Summary: pnpm-lock.yaml resolves two lodash-es releases (4.17.21 and 4.17.23), both in the range covered by the prototype pollution advisories affecting the 4.17.x line. Every importer resolving through the lockfile gets the vulnerable releases.
Area: Dependencies (Web UI)
Reproduction or evidence: pnpm-lock.yaml contains lodash-es@4.17.21 and lodash-es@4.17.23 (pulled in via chevrotain and the mermaid/dagre-d3-es subtree); pnpm audit flags lodash-es < 4.18.1 for prototype pollution. The override pins 4.18.1 and the regenerated lock converges both releases onto the patched single version.
Environment: BitFun version/commit 32f2427 (origin/main), pnpm 10.15.0.
Summary: pnpm-lock.yaml resolves two lodash-es releases (4.17.21 and 4.17.23), both in the range covered by the prototype pollution advisories affecting the 4.17.x line. Every importer resolving through the lockfile gets the vulnerable releases.
Area: Dependencies (Web UI)
Reproduction or evidence:
pnpm-lock.yamlcontainslodash-es@4.17.21andlodash-es@4.17.23(pulled in via chevrotain and the mermaid/dagre-d3-es subtree);pnpm auditflags lodash-es < 4.18.1 for prototype pollution. The override pins 4.18.1 and the regenerated lock converges both releases onto the patched single version.Environment: BitFun version/commit 32f2427 (origin/main), pnpm 10.15.0.