From dab50e352dc2f216b8000538c39fc8ecfbc6b9d2 Mon Sep 17 00:00:00 2001 From: Susmitha Girumala Date: Thu, 9 Apr 2026 16:14:45 -0400 Subject: [PATCH] =?UTF-8?q?chore:=20=F0=9F=A4=96=20Update=20underscore=20t?= =?UTF-8?q?o=20fix=20vulnerability=20(#3231)?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit * chore: 🤖 Update underscore to fix vulnerability Code scanning identified a potential DoS attach for underscore versions not using latest 1.13.8 release ✅ Closes: https://github.com/jashkenas/underscore/issues/3011 * chore: 🤖 Remove nomnom module underscore override --- package.json | 4 ++-- pnpm-lock.yaml | 64 +++++++++++++++++++++++++------------------------- 2 files changed, 34 insertions(+), 34 deletions(-) diff --git a/package.json b/package.json index c0676c498..255e4ed0f 100755 --- a/package.json +++ b/package.json @@ -44,7 +44,6 @@ }, "pnpm": { "overrides": { - "nomnom>underscore": "^1.12.1", "micromatch": "^4.0.8", "css-select>nth-check": "^2.0.1", "node-gyp": "^10.0.0", @@ -54,7 +53,8 @@ "ember-try-config>package-json": "^10.0.1", "ember-loading>ember-concurrency": "^4.0.0", "tmp": "^0.2.5", - "tar": "^7.5.10" + "tar": "^7.5.10", + "underscore": "^1.13.8" }, "ignoredBuiltDependencies": [ "@parcel/watcher", diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml index 99c97f3af..62f25b9e6 100644 --- a/pnpm-lock.yaml +++ b/pnpm-lock.yaml @@ -5,7 +5,6 @@ settings: excludeLinksFromLockfile: false overrides: - nomnom>underscore: ^1.12.1 micromatch: ^4.0.8 css-select>nth-check: ^2.0.1 node-gyp: ^10.0.0 @@ -16,6 +15,7 @@ overrides: ember-loading>ember-concurrency: ^4.0.0 tmp: ^0.2.5 tar: ^7.5.10 + underscore: ^1.13.8 patchedDependencies: ember-loading: @@ -155,13 +155,13 @@ importers: version: 2.2.0 ember-cli: specifier: ~5.12.0 - version: 5.12.0(handlebars@4.7.9)(underscore@1.13.7) + version: 5.12.0(handlebars@4.7.9)(underscore@1.13.8) ember-cli-clean-css: specifier: ^3.0.0 version: 3.0.0 ember-cli-dependency-checker: specifier: ^3.3.2 - version: 3.3.3(ember-cli@5.12.0(handlebars@4.7.9)(underscore@1.13.7)) + version: 3.3.3(ember-cli@5.12.0(handlebars@4.7.9)(underscore@1.13.8)) ember-cli-inject-live-reload: specifier: ^2.1.0 version: 2.1.0 @@ -288,13 +288,13 @@ importers: version: 2.2.0 ember-cli: specifier: ~5.12.0 - version: 5.12.0(handlebars@4.7.9)(underscore@1.13.7) + version: 5.12.0(handlebars@4.7.9)(underscore@1.13.8) ember-cli-clean-css: specifier: ^3.0.0 version: 3.0.0 ember-cli-dependency-checker: specifier: ^3.3.2 - version: 3.3.3(ember-cli@5.12.0(handlebars@4.7.9)(underscore@1.13.7)) + version: 3.3.3(ember-cli@5.12.0(handlebars@4.7.9)(underscore@1.13.8)) ember-cli-inject-live-reload: specifier: ^2.1.0 version: 2.1.0 @@ -469,13 +469,13 @@ importers: version: 2.2.0 ember-cli: specifier: ~5.12.0 - version: 5.12.0(handlebars@4.7.9)(underscore@1.13.7) + version: 5.12.0(handlebars@4.7.9)(underscore@1.13.8) ember-cli-clean-css: specifier: ^3.0.0 version: 3.0.0 ember-cli-dependency-checker: specifier: ^3.3.2 - version: 3.3.3(ember-cli@5.12.0(handlebars@4.7.9)(underscore@1.13.7)) + version: 3.3.3(ember-cli@5.12.0(handlebars@4.7.9)(underscore@1.13.8)) ember-cli-inject-live-reload: specifier: ^2.1.0 version: 2.1.0 @@ -644,13 +644,13 @@ importers: version: 2.2.0 ember-cli: specifier: ~5.12.0 - version: 5.12.0(handlebars@4.7.9)(underscore@1.13.7) + version: 5.12.0(handlebars@4.7.9)(underscore@1.13.8) ember-cli-clean-css: specifier: ^3.0.0 version: 3.0.0 ember-cli-dependency-checker: specifier: ^3.3.2 - version: 3.3.3(ember-cli@5.12.0(handlebars@4.7.9)(underscore@1.13.7)) + version: 3.3.3(ember-cli@5.12.0(handlebars@4.7.9)(underscore@1.13.8)) ember-cli-inject-live-reload: specifier: ^2.1.0 version: 2.1.0 @@ -879,7 +879,7 @@ importers: version: 8.8.0(@babel/core@7.27.1)(@ember/string@4.0.1)(@ember/test-helpers@5.2.2(@babel/core@7.27.1)(@glint/template@1.5.2))(@glimmer/component@2.0.0)(@glint/template@1.5.2)(ember-source@5.12.0(@glimmer/component@2.0.0)(@glint/template@1.5.2)(rsvp@4.8.5)(webpack@5.105.4(esbuild@0.25.9))) ember-cli: specifier: ~5.12.0 - version: 5.12.0(handlebars@4.7.9)(underscore@1.13.7) + version: 5.12.0(handlebars@4.7.9)(underscore@1.13.8) ember-cli-babel: specifier: ^8.2.0 version: 8.2.0(@babel/core@7.27.1) @@ -894,7 +894,7 @@ importers: version: 2.0.3 ember-cli-dependency-checker: specifier: ^3.3.2 - version: 3.3.3(ember-cli@5.12.0(handlebars@4.7.9)(underscore@1.13.7)) + version: 3.3.3(ember-cli@5.12.0(handlebars@4.7.9)(underscore@1.13.8)) ember-cli-flash: specifier: ^6.0.0 version: 6.0.0(@ember/string@4.0.1)(@embroider/macros@1.19.3(@glint/template@1.5.2))(ember-modifier@4.2.2(@babel/core@7.27.1)) @@ -1090,7 +1090,7 @@ importers: version: 2.10.0(@glint/template@1.5.2)(webpack@5.105.4(esbuild@0.25.9)) ember-cli: specifier: ~5.12.0 - version: 5.12.0(handlebars@4.7.9)(underscore@1.13.7) + version: 5.12.0(handlebars@4.7.9)(underscore@1.13.8) ember-cli-babel: specifier: ^8.2.0 version: 8.2.0(@babel/core@7.27.1) @@ -1102,7 +1102,7 @@ importers: version: 1.0.3 ember-cli-dependency-checker: specifier: ^3.3.2 - version: 3.3.3(ember-cli@5.12.0(handlebars@4.7.9)(underscore@1.13.7)) + version: 3.3.3(ember-cli@5.12.0(handlebars@4.7.9)(underscore@1.13.8)) ember-cli-flash: specifier: ^6.0.0 version: 6.0.0(@ember/string@4.0.1)(@embroider/macros@1.19.3(@glint/template@1.5.2))(ember-modifier@4.2.2(@babel/core@7.27.1)) @@ -1126,7 +1126,7 @@ importers: version: 4.0.4(@babel/core@7.27.1)(@glint/template@1.5.2) ember-electron: specifier: ^6.0.0 - version: 6.0.0(@babel/core@7.27.1)(ember-cli-dependency-checker@3.3.3(ember-cli@5.12.0(handlebars@4.7.9)(underscore@1.13.7)))(ember-cli@5.12.0(handlebars@4.7.9)(underscore@1.13.7))(ember-source@5.12.0(@glimmer/component@2.0.0)(@glint/template@1.5.2)(rsvp@4.8.5)(webpack@5.105.4(esbuild@0.25.9)))(encoding@0.1.13) + version: 6.0.0(@babel/core@7.27.1)(ember-cli-dependency-checker@3.3.3(ember-cli@5.12.0(handlebars@4.7.9)(underscore@1.13.8)))(ember-cli@5.12.0(handlebars@4.7.9)(underscore@1.13.8))(ember-source@5.12.0(@glimmer/component@2.0.0)(@glint/template@1.5.2)(rsvp@4.8.5)(webpack@5.105.4(esbuild@0.25.9)))(encoding@0.1.13) ember-exam: specifier: ^8.0.0 version: 8.0.0(@glint/template@1.5.2)(ember-qunit@8.1.1(@ember/test-helpers@5.2.2(@babel/core@7.27.1)(@glint/template@1.5.2))(@glint/template@1.5.2)(ember-source@5.12.0(@glimmer/component@2.0.0)(@glint/template@1.5.2)(rsvp@4.8.5)(webpack@5.105.4(esbuild@0.25.9)))(qunit@2.24.1))(qunit@2.24.1)(webpack@5.105.4(esbuild@0.25.9)) @@ -4212,7 +4212,7 @@ packages: toffee: ^0.3.6 twig: ^1.15.2 twing: ^5.0.2 - underscore: ^1.11.0 + underscore: ^1.13.8 vash: ^0.13.0 velocityjs: ^2.0.1 walrus: ^0.10.1 @@ -8977,8 +8977,8 @@ packages: underscore.string@3.3.6: resolution: {integrity: sha512-VoC83HWXmCrF6rgkyxS9GHv8W9Q5nhMKho+OadDJGzL2oDYbYEppBaCMH6pFlwLeqj2QS+hhkw2kpXkSdD1JxQ==} - underscore@1.13.7: - resolution: {integrity: sha512-GMXzWtsc57XAtguZgaQViUOzs0KTkk8ojr3/xAxXLITqf/3EMwxC0inyETfDFjH/Krbhuep0HNbbjI9i/q3F3g==} + underscore@1.13.8: + resolution: {integrity: sha512-DXtD3ZtEQzc7M8m4cXotyHR+FAS18C64asBYY5vqZexfYryNNnDc02W4hKg3rdQuqOYas1jkseX0+nZXjTXnvQ==} undici-types@6.21.0: resolution: {integrity: sha512-iwDZqg0QAGrg9Rav5H4n0M64c3mkR59cJ6wQp+7C4nI0gsmExaedaYLNO44eT4AtBBwjbTiGPMlt2Md0T9H9JQ==} @@ -12425,7 +12425,7 @@ snapshots: backbone@1.6.1: dependencies: - underscore: 1.13.7 + underscore: 1.13.8 backburner.js@2.8.0: {} @@ -13312,14 +13312,14 @@ snapshots: dependencies: easy-table: 1.1.0 - consolidate@0.16.0(handlebars@4.7.9)(lodash@4.17.23)(mustache@4.2.0)(underscore@1.13.7): + consolidate@0.16.0(handlebars@4.7.9)(lodash@4.17.23)(mustache@4.2.0)(underscore@1.13.8): dependencies: bluebird: 3.7.2 optionalDependencies: handlebars: 4.7.9 lodash: 4.17.23 mustache: 4.2.0 - underscore: 1.13.7 + underscore: 1.13.8 content-disposition@0.5.4: dependencies: @@ -13603,7 +13603,7 @@ snapshots: anchor-markdown-header: 0.5.7 htmlparser2: 7.2.0 minimist: 1.2.8 - underscore: 1.13.7 + underscore: 1.13.8 update-section: 0.3.3 transitivePeerDependencies: - supports-color @@ -13908,10 +13908,10 @@ snapshots: transitivePeerDependencies: - supports-color - ember-cli-dependency-checker@3.3.3(ember-cli@5.12.0(handlebars@4.7.9)(underscore@1.13.7)): + ember-cli-dependency-checker@3.3.3(ember-cli@5.12.0(handlebars@4.7.9)(underscore@1.13.8)): dependencies: chalk: 2.4.2 - ember-cli: 5.12.0(handlebars@4.7.9)(underscore@1.13.7) + ember-cli: 5.12.0(handlebars@4.7.9)(underscore@1.13.8) find-yarn-workspace-root: 2.0.0 is-git-url: 1.0.0 resolve: 1.22.10 @@ -14125,7 +14125,7 @@ snapshots: transitivePeerDependencies: - supports-color - ember-cli@5.12.0(handlebars@4.7.9)(underscore@1.13.7): + ember-cli@5.12.0(handlebars@4.7.9)(underscore@1.13.8): dependencies: '@pnpm/find-workspace-dir': 6.0.3 broccoli: 3.5.2 @@ -14204,7 +14204,7 @@ snapshots: sort-package-json: 1.57.0 symlink-or-copy: 1.3.1 temp: 0.9.4 - testem: 3.16.0(handlebars@4.7.9)(underscore@1.13.7) + testem: 3.16.0(handlebars@4.7.9)(underscore@1.13.8) tiny-lr: 2.0.0 tree-sync: 2.1.0 walk-sync: 3.0.0 @@ -14346,14 +14346,14 @@ snapshots: - ember-inflector - supports-color - ember-electron@6.0.0(@babel/core@7.27.1)(ember-cli-dependency-checker@3.3.3(ember-cli@5.12.0(handlebars@4.7.9)(underscore@1.13.7)))(ember-cli@5.12.0(handlebars@4.7.9)(underscore@1.13.7))(ember-source@5.12.0(@glimmer/component@2.0.0)(@glint/template@1.5.2)(rsvp@4.8.5)(webpack@5.105.4(esbuild@0.25.9)))(encoding@0.1.13): + ember-electron@6.0.0(@babel/core@7.27.1)(ember-cli-dependency-checker@3.3.3(ember-cli@5.12.0(handlebars@4.7.9)(underscore@1.13.8)))(ember-cli@5.12.0(handlebars@4.7.9)(underscore@1.13.8))(ember-source@5.12.0(@glimmer/component@2.0.0)(@glint/template@1.5.2)(rsvp@4.8.5)(webpack@5.105.4(esbuild@0.25.9)))(encoding@0.1.13): dependencies: '@electron-forge/core': 7.8.1(encoding@0.1.13) chalk: 4.1.2 debug: 4.4.0 - ember-cli: 5.12.0(handlebars@4.7.9)(underscore@1.13.7) + ember-cli: 5.12.0(handlebars@4.7.9)(underscore@1.13.8) ember-cli-babel: 8.2.0(@babel/core@7.27.1) - ember-cli-dependency-checker: 3.3.3(ember-cli@5.12.0(handlebars@4.7.9)(underscore@1.13.7)) + ember-cli-dependency-checker: 3.3.3(ember-cli@5.12.0(handlebars@4.7.9)(underscore@1.13.8)) ember-source: 5.12.0(@glimmer/component@2.0.0)(@glint/template@1.5.2)(rsvp@4.8.5)(webpack@5.105.4(esbuild@0.25.9)) execa: 5.1.1 find-yarn-workspace-root: 2.0.0 @@ -17322,7 +17322,7 @@ snapshots: nomnom@1.8.1: dependencies: chalk: 0.4.0 - underscore: 1.13.7 + underscore: 1.13.8 nopt@3.0.6: dependencies: @@ -19020,7 +19020,7 @@ snapshots: glob: 7.2.3 minimatch: 3.1.5 - testem@3.16.0(handlebars@4.7.9)(underscore@1.13.7): + testem@3.16.0(handlebars@4.7.9)(underscore@1.13.8): dependencies: '@xmldom/xmldom': 0.8.10 backbone: 1.6.1 @@ -19028,7 +19028,7 @@ snapshots: charm: 1.0.2 commander: 2.20.3 compression: 1.8.1 - consolidate: 0.16.0(handlebars@4.7.9)(lodash@4.17.23)(mustache@4.2.0)(underscore@1.13.7) + consolidate: 0.16.0(handlebars@4.7.9)(lodash@4.17.23)(mustache@4.2.0)(underscore@1.13.8) execa: 1.0.0 express: 4.22.1 fireworm: 0.7.2 @@ -19298,7 +19298,7 @@ snapshots: sprintf-js: 1.1.3 util-deprecate: 1.0.2 - underscore@1.13.7: {} + underscore@1.13.8: {} undici-types@6.21.0: {}