Bump lodash, grunt, grunt-contrib-uglify and grunt-contrib-watch

[dependabot]

Bumps lodash to 4.18.1 and updates ancestor dependencies lodash, grunt, grunt-contrib-uglify and grunt-contrib-watch. These dependencies need to be updated together.

Updates lodash from 2.4.2 to 4.18.1

Release notes

Sourced from lodash's releases.

4.18.1

Bugs

Fixes a ReferenceError issue in lodash lodash-es lodash-amd and lodash.template when using the template and fromPairs functions from the modular builds. See lodash/lodash#6167

These defects were related to how lodash distributions are built from the main branch using https://github.com/lodash-archive/lodash-cli. When internal dependencies change inside lodash functions, equivalent updates need to be made to a mapping in the lodash-cli. (hey, it was ahead of its time once upon a time!). We know this, but we missed it in the last release. It's the kind of thing that passes in CI, but fails bc the build is not the same thing you tested.

There is no diff on main for this, but you can see the diffs for each of the npm packages on their respective branches:

• lodash: lodash/lodash@4.18.0-npm...4.18.1-npm
• lodash-es: lodash/lodash@4.18.0-es...4.18.1-es
• lodash-amd: lodash/lodash@4.18.0-amd...4.18.1-amd
• lodash.templatelodash/lodash@4.18.0-npm-packages...4.18.1-npm-packages

4.18.0

v4.18.0

Full Changelog: lodash/lodash@4.17.23...4.18.0

Security

_.unset / _.omit: Fixed prototype pollution via constructor/prototype path traversal (GHSA-f23m-r3pf-42rh, fe8d32e). Previously, array-wrapped path segments and primitive roots could bypass the existing guards, allowing deletion of properties from built-in prototypes. Now constructor and prototype are blocked unconditionally as non-terminal path keys, matching baseSet. Calls that previously returned true and deleted the property now return false and leave the target untouched.

_.template: Fixed code injection via imports keys (GHSA-r5fr-rjxr-66jc, CVE-2026-4800, 879aaa9). Fixes an incomplete patch for CVE-2021-23337. The variable option was validated against reForbiddenIdentifierChars but importsKeys was left unguarded, allowing code injection via the same Function() constructor sink. imports keys containing forbidden identifier characters now throw "Invalid imports option passed into _.template".

Docs

• Add security notice for _.template in threat model and API docs (#6099)
• Document lower > upper behavior in _.random (#6115)
• Fix quotes in _.compact jsdoc (#6090)

lodash.* modular packages

Diff

We have also regenerated and published a select number of the lodash.* modular packages.

These modular packages had fallen out of sync significantly from the minor/patch updates to lodash. Specifically, we have brought the following packages up to parity w/ the latest lodash release because they have had CVEs on them in the past:

• lodash.orderby
• lodash.tonumber
• lodash.trim
• lodash.trimend
• lodash.sortedindexby
• lodash.zipobjectdeep
• lodash.unset
• lodash.omit
• lodash.template

4.0.0

lodash v4.0.0

... (truncated)

Commits

• cb0b9b9 release(patch): bump main to 4.18.1 (#6177)
• 75535f5 chore: prune stale advisory refs (#6170)
• 62e91bc docs: remove n_ Node.js < 6 REPL note from README (#6165)
• 59be2de release(minor): bump to 4.18.0 (#6161)
• af63457 fix: broken tests for _.template 879aaa9
• 1073a76 fix: linting issues
• 879aaa9 fix: validate imports keys in _.template
• fe8d32e fix: block prototype pollution in baseUnset via constructor/prototype traversal
• 18ba0a3 refactor(fromPairs): use baseAssignValue for consistent assignment (#6153)
• b819080 ci: add dist sync validation workflow (#6137)
• Additional commits viewable in compare view

Updates grunt from 0.4.5 to 1.6.3

Release notes

Sourced from grunt's releases.

v1.6.1

• Changelog updates 72f6f03
• Merge pull request #1755 from gruntjs/rm-dep 8d4c183
• Add recursive 1c7d483
• Merge pull request #1756 from gruntjs/downgrade-glob 2d4fd38
• Downgrade glob 902db7c
• Fix syntax 494f243
• remove mkdirp b01389e
• remove dep on rimraf and mkdirp 0072510

gruntjs/grunt@v1.6.0...v1.6.1

v1.6.0

• Merge pull request #1750 from gruntjs/dep-update-jan28 2805dc3
• README updates 3f1e423
• Bump to 16 8fd096d
• Update more deps 42c5f95
• Bump eslint and node version 1d88050

gruntjs/grunt@v1.5.3...v1.6.0

v1.5.3

• Merge pull request #1745 from gruntjs/fix-copy-op 572d79b
• Patch up race condition in symlink copying. 58016ff
• Merge pull request #1746 from JamieSlome/patch-1 0749e1d
• Create SECURITY.md 69b7c50

gruntjs/grunt@v1.5.2...v1.5.3

v1.5.2

• Update Changelog 7f15fd5
• Merge pull request #1743 from gruntjs/cleanup-link b0ec6e1
• Clean up link handling 433f91b

gruntjs/grunt@v1.5.1...v1.5.2

v1.5.1

• Merge pull request #1742 from gruntjs/update-symlink-test ad22608
• Fix symlink test 0652305

gruntjs/grunt@v1.5.0...v1.5.1

v1.5.0

• Updated changelog b2b2c2b
• Merge pull request #1740 from gruntjs/update-deps-22-10 3eda6ae
• Update testing matrix 47d32de
• More updates 2e9161c
• Remove console log 04b960e
• Update dependencies, tests... aad3d45
• Merge pull request #1736 from justlep/main fdc7056

... (truncated)

Changelog

Sourced from grunt's changelog.

v1.6.3

• date: 2026-07-28
• changes:
  • Update js-yaml to 3.15.0 to fix CVE (gruntjs/grunt#1803)

v1.6.2

• date: 2026-04-14
• changes:
  • Update minimatch to 3.1.5. (PR: gruntjs/grunt#1796)
  • Update nopt to 5.0.0. (PR: gruntjs/grunt#1778)

v1.6.1

• date: 2023-01-31
• changes:
  • Downgrades to glob 7 for Windows compatability
  • Removes mkdirp and rimraf in favour of node.js APIs.

v1.6.0

• date: 2023-01-28
• changes:
  • Requires node.js 16+.
  • template.date now uses dateformat ~4.6.2.
  • other dependency updates such as glob, rimraf, etc.

v1.5.3

• date: 2022-04-23
• changes:
  • Patch up race condition in symlink copying.

v1.5.2

• date: 2022-04-12
• changes:
  • Unlink symlinks when copy destination is a symlink.

v1.5.1

• date: 2022-04-11
• changes:
  • Fixed symlink destination handling.

v1.5.0

• date: 2022-04-10
• changes:
  • Updated dependencies.
  • Add symlink handling for copying files.

v1.4.1

• date: 2021-05-24
• changes:

... (truncated)

Commits

• d71f9aa 1.6.3
• 33280c2 docs: Convert changelog to markdown
• 8534749 Update js-yaml to 3.15.0 to fix CVE
• 1d8bf42 Update copyright to OpenJS Foundation
• f49016e 1.6.2
• 662e097 Update minimatch to 3.1.5 to fix CVEs
• a29fd18 CI: add Node.js 24 to version matrix
• f757c4f Update links
• b5aa834 Merge pull request #1792 from UlisesGascon/security-md
• 8d2dea2 docs: refresh security policy
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by krinkle, a new releaser for grunt since your current version.

Updates grunt-contrib-uglify from 0.10.1 to 5.2.2

Release notes

Sourced from grunt-contrib-uglify's releases.

v5.2.2

• Set dev version for publish df82903
• update dependencies (#572) 70b6eb7
• Bump ejs from 3.1.6 to 3.1.8 (#570) a285b24
• Bump grunt from 1.5.2 to 1.5.3 (#569) 4415d58
• Update README.md efdabc7

gruntjs/grunt-contrib-uglify@v5.2.1...v5.2.2

v5.2.1

• Update Readme 3c8d904
• update dependencies (#568) 0850dcd
• Bump minimist from 1.2.5 to 1.2.6 (#567) c27ad5f
• Fix documentation in relation to issue #565 (#566) 98b4c5f
• Bump minimist from 1.2.5 to 1.2.6 (#563) 7228446

gruntjs/grunt-contrib-uglify@v5.1.0...v5.2.1

v5.1.0

• Update deps, v5.1.0 (#564) e410511
• Update uglify-js to v3.15.2 (#562) 2cb31be
• Fix wording in README.md (#560) 12ca0f2
• Bump path-parse from 1.0.6 to 1.0.7 (#558) 1f6a012
• Update uglify-js (#557) 0e4b1a0
• Bump hosted-git-info from 2.8.8 to 2.8.9 (#556) 9ccf10d

gruntjs/grunt-contrib-uglify@v5.0.1...v5.1.0

v5.0.1

• Update uglify-js to v3.13.3.

v4.0.1

• Update uglify-js to v3.5.0.
• Update dependencies.

v4.0.0

• Updated all dependencies.
• Requires Node.js >= 6.

v3.4.0

No release notes provided.

v3.3.0

No release notes provided.

v3.2.1

No release notes provided.

v3.2.0

... (truncated)

Changelog

Sourced from grunt-contrib-uglify's changelog.

v5.1.0: date: 2022-03-27 changes: - Update dependencies. uglify-js ^3.15.2. - Requires node 12+. v5.0.0: date: 2020-07-16 changes: - Requires node 10+. - Update dependencies. v4.0.1: date: 2019-03-21 changes: - Update uglify-js to v3.5.0. - Update dependencies. v4.0.0: date: 2018-08-26 changes: - Update dependencies. - Requires Node.js >= 6. v3.4.0: date: 2018-07-29 changes: - Update uglify-js to v3.4.0. v3.3.0: date: 2017-12-24 changes: - Update uglify-js to v3.3.0. v3.2.1: date: 2017-11-26 changes: - Update uglify-js to v3.2.0. v3.1.0: date: 2017-09-11 changes: - Update uglify-js to v3.1.0. v3.0.1: date: 2017-05-20 changes: - Fix toplevel option. v3.0.0: date: 2017-05-12 changes: - Update uglify-js to v3.0.4. v2.3.0: date: 2017-04-05 changes: - Make CLI output less verbose. v2.2.1: date: 2017-03-31

... (truncated)

Commits

• 4a73c8a 5.2.2
• df82903 Set dev version for publish
• 70b6eb7 update dependencies (#572)
• a285b24 Bump ejs from 3.1.6 to 3.1.8 (#570)
• 4415d58 Bump grunt from 1.5.2 to 1.5.3 (#569)
• efdabc7 Update README.md
• a3f3f34 5.2.1
• 3c8d904 Update Readme
• 0850dcd update dependencies (#568)
• c27ad5f Bump minimist from 1.2.5 to 1.2.6 (#567)
• Additional commits viewable in compare view

Updates grunt-contrib-watch from 0.6.1 to 1.1.0

Changelog

Sourced from grunt-contrib-watch's changelog.

v1.1.0: date: 2018-05-12 changes: - Update to tiny-lr@1.1.1, lodash@4.17.10, async@2.6.0 v1.0.1: date: 2018-04-20 changes: - Update to gaze@1.1, lodash@4 v1.0.0: date: 2016-03-12 changes: - Updated tiny-lr, gaze, async and lodash dependencies. - Fix endless loop issue with atBegin/nospawn. - Expose hostname parameter of tiny-lr. - Support cwd.event to emit events relative to path. - Removed peerDependencies setting.

Commits

• 3b7ddf4 v1.1.0
• 72b1214 Updating dependencies, async, lodash and tiny-lr
• 5adb27c Merge pull request #543 from digitalbazaar/master
• 6ec71e9 v1.0.1
• 7d20933 Update copyright year
• e3d19df Update ci configs
• d117574 Updating ci configs
• 99410a7 README.md: Fixed typos (#536)
• f07311b Update tiny-lr dependency to 1.x
• 7f8cf80 Add local grunt-cli
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.