chore(deps): bump the npm-security group across 1 directory with 3 updates by dependabot[bot] · Pull Request #42 · github/github-well-architected

dependabot · 2026-02-28T11:01:40Z

Bumps the npm-security group with 3 updates in the / directory: webpack, lodash and tar.

Updates webpack from 5.102.1 to 5.106.2

Release notes

v5.106.2

Patch Changes

CSS @import now inherits the parent module's exportType, so a file configured as "text" correctly creates a style tag when @imported by a "style" parent. (by @xiaoxiaojx in #20838)

Make asset modules available in JS context when referenced from both CSS and a lazily compiled JS chunk. (by @xiaoxiaojx in #20801)

Include missing generator options in hash to ensure persistent cache invalidation when configuration changes (CssGenerator exportsOnly, JsonGenerator JSONParse, WebAssemblyGenerator mangleImports). (by @xiaoxiaojx in #20821)

Fix || default value handling in ProgressPlugin and ManifestPlugin that incorrectly overrode user-provided falsy values (e.g. modules: false, entries: false, entrypoints: false). (by @xiaoxiaojx in #20823)

Migrate from mime-types to mime-db. (by @alexander-akait in #20812)

Handle @charset at-rules in CSS modules. (by @alexander-akait in #20831)

Marked all experimental options in types. (by @alexander-akait in #20814)

v5.106.1

Patch Changes

Fix two ES5-environment regressions in the anonymous default export .name fix-up: the generated code referenced an undeclared __WEBPACK_DEFAULT_EXPORT__ binding causing ReferenceError, and used Reflect.defineProperty which is not available in pre-ES2015 runtimes. The fix-up now references the real assignment target and uses Object.defineProperty / Object.getOwnPropertyDescriptor. (by @xiaoxiaojx in #20796)

Prevent !important from being renamed as a local identifier in CSS modules. (by @xiaoxiaojx in #20798)

Use compiler context instead of module context for CSS modules local ident hashing to avoid hash collisions when files with the same name exist in different directories. (by @xiaoxiaojx in #20799)

v5.106.0

Minor Changes

Add exportType: "style" for CSS modules to inject styles into DOM via HTMLStyleElement, similar to style-loader functionality. (by @xiaoxiaojx in #20579)

Add context option support for VirtualUrlPlugin (by @xiaoxiaojx in #20449)

The context for the virtual module. A string path. Defaults to 'auto', which will try to resolve the context from the module id.

Support custom context path for resolving relative imports in virtual modules

Add examples demonstrating context usage and filename customization

Generate different CssModule instances for different exportType values. (by @xiaoxiaojx in #20590)

Added the localIdentHashFunction option to configure the hash function to be used for hashing. (by @alexander-akait in #20694) Additionally, the localIdentName option can now be a function.

Added support for destructuring assignment require in cjs, allowing for tree shaking. (by @ahabhgk in #20548)

Added the validate option to enable/disable validation in webpack/plugins/loaders, also implemented API to make it inside plugins. (by @xiaoxiaojx in #20275)

Added source support for async WASM modules. (by @magic-akari in #20364)

Patch Changes

Add a static getSourceBasicTypes method to the Module class to prevent errors across multiple versions. (by @xiaoxiaojx in #20614)

... (truncated)

Changelog

Sourced from webpack's changelog.

5.106.2

Patch Changes

CSS @import now inherits the parent module's exportType, so a file configured as "text" correctly creates a style tag when @imported by a "style" parent. (by @xiaoxiaojx in #20838)

Make asset modules available in JS context when referenced from both CSS and a lazily compiled JS chunk. (by @xiaoxiaojx in #20801)

Include missing generator options in hash to ensure persistent cache invalidation when configuration changes (CssGenerator exportsOnly, JsonGenerator JSONParse, WebAssemblyGenerator mangleImports). (by @xiaoxiaojx in #20821)

Fix || default value handling in ProgressPlugin and ManifestPlugin that incorrectly overrode user-provided falsy values (e.g. modules: false, entries: false, entrypoints: false). (by @xiaoxiaojx in #20823)

Migrate from mime-types to mime-db. (by @alexander-akait in #20812)

Handle @charset at-rules in CSS modules. (by @alexander-akait in #20831)

Marked all experimental options in types. (by @alexander-akait in #20814)

5.106.1

Patch Changes

Fix two ES5-environment regressions in the anonymous default export .name fix-up: the generated code referenced an undeclared __WEBPACK_DEFAULT_EXPORT__ binding causing ReferenceError, and used Reflect.defineProperty which is not available in pre-ES2015 runtimes. The fix-up now references the real assignment target and uses Object.defineProperty / Object.getOwnPropertyDescriptor. (by @xiaoxiaojx in #20796)

Prevent !important from being renamed as a local identifier in CSS modules. (by @xiaoxiaojx in #20798)

Use compiler context instead of module context for CSS modules local ident hashing to avoid hash collisions when files with the same name exist in different directories. (by @xiaoxiaojx in #20799)

5.106.0

Minor Changes

Add exportType: "style" for CSS modules to inject styles into DOM via HTMLStyleElement, similar to style-loader functionality. (by @xiaoxiaojx in #20579)

Add context option support for VirtualUrlPlugin (by @xiaoxiaojx in #20449)

The context for the virtual module. A string path. Defaults to 'auto', which will try to resolve the context from the module id.

Support custom context path for resolving relative imports in virtual modules

Add examples demonstrating context usage and filename customization

Generate different CssModule instances for different exportType values. (by @xiaoxiaojx in #20590)

Added the localIdentHashFunction option to configure the hash function to be used for hashing. (by @alexander-akait in #20694) Additionally, the localIdentName option can now be a function.

Added support for destructuring assignment require in cjs, allowing for tree shaking. (by @ahabhgk in #20548)

Added the validate option to enable/disable validation in webpack/plugins/loaders, also implemented API to make it inside plugins. (by @xiaoxiaojx in #20275)

Added source support for async WASM modules. (by @magic-akari in #20364)

... (truncated)

Commits

0d7e3e0 chore(release): new release (#20815)
d5df118 chore(deps): bump actions/cache in the dependencies group (#20839)
5f0874b fix: make asset modules available in JS when referenced from CSS and lazy JS ...
b63ab37 chore(deps): bump test/test262-cases in the dependencies group (#20792)
313dfc5 ci: improve time for windows (#20840)
a553f61 test: update test262 (#20841)
1ef747c fix: CSS @import should inherit parent's exportType over parser config (#20838)
485d4ce chore(deps): update open-cli (#20834)
46042b9 chore(deps): no outdated strip-ansi (#20835)
8c7700b fix: handle @charset at-rules in CSS modules
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for webpack since your current version.

Updates lodash from 4.17.21 to 4.18.1

Release notes

Sourced from lodash's releases.

4.18.1

Bugs

Fixes a ReferenceError issue in lodash lodash-es lodash-amd and lodash.template when using the template and fromPairs functions from the modular builds. See lodash/lodash#6167

These defects were related to how lodash distributions are built from the main branch using https://github.com/lodash-archive/lodash-cli. When internal dependencies change inside lodash functions, equivalent updates need to be made to a mapping in the lodash-cli. (hey, it was ahead of its time once upon a time!). We know this, but we missed it in the last release. It's the kind of thing that passes in CI, but fails bc the build is not the same thing you tested.

There is no diff on main for this, but you can see the diffs for each of the npm packages on their respective branches:

lodash: lodash/lodash@4.18.0-npm...4.18.1-npm

lodash-es: lodash/lodash@4.18.0-es...4.18.1-es

lodash-amd: lodash/lodash@4.18.0-amd...4.18.1-amd

lodash.templatelodash/lodash@4.18.0-npm-packages...4.18.1-npm-packages

4.18.0

v4.18.0

Full Changelog: lodash/lodash@4.17.23...4.18.0

Security

_.unset / _.omit: Fixed prototype pollution via constructor/prototype path traversal (GHSA-f23m-r3pf-42rh, fe8d32e). Previously, array-wrapped path segments and primitive roots could bypass the existing guards, allowing deletion of properties from built-in prototypes. Now constructor and prototype are blocked unconditionally as non-terminal path keys, matching baseSet. Calls that previously returned true and deleted the property now return false and leave the target untouched.

_.template: Fixed code injection via imports keys (GHSA-r5fr-rjxr-66jc, CVE-2026-4800, 879aaa9). Fixes an incomplete patch for CVE-2021-23337. The variable option was validated against reForbiddenIdentifierChars but importsKeys was left unguarded, allowing code injection via the same Function() constructor sink. imports keys containing forbidden identifier characters now throw "Invalid imports option passed into _.template".

Docs

Add security notice for _.template in threat model and API docs (#6099)

Document lower > upper behavior in _.random (#6115)

Fix quotes in _.compact jsdoc (#6090)

lodash.* modular packages

Diff

We have also regenerated and published a select number of the lodash.* modular packages.

These modular packages had fallen out of sync significantly from the minor/patch updates to lodash. Specifically, we have brought the following packages up to parity w/ the latest lodash release because they have had CVEs on them in the past:

lodash.orderby

lodash.tonumber

lodash.trim

lodash.trimend

lodash.sortedindexby

lodash.zipobjectdeep

lodash.unset

lodash.omit

lodash.template

Commits

cb0b9b9 release(patch): bump main to 4.18.1 (#6177)
75535f5 chore: prune stale advisory refs (#6170)
62e91bc docs: remove n_ Node.js < 6 REPL note from README (#6165)
59be2de release(minor): bump to 4.18.0 (#6161)
af63457 fix: broken tests for _.template 879aaa9
1073a76 fix: linting issues
879aaa9 fix: validate imports keys in _.template
fe8d32e fix: block prototype pollution in baseUnset via constructor/prototype traversal
18ba0a3 refactor(fromPairs): use baseAssignValue for consistent assignment (#6153)
b819080 ci: add dist sync validation workflow (#6137)
Additional commits viewable in compare view

Updates tar from 7.5.2 to 7.5.13

Commits

d6611ae 7.5.13
119c401 fix(extract): prevent raced symlink writes outside cwd
2a294d3 7.5.12
01082a4 fix: reject top promise on floating addFilesAsync rejections
dd1c36a linting
35a1ffe doc: more clarity in security warning
bf776f6 7.5.11
f48b5fa prevent escaping symlinks with drive-relative paths
97cff15 docs: more security info
2b72abc 7.5.10
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by isaacs, a new releaser for tar since your current version.

Install script changes

This version adds prepare script that runs during installation. Review the package contents before updating.

github-actions · 2026-02-28T11:02:01Z

Dependency Review

The following issues were found:

✅ 0 vulnerable package(s)
✅ 0 package(s) with incompatible licenses
✅ 0 package(s) with invalid SPDX license definitions
⚠️ 2 package(s) with unknown licenses.
⚠️ 1 packages with OpenSSF Scorecard issues.

See the Details below.

License Issues

package-lock.json

Package	Version	License	Issue Type
baseline-browser-mapping	2.10.25	Null	Unknown License
electron-to-chromium	1.5.348	Null	Unknown License

OpenSSF Scorecard

Scorecard details

Package

Version

Score

Details

npm/@jridgewell/source-map

0.3.11

Unknown

npm/acorn

8.16.0

🟢 5

Details

Check	Score	Reason
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
Maintained	🟢 10	10 commit(s) and 7 issue activity found in the last 90 days -- score normalized to 10
Code-Review	🟢 3	Found 11/29 approved changesets -- score normalized to 3
Packaging	⚠️ -1	packaging workflow not detected
Token-Permissions	🟢 10	GitHub workflow tokens follow principle of least privilege
Binary-Artifacts	🟢 10	no binaries found in the repo
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
Pinned-Dependencies	🟢 3	dependency not pinned by hash detected -- score normalized to 3
Security-Policy	⚠️ 0	security policy file not detected
License	⚠️ 0	license file not detected
Signed-Releases	⚠️ -1	no releases found
Branch-Protection	⚠️ 0	branch protection not enabled on development/release branches
Fuzzing	⚠️ 0	project is not fuzzed
SAST	⚠️ 0	SAST tool is not run on all commits -- score normalized to 0

npm/ajv

8.20.0

🟢 5

Details

Check	Score	Reason
Code-Review	⚠️ 1	Found 3/30 approved changesets -- score normalized to 1
Security-Policy	🟢 10	security policy file detected
Maintained	🟢 8	8 commit(s) and 2 issue activity found in the last 90 days -- score normalized to 8
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
Packaging	⚠️ -1	packaging workflow not detected
Token-Permissions	⚠️ 0	detected GitHub workflow tokens with excessive permissions
Binary-Artifacts	🟢 10	no binaries found in the repo
Pinned-Dependencies	⚠️ 0	dependency not pinned by hash detected -- score normalized to 0
CII-Best-Practices	⚠️ 2	badge detected: InProgress
License	🟢 10	license file detected
Fuzzing	⚠️ 0	project is not fuzzed
Signed-Releases	⚠️ -1	no releases found
Branch-Protection	⚠️ -1	internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
SAST	⚠️ 0	SAST tool is not run on all commits -- score normalized to 0

npm/baseline-browser-mapping

2.10.25

Unknown

npm/browserslist

4.28.2

🟢 6

Details

Check	Score	Reason
Maintained	🟢 10	22 commit(s) and 3 issue activity found in the last 90 days -- score normalized to 10
Security-Policy	🟢 10	security policy file detected
Packaging	⚠️ -1	packaging workflow not detected
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
Code-Review	⚠️ 0	Found 1/26 approved changesets -- score normalized to 0
Token-Permissions	⚠️ 0	detected GitHub workflow tokens with excessive permissions
Binary-Artifacts	🟢 10	no binaries found in the repo
Pinned-Dependencies	🟢 10	all dependencies are pinned
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
Fuzzing	⚠️ 0	project is not fuzzed
License	🟢 10	license file detected
Signed-Releases	⚠️ -1	no releases found
Branch-Protection	🟢 3	branch protection is not maximal on development and all release branches
SAST	🟢 7	SAST tool is not run on all commits -- score normalized to 7

npm/caniuse-lite

1.0.30001791

🟢 4.5

Details

Check	Score	Reason
Code-Review	⚠️ 0	Found 0/30 approved changesets -- score normalized to 0
Maintained	🟢 10	26 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 10
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
Packaging	⚠️ -1	packaging workflow not detected
Token-Permissions	⚠️ 0	detected GitHub workflow tokens with excessive permissions
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
SAST	⚠️ 0	no SAST tool detected
Binary-Artifacts	🟢 10	no binaries found in the repo
Security-Policy	⚠️ 0	security policy file not detected
Pinned-Dependencies	🟢 10	all dependencies are pinned
License	🟢 10	license file detected
Signed-Releases	⚠️ -1	no releases found
Fuzzing	⚠️ 0	project is not fuzzed
Branch-Protection	⚠️ 0	branch protection not enabled on development/release branches

npm/electron-to-chromium

1.5.348

🟢 4.5

Details

Check	Score	Reason
Code-Review	⚠️ 0	Found 0/22 approved changesets -- score normalized to 0
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
Maintained	🟢 10	30 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 10
Binary-Artifacts	🟢 10	no binaries found in the repo
Token-Permissions	⚠️ 0	detected GitHub workflow tokens with excessive permissions
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
Pinned-Dependencies	🟢 4	dependency not pinned by hash detected -- score normalized to 4
Security-Policy	⚠️ 0	security policy file not detected
Fuzzing	⚠️ 0	project is not fuzzed
License	🟢 10	license file detected
Branch-Protection	⚠️ 0	branch protection not enabled on development/release branches
Signed-Releases	⚠️ -1	no releases found
Packaging	🟢 10	packaging workflow detected
SAST	⚠️ 0	SAST tool is not run on all commits -- score normalized to 0

npm/enhanced-resolve

5.21.0

🟢 5.6

Details

Check	Score	Reason
Maintained	🟢 10	30 commit(s) and 13 issue activity found in the last 90 days -- score normalized to 10
Code-Review	⚠️ 0	Found 0/12 approved changesets -- score normalized to 0
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
Packaging	⚠️ -1	packaging workflow not detected
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
Token-Permissions	⚠️ 0	detected GitHub workflow tokens with excessive permissions
Pinned-Dependencies	🟢 8	dependency not pinned by hash detected -- score normalized to 8
Binary-Artifacts	🟢 10	no binaries found in the repo
License	🟢 10	license file detected
Fuzzing	⚠️ 0	project is not fuzzed
Signed-Releases	⚠️ -1	no releases found
Security-Policy	🟢 10	security policy file detected
Branch-Protection	🟢 5	branch protection is not maximal on development and all release branches
SAST	⚠️ 0	SAST tool is not run on all commits -- score normalized to 0

npm/es-module-lexer

2.1.0

⚠️ 2.9

Details

Check	Score	Reason
Token-Permissions	⚠️ 0	detected GitHub workflow tokens with excessive permissions
Code-Review	⚠️ 0	Found 2/30 approved changesets -- score normalized to 0
Maintained	⚠️ 2	3 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 2
Packaging	⚠️ -1	packaging workflow not detected
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
Binary-Artifacts	🟢 9	binaries present in source code
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
Pinned-Dependencies	⚠️ 0	dependency not pinned by hash detected -- score normalized to 0
License	🟢 10	license file detected
Signed-Releases	⚠️ -1	no releases found
Branch-Protection	⚠️ 0	branch protection not enabled on development/release branches
Security-Policy	⚠️ 0	security policy file not detected
Fuzzing	⚠️ 0	project is not fuzzed
SAST	⚠️ 0	SAST tool is not run on all commits -- score normalized to 0

npm/fast-uri

3.1.0

Unknown

npm/loader-runner

4.3.2

🟢 4.4

Details

Check	Score	Reason
Packaging	⚠️ -1	packaging workflow not detected
Code-Review	⚠️ 1	Found 3/19 approved changesets -- score normalized to 1
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
Maintained	🟢 3	4 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 3
Token-Permissions	⚠️ 0	detected GitHub workflow tokens with excessive permissions
Binary-Artifacts	🟢 10	no binaries found in the repo
Pinned-Dependencies	⚠️ 1	dependency not pinned by hash detected -- score normalized to 1
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
Fuzzing	⚠️ 0	project is not fuzzed
License	🟢 10	license file detected
Signed-Releases	⚠️ -1	no releases found
Security-Policy	🟢 10	security policy file detected
Branch-Protection	🟢 5	branch protection is not maximal on development and all release branches
SAST	⚠️ 0	SAST tool is not run on all commits -- score normalized to 0

npm/lodash

4.18.1

🟢 6.9

Details

Check	Score	Reason
Binary-Artifacts	🟢 10	no binaries found in the repo
Branch-Protection	⚠️ -1	internal error: error during branchesHandler.setup: internal error: githubv4.Query: Resource not accessible by integration
CI-Tests	🟢 9	20 out of 21 merged PRs checked by a CI test -- score normalized to 9
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
Code-Review	🟢 6	Found 20/30 approved changesets -- score normalized to 6
Contributors	🟢 10	project has 89 contributing companies or organizations
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
Dependency-Update-Tool	🟢 10	update tool detected
Fuzzing	🟢 10	project is fuzzed
License	🟢 9	license file detected
Maintained	🟢 10	13 commit(s) and 15 issue activity found in the last 90 days -- score normalized to 10
Packaging	⚠️ -1	packaging workflow not detected
Pinned-Dependencies	⚠️ 1	dependency not pinned by hash detected -- score normalized to 1
SAST	🟢 9	SAST tool detected but not run on all commits
Security-Policy	🟢 10	security policy file detected
Signed-Releases	⚠️ -1	no releases found
Token-Permissions	⚠️ 0	detected GitHub workflow tokens with excessive permissions
Vulnerabilities	⚠️ 0	97 existing vulnerabilities detected

npm/mime-db

1.54.0

🟢 6.9

Details

Check	Score	Reason
Binary-Artifacts	🟢 10	no binaries found in the repo
Branch-Protection	🟢 5	branch protection is not maximal on development and all release branches
CI-Tests	🟢 7	17 out of 22 merged PRs checked by a CI test -- score normalized to 7
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
Code-Review	🟢 4	Found 6/14 approved changesets -- score normalized to 4
Contributors	🟢 10	project has 28 contributing companies or organizations
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
Dependency-Update-Tool	🟢 10	update tool detected
Fuzzing	⚠️ 0	project is not fuzzed
License	🟢 10	license file detected
Maintained	🟢 10	13 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 10
Packaging	⚠️ -1	packaging workflow not detected
Pinned-Dependencies	⚠️ 2	dependency not pinned by hash detected -- score normalized to 2
SAST	🟢 9	SAST tool detected but not run on all commits
Security-Policy	🟢 9	security policy file detected
Signed-Releases	⚠️ -1	no releases found
Token-Permissions	⚠️ 0	detected GitHub workflow tokens with excessive permissions
Vulnerabilities	🟢 10	0 existing vulnerabilities detected

npm/node-releases

2.0.38

🟢 3.8

Details

Check	Score	Reason
Code-Review	⚠️ 0	Found 0/30 approved changesets -- score normalized to 0
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
Maintained	🟢 9	11 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 9
Binary-Artifacts	🟢 10	no binaries found in the repo
Token-Permissions	⚠️ 0	detected GitHub workflow tokens with excessive permissions
Packaging	⚠️ -1	packaging workflow not detected
Pinned-Dependencies	⚠️ 2	dependency not pinned by hash detected -- score normalized to 2
SAST	⚠️ 0	no SAST tool detected
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
Security-Policy	⚠️ 0	security policy file not detected
Fuzzing	⚠️ 0	project is not fuzzed
License	🟢 10	license file detected
Signed-Releases	⚠️ -1	no releases found
Branch-Protection	⚠️ 0	branch protection not enabled on development/release branches

npm/tapable

2.3.3

🟢 5.7

Details

Check	Score	Reason
Code-Review	⚠️ 1	Found 2/19 approved changesets -- score normalized to 1
Maintained	🟢 10	24 commit(s) and 4 issue activity found in the last 90 days -- score normalized to 10
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
Packaging	⚠️ -1	packaging workflow not detected
Binary-Artifacts	🟢 10	no binaries found in the repo
Token-Permissions	⚠️ 0	detected GitHub workflow tokens with excessive permissions
Pinned-Dependencies	🟢 8	dependency not pinned by hash detected -- score normalized to 8
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
Fuzzing	⚠️ 0	project is not fuzzed
License	🟢 10	license file detected
Security-Policy	🟢 10	security policy file detected
Signed-Releases	⚠️ -1	no releases found
Branch-Protection	🟢 5	branch protection is not maximal on development and all release branches
SAST	⚠️ 0	SAST tool is not run on all commits -- score normalized to 0

npm/tar

7.5.13

🟢 6.2

Details

Check	Score	Reason
Code-Review	⚠️ 0	Found 1/30 approved changesets -- score normalized to 0
Maintained	🟢 10	18 commit(s) and 4 issue activity found in the last 90 days -- score normalized to 10
Packaging	⚠️ -1	packaging workflow not detected
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
Token-Permissions	🟢 10	GitHub workflow tokens follow principle of least privilege
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
Binary-Artifacts	🟢 10	no binaries found in the repo
Pinned-Dependencies	⚠️ 0	dependency not pinned by hash detected -- score normalized to 0
License	🟢 10	license file detected
Fuzzing	⚠️ 0	project is not fuzzed
Branch-Protection	⚠️ -1	internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
Security-Policy	🟢 10	security policy file detected
Signed-Releases	⚠️ -1	no releases found
SAST	⚠️ 0	SAST tool is not run on all commits -- score normalized to 0

npm/terser

5.46.2

🟢 5.8

Details

Check	Score	Reason
Packaging	⚠️ -1	packaging workflow not detected
Security-Policy	🟢 10	security policy file detected
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
Maintained	🟢 10	12 commit(s) and 13 issue activity found in the last 90 days -- score normalized to 10
Code-Review	⚠️ 0	Found 2/30 approved changesets -- score normalized to 0
Token-Permissions	🟢 10	GitHub workflow tokens follow principle of least privilege
Binary-Artifacts	🟢 10	no binaries found in the repo
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
Pinned-Dependencies	🟢 5	dependency not pinned by hash detected -- score normalized to 5
License	🟢 9	license file detected
Fuzzing	⚠️ 0	project is not fuzzed
Signed-Releases	⚠️ -1	no releases found
Branch-Protection	⚠️ 0	branch protection not enabled on development/release branches
SAST	⚠️ 0	SAST tool is not run on all commits -- score normalized to 0

npm/terser-webpack-plugin

5.5.0

Unknown

npm/update-browserslist-db

1.2.3

🟢 3.7

Details

Check	Score	Reason
Code-Review	⚠️ 1	Found 3/27 approved changesets -- score normalized to 1
Maintained	⚠️ 1	1 commit(s) and 1 issue activity found in the last 90 days -- score normalized to 1
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
Binary-Artifacts	🟢 10	no binaries found in the repo
Packaging	⚠️ -1	packaging workflow not detected
Token-Permissions	⚠️ 0	detected GitHub workflow tokens with excessive permissions
Pinned-Dependencies	🟢 10	all dependencies are pinned
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
Security-Policy	⚠️ 0	security policy file not detected
Fuzzing	⚠️ 0	project is not fuzzed
License	🟢 10	license file detected
Signed-Releases	⚠️ -1	no releases found
Branch-Protection	⚠️ 0	branch protection not enabled on development/release branches
SAST	⚠️ 0	SAST tool is not run on all commits -- score normalized to 0

npm/watchpack

2.5.1

🟢 5.6

Details

Check	Score	Reason
Code-Review	⚠️ 0	Found 0/14 approved changesets -- score normalized to 0
Maintained	🟢 10	28 commit(s) and 3 issue activity found in the last 90 days -- score normalized to 10
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
Binary-Artifacts	🟢 10	no binaries found in the repo
Packaging	⚠️ -1	packaging workflow not detected
Token-Permissions	⚠️ 0	detected GitHub workflow tokens with excessive permissions
Pinned-Dependencies	🟢 8	dependency not pinned by hash detected -- score normalized to 8
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
Fuzzing	⚠️ 0	project is not fuzzed
License	🟢 10	license file detected
Signed-Releases	⚠️ -1	no releases found
Security-Policy	🟢 10	security policy file detected
Branch-Protection	🟢 5	branch protection is not maximal on development and all release branches
SAST	⚠️ 0	SAST tool is not run on all commits -- score normalized to 0

npm/webpack

5.106.2

🟢 5.5

Details

Check	Score	Reason
Maintained	🟢 10	30 commit(s) and 18 issue activity found in the last 90 days -- score normalized to 10
Packaging	⚠️ -1	packaging workflow not detected
Code-Review	🟢 3	Found 6/20 approved changesets -- score normalized to 3
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
Token-Permissions	⚠️ 0	detected GitHub workflow tokens with excessive permissions
CII-Best-Practices	⚠️ 2	badge detected: InProgress
License	🟢 10	license file detected
Signed-Releases	⚠️ -1	no releases found
Security-Policy	🟢 10	security policy file detected
Pinned-Dependencies	🟢 10	all dependencies are pinned
Binary-Artifacts	⚠️ 0	binaries present in source code
Branch-Protection	🟢 5	branch protection is not maximal on development and all release branches
Fuzzing	⚠️ 0	project is not fuzzed
SAST	🟢 7	SAST tool is not run on all commits -- score normalized to 7

npm/webpack-sources

3.4.1

🟢 5.5

Details

Check	Score	Reason
Code-Review	⚠️ 0	Found 0/12 approved changesets -- score normalized to 0
Packaging	⚠️ -1	packaging workflow not detected
Maintained	🟢 10	30 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 10
Binary-Artifacts	🟢 10	no binaries found in the repo
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
Token-Permissions	⚠️ 0	detected GitHub workflow tokens with excessive permissions
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
Pinned-Dependencies	🟢 7	dependency not pinned by hash detected -- score normalized to 7
Fuzzing	⚠️ 0	project is not fuzzed
License	🟢 10	license file detected
Signed-Releases	⚠️ -1	no releases found
Branch-Protection	🟢 5	branch protection is not maximal on development and all release branches
Security-Policy	🟢 10	security policy file detected
SAST	⚠️ 0	SAST tool is not run on all commits -- score normalized to 0

Scanned Files

package-lock.json

…dates Bumps the npm-security group with 3 updates in the / directory: [webpack](https://github.com/webpack/webpack), [lodash](https://github.com/lodash/lodash) and [tar](https://github.com/isaacs/node-tar). Updates `webpack` from 5.102.1 to 5.106.2 - [Release notes](https://github.com/webpack/webpack/releases) - [Changelog](https://github.com/webpack/webpack/blob/main/CHANGELOG.md) - [Commits](webpack/webpack@v5.102.1...v5.106.2) Updates `lodash` from 4.17.21 to 4.18.1 - [Release notes](https://github.com/lodash/lodash/releases) - [Commits](lodash/lodash@4.17.21...4.18.1) Updates `tar` from 7.5.2 to 7.5.13 - [Release notes](https://github.com/isaacs/node-tar/releases) - [Changelog](https://github.com/isaacs/node-tar/blob/main/CHANGELOG.md) - [Commits](isaacs/node-tar@v7.5.2...v7.5.13) --- updated-dependencies: - dependency-name: lodash dependency-version: 4.17.23 dependency-type: indirect dependency-group: npm-security - dependency-name: tar dependency-version: 7.5.9 dependency-type: indirect dependency-group: npm-security - dependency-name: webpack dependency-version: 5.105.3 dependency-type: direct:development dependency-group: npm-security ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Feb 28, 2026

dependabot Bot requested a review from a team as a code owner February 28, 2026 11:01

dependabot Bot added the dependencies Pull requests that update a dependency file label Feb 28, 2026

dependabot Bot requested review from a team as code owners February 28, 2026 11:01

dependabot Bot added the javascript Pull requests that update javascript code label Feb 28, 2026

This was referenced Feb 28, 2026

Bump lodash from 4.17.21 to 4.17.23 #26

Closed

Bump tar from 7.5.2 to 7.5.7 #30

Closed

dependabot Bot temporarily deployed to development February 28, 2026 11:01 Inactive

github-actions Bot added the ready for review label Feb 28, 2026

stoe enabled auto-merge (squash) February 28, 2026 11:30

dependabot Bot force-pushed the dependabot/npm_and_yarn/npm-security-bec2176354 branch from 6a75191 to b81fdc9 Compare March 9, 2026 16:14

dependabot Bot temporarily deployed to development March 9, 2026 16:14 Inactive

dependabot Bot force-pushed the dependabot/npm_and_yarn/npm-security-bec2176354 branch from b81fdc9 to 1abf6cb Compare March 11, 2026 14:42

dependabot Bot temporarily deployed to development March 11, 2026 14:42 Inactive

dependabot Bot force-pushed the dependabot/npm_and_yarn/npm-security-bec2176354 branch from 1abf6cb to 020b758 Compare March 12, 2026 14:37

dependabot Bot temporarily deployed to development March 12, 2026 14:37 Inactive

dependabot Bot force-pushed the dependabot/npm_and_yarn/npm-security-bec2176354 branch from 020b758 to ced6b6f Compare March 18, 2026 14:38

dependabot Bot temporarily deployed to development March 18, 2026 14:38 Inactive

dependabot Bot force-pushed the dependabot/npm_and_yarn/npm-security-bec2176354 branch from ced6b6f to a5b3922 Compare March 19, 2026 12:12

dependabot Bot requested a review from bot-digital-customer-success as a code owner March 19, 2026 12:12

dependabot Bot temporarily deployed to development March 19, 2026 12:13 Inactive

dependabot Bot force-pushed the dependabot/npm_and_yarn/npm-security-bec2176354 branch from a5b3922 to 6814d81 Compare April 1, 2026 18:38

dependabot Bot temporarily deployed to development April 1, 2026 18:38 Inactive

dependabot Bot force-pushed the dependabot/npm_and_yarn/npm-security-bec2176354 branch from 6814d81 to 1be3789 Compare May 1, 2026 17:32

dependabot Bot had a problem deploying to development May 1, 2026 17:32 Failure

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

chore(deps): bump the npm-security group across 1 directory with 3 updates#42

chore(deps): bump the npm-security group across 1 directory with 3 updates#42
dependabot[bot] wants to merge 1 commit intomainfrom
dependabot/npm_and_yarn/npm-security-bec2176354

dependabot Bot commented on behalf of github Feb 28, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented Feb 28, 2026 •

edited

Loading

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

dependabot Bot commented on behalf of github Feb 28, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

v5.106.2

Patch Changes

v5.106.1

Patch Changes

v5.106.0

Minor Changes

Patch Changes

5.106.2

Patch Changes

5.106.1

Patch Changes

5.106.0

Minor Changes

4.18.1

Bugs

4.18.0

v4.18.0

Security

Docs

lodash.* modular packages

Uh oh!

github-actions Bot commented Feb 28, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Dependency Review

License Issues

package-lock.json

OpenSSF Scorecard

Scanned Files

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

dependabot Bot commented on behalf of github Feb 28, 2026 •

edited

Loading

`lodash.*` modular packages

github-actions Bot commented Feb 28, 2026 •

edited

Loading