755 feat(mdx-loader): add support for explicit headingId based on MD/MDX comments (@​slorber)
  • docusaurus-theme-live-codeblock, docusaurus-theme-translations
  • docusaurus-theme-classic, docusaurus-theme-common
    • #11734 feat(theme): Split <DocCard>, improve extensibility, better handling of emoji icons, stable classNames (@​slorber)
    • #11733 feat(theme): Use React context for <Tabs>, allow custom <TabItem> components (@​slorber)
  • docusaurus-faster, docusaurus
    • #11715 feat(bundler): upgrade to Rspack 1.7, remove useless experimental feature flags (@​slorber)
  • docusaurus-plugin-content-pages
  • docusaurus-mdx-loader, docusaurus-theme-classic
    • #11642 feat(mdx-loader): add admonitions directive support for class/id shortcuts (@​lebalz)
  • docusaurus-theme-classic
  • docusaurus-theme-search-algolia
  • create-docusaurus, docusaurus-plugin-content-blog, docusaurus-plugin-content-docs, docusaurus-plugin-content-pages, docusaurus-plugin-sitemap, docusaurus-types, docusaurus-utils, docusaurus
    • #11512 feat(core): New siteConfig future.experimental_vcs API + future.experimental_faster.gitEagerVcs flag (@​slorber)

🐛 Bug Fix

  • docusaurus
    • #11844 fix(core): fix url.resolve() Node.js deprecation warning (@​slorber)
    • #11833 fix(core): upgrade serve handler min version to for upgrade users to a secure version (@​BearAlliance)
    • #11763 fix(cli): fix write-heading-ids CLI when no files provided (@​slorber)
    • #11693 fix(core): Remove deprecated experiments.lazyBarrel config for RsPack (@​VedikaGupt)
    • #11604 fix(core): webpack aliases shouldn't be created for test files and typedefs (@​slorber)
    • #11603 fix(core): Fix openBrowser AppleScript support for Arc (@​slorber)
    • #11579 fix(core): in isInternalUrl(), URI protocol scheme detection should implement the spec more strictly (@​slorber)

... (truncated)

Commits
Maintainer changes

This version was pushed to npm by [GitHub Actions](https://www.npmjs.com/~GitHub Actions), a new releaser for @​docusaurus/module-type-aliases since your current version.


Updates @docusaurus/tsconfig from 3.9.2 to 3.10.0

Release notes

Sourced from @​docusaurus/tsconfig's releases.

3.10.0 (2026-04-07)

🚀 New Feature

  • docusaurus-types, docusaurus
    • #11896 feat(core): add future.v4.mdx1CompatDisabledByDefault flag (@​slorber)
    • #11797 feat(core): promote siteConfig.storage to stable + add future.v4.siteStorageNamespacing flag [Claude] (@​slorber)
    • #11571 feat(core): support custom html elements in head tags (@​lebalz)
  • create-docusaurus
    • #11897 feat(create-docusaurus): update init template to .mdx extension and strict MDX syntax (@​slorber)
    • #11696 feat(create-docusaurus): Newly initialized TS sites should use "strict: true" (@​slorber)
    • #11611 feat(create-docusaurus): enable creation in current directory (@​Mcheung7272)
  • Other
    • #11874 feat(ci): improve npm supply chain security - improve Dependabot config (@​slorber)
    • #11712 feat(publish): Use trusted publishing (OIDC) for canary releases (@​slorber)
  • create-docusaurus, docusaurus-bundler, docusaurus-plugin-content-blog, docusaurus-plugin-content-docs, docusaurus-plugin-content-pages, docusaurus-plugin-pwa, docusaurus-types, docusaurus
    • #11802 feat(core): Docusaurus Faster is stable + v4 future flag turns it on by default (@​slorber)
  • docusaurus-mdx-loader, docusaurus-utils, docusaurus
    • #11777 feat(cli): write-heading-ids CLI now supports the --syntax and --migrate options (@​slorber)
  • docusaurus-mdx-loader
    • #11755 feat(mdx-loader): add support for explicit headingId based on MD/MDX comments (@​slorber)
  • docusaurus-theme-live-codeblock, docusaurus-theme-translations
  • docusaurus-theme-classic, docusaurus-theme-common
    • #11734 feat(theme): Split <DocCard>, improve extensibility, better handling of emoji icons, stable classNames (@​slorber)
    • #11733 feat(theme): Use React context for <Tabs>, allow custom <TabItem> components (@​slorber)
  • docusaurus-faster, docusaurus
    • #11715 feat(bundler): upgrade to Rspack 1.7, remove useless experimental feature flags (@​slorber)
  • docusaurus-plugin-content-pages
  • docusaurus-mdx-loader, docusaurus-theme-classic
    • #11642 feat(mdx-loader): add admonitions directive support for class/id shortcuts (@​lebalz)
  • docusaurus-theme-classic
  • docusaurus-theme-search-algolia
  • create-docusaurus, docusaurus-plugin-content-blog, docusaurus-plugin-content-docs, docusaurus-plugin-content-pages, docusaurus-plugin-sitemap, docusaurus-types, docusaurus-utils, docusaurus
    • #11512 feat(core): New siteConfig future.experimental_vcs API + future.experimental_faster.gitEagerVcs flag (@​slorber)

🐛 Bug Fix

  • docusaurus
    • #11844 fix(core): fix url.resolve() Node.js deprecation warning (@​slorber)
    • #11833 fix(core): upgrade serve handler min version to for upgrade users to a secure version (@​BearAlliance)
    • #11763 fix(cli): fix write-heading-ids CLI when no files provided (@​slorber)
    • #11693 fix(core): Remove deprecated experiments.lazyBarrel config for RsPack (@​VedikaGupt)
    • #11604 fix(core): webpack aliases shouldn't be created for test files and typedefs (@​slorber)
    • #11603 fix(core): Fix openBrowser AppleScript support for Arc (@​slorber)
    • #11579 fix(core): in isInternalUrl(), URI protocol scheme detection should implement the spec more strictly (@​slorber)

... (truncated)

Changelog

Sourced from @​docusaurus/tsconfig's changelog.

3.10.0 (2026-04-07)

🚀 New Feature

  • docusaurus-types, docusaurus
    • #11896 feat(core): add future.v4.mdx1CompatDisabledByDefault flag (@​slorber)
    • #11797 feat(core): promote siteConfig.storage to stable + add future.v4.siteStorageNamespacing flag [Claude] (@​slorber)
    • #11571 feat(core): support custom html elements in head tags (@​lebalz)
  • create-docusaurus
    • #11897 feat(create-docusaurus): update init template to .mdx extension and strict MDX syntax (@​slorber)
    • #11696 feat(create-docusaurus): Newly initialized TS sites should use "strict: true" (@​slorber)
    • #11611 feat(create-docusaurus): enable creation in current directory (@​Mcheung7272)
  • Other
    • #11874 feat(ci): improve npm supply chain security - improve Dependabot config (@​slorber)
    • #11712 feat(publish): Use trusted publishing (OIDC) for canary releases (@​slorber)
  • create-docusaurus, docusaurus-bundler, docusaurus-plugin-content-blog, docusaurus-plugin-content-docs, docusaurus-plugin-content-pages, docusaurus-plugin-pwa, docusaurus-types, docusaurus
    • #11802 feat(core): Docusaurus Faster is stable + v4 future flag turns it on by default (@​slorber)
  • docusaurus-mdx-loader, docusaurus-utils, docusaurus
    • #11777 feat(cli): write-heading-ids CLI now supports the --syntax and --migrate options (@​slorber)
  • docusaurus-mdx-loader
    • #11755 feat(mdx-loader): add support for explicit headingId based on MD/MDX comments (@​slorber)
  • docusaurus-theme-live-codeblock, docusaurus-theme-translations
  • docusaurus-theme-classic, docusaurus-theme-common
    • #11734 feat(theme): Split <DocCard>, improve extensibility, better handling of emoji icons, stable classNames (@​slorber)
    • #11733 feat(theme): Use React context for <Tabs>, allow custom <TabItem> components (@​slorber)
  • docusaurus-faster, docusaurus
    • #11715 feat(bundler): upgrade to Rspack 1.7, remove useless experimental feature flags (@​slorber)
  • docusaurus-plugin-content-pages
  • docusaurus-mdx-loader, docusaurus-theme-classic
    • #11642 feat(mdx-loader): add admonitions directive support for class/id shortcuts (@​lebalz)
  • docusaurus-theme-classic
  • docusaurus-theme-search-algolia
  • create-docusaurus, docusaurus-plugin-content-blog, docusaurus-plugin-content-docs, docusaurus-plugin-content-pages, docusaurus-plugin-sitemap, docusaurus-types, docusaurus-utils, docusaurus
    • #11512 feat(core): New siteConfig future.experimental_vcs API + future.experimental_faster.gitEagerVcs flag (@​slorber)

🐛 Bug Fix

  • docusaurus
    • #11844 fix(core): fix url.resolve() Node.js deprecation warning (@​slorber)
    • #11833 fix(core): upgrade serve handler min version to for upgrade users to a secure version (@​BearAlliance)
    • #11763 fix(cli): fix write-heading-ids CLI when no files provided (@​slorber)
    • #11693 fix(core): Remove deprecated experiments.lazyBarrel config for RsPack (@​VedikaGupt)
    • #11604 fix(core): webpack aliases shouldn't be created for test files and typedefs (@​slorber)
    • #11603 fix(core): Fix openBrowser AppleScript support for Arc (@​slorber)
    • #11579 fix(core): in isInternalUrl(), URI protocol scheme detection should implement the spec more strictly (@​slorber)

... (truncated)

Commits
Maintainer changes

This version was pushed to npm by [GitHub Actions](https://www.npmjs.com/~GitHub Actions), a new releaser for @​docusaurus/tsconfig since your current version.


Updates @docusaurus/types from 3.9.2 to 3.10.0

Release notes

Sourced from @​docusaurus/types's releases.

3.10.0 (2026-04-07)

🚀 New Feature

  • docusaurus-types, docusaurus
    • #11896 feat(core): add future.v4.mdx1CompatDisabledByDefault flag (@​slorber)
    • #11797 feat(core): promote siteConfig.storage to stable + add future.v4.siteStorageNamespacing flag [Claude] (@​slorber)
    • #11571 feat(core): support custom html elements in head tags (@​lebalz)
  • create-docusaurus
    • #11897 feat(create-docusaurus): update init template to .mdx extension and strict MDX syntax (@​slorber)
    • #11696 feat(create-docusaurus): Newly initialized TS sites should use "strict: true" (@​slorber)
    • #11611 feat(create-docusaurus): enable creation in current directory (@​Mcheung7272)
  • Other
    • #11874 feat(ci): improve npm supply chain security - improve Dependabot config (@​slorber)
    • #11712 feat(publish): Use trusted publishing (OIDC) for canary releases (@​slorber)
  • create-docusaurus, docusaurus-bundler, docusaurus-plugin-content-blog, docusaurus-plugin-content-docs, docusaurus-plugin-content-pages, docusaurus-plugin-pwa, docusaurus-types, docusaurus
    • #11802 feat(core): Docusaurus Faster is stable + v4 future flag turns it on by default (@​slorber)
  • docusaurus-mdx-loader, docusaurus-utils, docusaurus
    • #11777 feat(cli): write-heading-ids CLI now supports the --syntax and --migrate options (@​slorber)
  • docusaurus-mdx-loader
    • #11755 feat(mdx-loader): add support for explicit headingId based on MD/MDX comments (@​slorber)
  • docusaurus-theme-live-codeblock, docusaurus-theme-translations
  • docusaurus-theme-classic, docusaurus-theme-common
    • #11734 feat(theme): Split <DocCard>, improve extensibility, better handling of emoji icons, stable classNames (@​slorber)
    • #11733 feat(theme): Use React context for <Tabs>, allow custom <TabItem> components (@​slorber)
  • docusaurus-faster, docusaurus
    • #11715 feat(bundler): upgrade to Rspack 1.7, remove useless experimental feature flags (@​slorber)
  • docusaurus-plugin-content-pages
  • docusaurus-mdx-loader, docusaurus-theme-classic
    • #11642 feat(mdx-loader): add admonitions directive support for class/id shortcuts (@​lebalz)
  • docusaurus-theme-classic
  • docusaurus-theme-search-algolia
  • create-docusaurus, docusaurus-plugin-content-blog, docusaurus-plugin-content-docs, docusaurus-plugin-content-pages, docusaurus-plugin-sitemap, docusaurus-types, docusaurus-utils, docusaurus
    • #11512 feat(core): New siteConfig future.experimental_vcs API + future.experimental_faster.gitEagerVcs flag (@​slorber)

🐛 Bug Fix

  • docusaurus
    • #11844 fix(core): fix url.resolve() Node.js deprecation warning (@​slorber)
    • #11833 fix(core): upgrade serve handler min version to for upgrade users to a secure version (@​BearAlliance)
    • #11763 fix(cli): fix write-heading-ids CLI when no files provided (@​slorber)
    • #11693 fix(core): Remove deprecated experiments.lazyBarrel config for RsPack (@​VedikaGupt)
    • #11604 fix(core): webpack aliases shouldn't be created for test files and typedefs (@​slorber)
    • #11603 fix(core): Fix openBrowser AppleScript support for Arc (@​slorber)
    • #11579 fix(core): in isInternalUrl(), URI protocol scheme detection should implement the spec more strictly (@​slorber)

... (truncated)

Changelog

Sourced from @​docusaurus/types's changelog.

3.10.0 (2026-04-07)

🚀 New Feature

  • docusaurus-types, docusaurus
    • #11896 feat(core): add future.v4.mdx1CompatDisabledByDefault flag (@​slorber)
    • #11797 feat(core): promote siteConfig.storage to stable + add future.v4.siteStorageNamespacing flag [Claude] (@​slorber)
    • #11571 feat(core): support custom html elements in head tags (@​lebalz)
  • create-docusaurus
    • #11897 feat(create-docusaurus): update init template to .mdx extension and strict MDX syntax (@​slorber)
    • #11696 feat(create-docusaurus): Newly initialized TS sites should use "strict: true" (@​slorber)
    • #11611 feat(create-docusaurus): enable creation in current directory (@​Mcheung7272)
  • Other
    • #11874 feat(ci): improve npm supply chain security - improve Dependabot config (@​slorber)
    • #11712 feat(publish): Use trusted publishing (OIDC) for canary releases (@​slorber)
  • create-docusaurus, docusaurus-bundler, docusaurus-plugin-content-blog, docusaurus-plugin-content-docs, docusaurus-plugin-content-pages, docusaurus-plugin-pwa, docusaurus-types, docusaurus
    • #11802 feat(core): Docusaurus Faster is stable + v4 future flag turns it on by default (@​slorber)
  • docusaurus-mdx-loader, docusaurus-utils, docusaurus
    • #11777 feat(cli): write-heading-ids CLI now supports the --syntax and --migrate options (@​slorber)
  • docusaurus-mdx-loader
    • #11755 feat(mdx-loader): add support for explicit headingId based on MD/MDX comments (@​slorber)
  • docusaurus-theme-live-codeblock, docusaurus-theme-translations
  • docusaurus-theme-classic, docusaurus-theme-common
    • #11734 feat(theme): Split <DocCard>, improve extensibility, better handling of emoji icons, stable classNames (@​slorber)
    • #11733 feat(theme): Use React context for <Tabs>, allow custom <TabItem> components (@​slorber)
  • docusaurus-faster, docusaurus
    • #11715 feat(bundler): upgrade to Rspack 1.7, remove useless experimental feature flags (@​slorber)
  • docusaurus-plugin-content-pages
  • docusaurus-mdx-loader, docusaurus-theme-classic
    • #11642 feat(mdx-loader): add admonitions directive support for class/id shortcuts (@​lebalz)
  • docusaurus-theme-classic
  • docusaurus-theme-search-algolia
  • create-docusaurus, docusaurus-plugin-content-blog, docusaurus-plugin-content-docs, docusaurus-plugin-content-pages, docusaurus-plugin-sitemap, docusaurus-types, docusaurus-utils, docusaurus
    • #11512 feat(core): New siteConfig future.experimental_vcs API + future.experimental_faster.gitEagerVcs flag (@​slorber)

🐛 Bug Fix

  • docusaurus
    • #11844 fix(core): fix url.resolve() Node.js deprecation warning (@​slorber)
    • #11833 fix(core): upgrade serve handler min version to for upgrade users to a secure version (@​BearAlliance)
    • #11763 fix(cli): fix write-heading-ids CLI when no files provided (@​slorber)
    • #11693 fix(core): Remove deprecated experiments.lazyBarrel config for RsPack (@​VedikaGupt)
    • #11604 fix(core): webpack aliases shouldn't be created for test files and typedefs (@​slorber)
    • #11603 fix(core): Fix openBrowser AppleScript support for Arc (@​slorber)
    • #11579 fix(core): in isInternalUrl(), URI protocol scheme detection should implement the spec more strictly (@​slorber)

... (truncated)

Commits
  • 0d98888 v3.10.0
  • 4892e7f feat(core): add future.v4.mdx1CompatDisabledByDefault flag (#11896)
  • 1451780 chore(ci): fixes for the npm trusted publishing workflow (#11823)
  • 5dff744 chore(ci): add Trusted Publishing release workflow through dispatch action (#...
  • 29c3b5c feat(core): Docusaurus Faster is stable + v4 future flag turns it on by defau...
  • 2a7f8b9 feat(core): promote siteConfig.storage to stable + add `future.v4.siteStora...
  • c6a86ff feat(core): support custom html elements in head tags (#11571)
  • acc66c1 feat(core): New siteConfig future.experimental_vcs API + `future.experimen...
  • bca9ce7 chore: release v3.9.2 (#11491)
  • See full diff in compare view
Maintainer changes

This version was pushed to npm by [GitHub Actions](https://www.npmjs.com/~GitHub Actions), a new releaser for @​docusaurus/types since your current version.


Updates dotenv from 17.3.1 to 17.4.1

Changelog

Sourced from dotenv's changelog.

17.4.1 (2026-04-05)

Changed

  • Change text injecting to injected (#1005)

17.4.0 (2026-04-01)

Added

  • Add skills/ folder with focused agent skills: skills/dotenv/SKILL.md (core usage) and skills/dotenvx/SKILL.md (encryption, multiple environments, variable expansion) for AI coding agent discovery via the skills.sh ecosystem (npx skills add motdotla/dotenv)

Changed

  • Tighten up logs: ◇ injecting env (14) from .env (#1003)
Commits

Updates lodash from 4.17.23 to 4.18.1

Release notes

Sourced from lodash's releases.

4.18.1

Bugs

Fixes a ReferenceError issue in lodash lodash-es lodash-amd and lodash.template when using the template and fromPairs functions from the modular builds. See lodash/lodash#6167

These defects were related to how lodash distributions are built from the main branch using https://github.com/lodash-archive/lodash-cli. When internal dependencies change inside lodash functions, equivalent updates need to be made to a mapping in the lodash-cli. (hey, it was ahead of its time once upon a time!). We know this, but we missed it in the last release. It's the kind of thing that passes in CI, but fails bc the build is not the same thing you tested.

There is no diff on main for this, but you can see the diffs for each of the npm packages on their respective branches:

4.18.0

v4.18.0

Full Changelog: lodash/lodash@4.17.23...4.18.0

Security

_.unset / _.omit: Fixed prototype pollution via constructor/prototype path traversal (GHSA-f23m-r3pf-42rh, fe8d32e). Previously, array-wrapped path segments and primitive roots could bypass the existing guards, allowing deletion of properties from built-in prototypes. Now constructor and prototype are blocked unconditionally as non-terminal path keys, matching baseSet. Calls that previously returned true and deleted the property now return false and leave the target untouched.

_.template: Fixed code injection via imports keys (GHSA-r5fr-rjxr-66jc, CVE-2026-4800, 879aaa9). Fixes an incomplete patch for CVE-2021-23337. The variable option was validated against reForbiddenIdentifierChars but importsKeys was left unguarded, allowing code injection via the same Funct...

Description has been truncated

@dependabot
Bump the development-dependencies group across 1 directory with 7 upd…
b0c33e2 
…ates

Bumps the development-dependencies group with 7 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [@docusaurus/module-type-aliases](https://github.com/facebook/docusaurus/tree/HEAD/packages/docusaurus-module-type-aliases) | `3.9.2` | `3.10.0` |
| [@docusaurus/tsconfig](https://github.com/facebook/docusaurus/tree/HEAD/packages/docusaurus-tsconfig) | `3.9.2` | `3.10.0` |
| [@docusaurus/types](https://github.com/facebook/docusaurus/tree/HEAD/packages/docusaurus-types) | `3.9.2` | `3.10.0` |
| [dotenv](https://github.com/motdotla/dotenv) | `17.3.1` | `17.4.1` |
| [lodash](https://github.com/lodash/lodash) | `4.17.23` | `4.18.1` |
| [typescript](https://github.com/microsoft/TypeScript) | `5.9.3` | `6.0.2` |
| [typescript-eslint](https://github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/typescript-eslint) | `8.57.1` | `8.58.0` |



Updates `@docusaurus/module-type-aliases` from 3.9.2 to 3.10.0
- [Release notes](https://github.com/facebook/docusaurus/releases)
- [Changelog](https://github.com/facebook/docusaurus/blob/main/CHANGELOG.md)
- [Commits](https://github.com/facebook/docusaurus/commits/v3.10.0/packages/docusaurus-module-type-aliases)

Updates `@docusaurus/tsconfig` from 3.9.2 to 3.10.0
- [Release notes](https://github.com/facebook/docusaurus/releases)
- [Changelog](https://github.com/facebook/docusaurus/blob/main/CHANGELOG.md)
- [Commits](https://github.com/facebook/docusaurus/commits/v3.10.0/packages/docusaurus-tsconfig)

Updates `@docusaurus/types` from 3.9.2 to 3.10.0
- [Release notes](https://github.com/facebook/docusaurus/releases)
- [Changelog](https://github.com/facebook/docusaurus/blob/main/CHANGELOG.md)
- [Commits](https://github.com/facebook/docusaurus/commits/v3.10.0/packages/docusaurus-types)

Updates `dotenv` from 17.3.1 to 17.4.1
- [Changelog](https://github.com/motdotla/dotenv/blob/master/CHANGELOG.md)
- [Commits](motdotla/dotenv@v17.3.1...v17.4.1)

Updates `lodash` from 4.17.23 to 4.18.1
- [Release notes](https://github.com/lodash/lodash/releases)
- [Commits](lodash/lodash@4.17.23...4.18.1)

Updates `typescript` from 5.9.3 to 6.0.2
- [Release notes](https://github.com/microsoft/TypeScript/releases)
- [Commits](microsoft/TypeScript@v5.9.3...v6.0.2)

Updates `typescript-eslint` from 8.57.1 to 8.58.0
- [Release notes](https://github.com/typescript-eslint/typescript-eslint/releases)
- [Changelog](https://github.com/typescript-eslint/typescript-eslint/blob/main/packages/typescript-eslint/CHANGELOG.md)
- [Commits](https://github.com/typescript-eslint/typescript-eslint/commits/v8.58.0/packages/typescript-eslint)

---
updated-dependencies:
- dependency-name: "@docusaurus/module-type-aliases"
  dependency-version: 3.10.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: development-dependencies
- dependency-name: "@docusaurus/tsconfig"
  dependency-version: 3.10.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: development-dependencies
- dependency-name: "@docusaurus/types"
  dependency-version: 3.10.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: development-dependencies
- dependency-name: dotenv
  dependency-version: 17.4.1
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: development-dependencies
- dependency-name: lodash
  dependency-version: 4.18.1
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: development-dependencies
- dependency-name: typescript
  dependency-version: 6.0.2
  dependency-type: direct:development
  update-type: version-update:semver-major
  dependency-group: development-dependencies
- dependency-name: typescript-eslint
  dependency-version: 8.58.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: development-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Apr 7, 2026
@dependabot dependabot bot requested a review from a team as a code owner April 7, 2026 16:17
@dependabot dependabot bot added the dependencies Pull requests that update a dependency file label Apr 7, 2026
@dependabot dependabot bot requested a review from dcoffey3296 April 7, 2026 16:17
@dependabot dependabot bot added the javascript Pull requests that update javascript code label Apr 7, 2026
@dependabot dependabot bot requested a review from jeroentempels-dolby April 7, 2026 16:17
@dependabot @github
Copy link
Copy Markdown
Contributor Author

dependabot bot commented on behalf of github Apr 7, 2026

Looks like these dependencies are updatable in another way, so this is no longer needed.

@dependabot dependabot bot closed this Apr 7, 2026
@dependabot dependabot bot deleted the dependabot/npm_and_yarn/development-dependencies-8e14f0435f branch April 7, 2026 17:15
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@dcoffey3296 dcoffey3296 Awaiting requested review from dcoffey3296 dcoffey3296 is a code owner automatically assigned from THEOplayer/documentation-reviewers

@jeroentempels-dolby jeroentempels-dolby Awaiting requested review from jeroentempels-dolby jeroentempels-dolby is a code owner automatically assigned from THEOplayer/documentation-reviewers

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants