From a8cf21887faf497563c9f69f327534893d96a99d Mon Sep 17 00:00:00 2001 From: focuslight-nr <45585253+focuslight-nr@users.noreply.github.com> Date: Fri, 25 Sep 2026 17:21:29 +0900 Subject: [PATCH 1/2] fix(deps): bump lodash and lodash-es to 4.18.1 in the root lockfile lodash and lodash-es 4.17.21 are affected by CVE-2021-23337 (command injection in `template`, EPSS ~21%), CVE-2025-13465, CVE-2026-2950 and CVE-2026-4800. Every range that reaches them already allows 4.18.x (recharts ^4.17.21, force-graph/kapsule lodash-es 4, the conventional- changelog tooling ^4.17.15), so this is a lockfile-only change with no package.json edits. Only those two entries were re-resolved; `yarn upgrade` was not used because it ignores transitive packages in a workspace and drags in unrelated bumps. The one remaining lodash 4.17.21 is commitizen's exact pin (dev-only commit tooling); commitizen 4.3.2 moves that pin to 4.18.1 but also pulls in @commitlint 21, so it is left for a separate change. Co-Authored-By: Claude Opus 5.5 --- yarn.lock | 15 ++++++++++----- 1 file changed, 10 insertions(+), 5 deletions(-) diff --git a/yarn.lock b/yarn.lock index a89d92cfd..350014dfc 100644 --- a/yarn.lock +++ b/yarn.lock @@ -6323,9 +6323,9 @@ locate-path@^7.2.0: p-locate "^6.0.0" lodash-es@4: - version "4.17.21" - resolved "https://registry.npmjs.org/lodash-es/-/lodash-es-4.17.21.tgz" - integrity sha512-mKnC+QJ9pWVzv+C4/U3rRsHapFfHvQFoFB92e52xeyGMcX6/OlIl78je1u8vePzYZSkkogMPJ2yjxxsb89cxyw== + version "4.18.1" + resolved "https://registry.yarnpkg.com/lodash-es/-/lodash-es-4.18.1.tgz#b962eeb80d9d983a900bf342961fb7418ca10b1d" + integrity sha512-J8xewKD/Gk22OZbhpOVSwcs60zhd95ESDwezOFuA3/099925PdHJ7OFHNTGtajL3AlZkykD32HykiMo+BIBI8A== lodash.camelcase@^4.3.0: version "4.3.0" @@ -6387,11 +6387,16 @@ lodash.upperfirst@^4.3.1: resolved "https://registry.npmjs.org/lodash.upperfirst/-/lodash.upperfirst-4.3.1.tgz" integrity sha512-sReKOYJIJf74dhJONhU4e0/shzi1trVbSWDOhKYE5XV2O+H7Sb2Dihwuc7xWxVl+DgFPyTqIN3zMfT9cq5iWDg== -lodash@4.17.21, lodash@^4.17.15, lodash@^4.17.21: +lodash@4.17.21: version "4.17.21" - resolved "https://registry.npmjs.org/lodash/-/lodash-4.17.21.tgz" + resolved "https://registry.yarnpkg.com/lodash/-/lodash-4.17.21.tgz#679591c564c3bffaae8454cf0b3df370c3d6911c" integrity sha512-v2kDEe57lecTulaDIuNTPy3Ry4gLGJ6Z1O3vE1krgXZNrsQ+LFTGHVxVjcXPs17LhbZVGedAJv8XZ1tvj5FvSg== +lodash@^4.17.15, lodash@^4.17.21: + version "4.18.1" + resolved "https://registry.yarnpkg.com/lodash/-/lodash-4.18.1.tgz#ff2b66c1f6326d59513de2407bf881439812771c" + integrity sha512-dMInicTPVE8d1e5otfwmmjlxkZoUpiVLwyeTdUsi/Caj/gfzzblBcCE5sRHV/AsjuCmxWrte2TNGSYuCeCq+0Q== + log-symbols@^4.1.0: version "4.1.0" resolved "https://registry.npmjs.org/log-symbols/-/log-symbols-4.1.0.tgz" From b7009427e9c8273a4ca50a932219d9f1df2864dc Mon Sep 17 00:00:00 2001 From: focuslight-nr <45585253+focuslight-nr@users.noreply.github.com> Date: Fri, 25 Sep 2026 17:21:29 +0900 Subject: [PATCH 2/2] fix(app): bump lodash and lodash-es to 4.18.1 in the Docker build lockfile flowsint-app/Dockerfile (used by docker-compose with context ./flowsint-app) installs from flowsint-app/yarn.lock, not the root lockfile, so the root bump alone does not reach the built image. Same two entries, spliced in unchanged from the root lockfile. A plain `yarn install` in a standalone copy of flowsint-app - what the Dockerfile runs - now resolves lodash and lodash-es to 4.18.1 (4.17.21 before). Co-Authored-By: Claude Opus 5.5 --- flowsint-app/yarn.lock | 13 +++++++++---- 1 file changed, 9 insertions(+), 4 deletions(-) diff --git a/flowsint-app/yarn.lock b/flowsint-app/yarn.lock index 489df5ee2..89902fa0e 100644 --- a/flowsint-app/yarn.lock +++ b/flowsint-app/yarn.lock @@ -5763,9 +5763,9 @@ locate-path@^7.2.0: p-locate "^6.0.0" lodash-es@4: - version "4.17.21" - resolved "https://registry.yarnpkg.com/lodash-es/-/lodash-es-4.17.21.tgz#43e626c46e6591b7750beb2b50117390c609e3ee" - integrity sha512-mKnC+QJ9pWVzv+C4/U3rRsHapFfHvQFoFB92e52xeyGMcX6/OlIl78je1u8vePzYZSkkogMPJ2yjxxsb89cxyw== + version "4.18.1" + resolved "https://registry.yarnpkg.com/lodash-es/-/lodash-es-4.18.1.tgz#b962eeb80d9d983a900bf342961fb7418ca10b1d" + integrity sha512-J8xewKD/Gk22OZbhpOVSwcs60zhd95ESDwezOFuA3/099925PdHJ7OFHNTGtajL3AlZkykD32HykiMo+BIBI8A== lodash.camelcase@^4.3.0: version "4.3.0" @@ -5832,11 +5832,16 @@ lodash.upperfirst@^4.3.1: resolved "https://registry.yarnpkg.com/lodash.upperfirst/-/lodash.upperfirst-4.3.1.tgz#1365edf431480481ef0d1c68957a5ed99d49f7ce" integrity sha512-sReKOYJIJf74dhJONhU4e0/shzi1trVbSWDOhKYE5XV2O+H7Sb2Dihwuc7xWxVl+DgFPyTqIN3zMfT9cq5iWDg== -lodash@4.17.21, lodash@^4.17.15, lodash@^4.17.21: +lodash@4.17.21: version "4.17.21" resolved "https://registry.yarnpkg.com/lodash/-/lodash-4.17.21.tgz#679591c564c3bffaae8454cf0b3df370c3d6911c" integrity sha512-v2kDEe57lecTulaDIuNTPy3Ry4gLGJ6Z1O3vE1krgXZNrsQ+LFTGHVxVjcXPs17LhbZVGedAJv8XZ1tvj5FvSg== +lodash@^4.17.15, lodash@^4.17.21: + version "4.18.1" + resolved "https://registry.yarnpkg.com/lodash/-/lodash-4.18.1.tgz#ff2b66c1f6326d59513de2407bf881439812771c" + integrity sha512-dMInicTPVE8d1e5otfwmmjlxkZoUpiVLwyeTdUsi/Caj/gfzzblBcCE5sRHV/AsjuCmxWrte2TNGSYuCeCq+0Q== + log-symbols@^4.1.0: version "4.1.0" resolved "https://registry.yarnpkg.com/log-symbols/-/log-symbols-4.1.0.tgz#3fbdbb95b4683ac9fc785111e792e558d4abd503"