Skip to content

Update group of unrelated packages - #9

Closed
renovate-justfalter[bot] wants to merge 1 commit into
mainfrom
renovate/group-of-unrelated-packages
Closed

Update group of unrelated packages#9
renovate-justfalter[bot] wants to merge 1 commit into
mainfrom
renovate/group-of-unrelated-packages

Conversation

@renovate-justfalter

@renovate-justfalter renovate-justfalter Bot commented Apr 15, 2026

Copy link
Copy Markdown

This PR contains the following updates:

Package Change Age Confidence
chalk 5.4.1 → 5.6.2 age confidence
lodash (source) 4.17.19 → 4.18.1 age confidence
tar 7.5.8 → 7.5.13 age confidence
  • lodash - should have no changelogs

Release Notes

chalk/chalk (chalk)

v5.6.2

Compare Source

  • Fix vulnerability in 5.6.1, see: #​656

v5.6.0

Compare Source

  • Make WezTerm terminal use true color a8f5bf7

v5.5.0

Compare Source

lodash/lodash (lodash)

v4.18.1

Compare Source

Bugs

Fixes a ReferenceError issue in lodash lodash-es lodash-amd and lodash.template when using the template and fromPairs functions from the modular builds. See #​6167 (comment)

These defects were related to how lodash distributions are built from the main branch using https://github.com/lodash-archive/lodash-cli. When internal dependencies change inside lodash functions, equivalent updates need to be made to a mapping in the lodash-cli. (hey, it was ahead of its time once upon a time!). We know this, but we missed it in the last release. It's the kind of thing that passes in CI, but fails bc the build is not the same thing you tested.

There is no diff on main for this, but you can see the diffs for each of the npm packages on their respective branches:

v4.18.0

Compare Source

v4.18.0

Full Changelog: lodash/lodash@4.17.23...4.18.0

Security

_.unset / _.omit: Fixed prototype pollution via constructor/prototype path traversal (GHSA-f23m-r3pf-42rh, fe8d32e). Previously, array-wrapped path segments and primitive roots could bypass the existing guards, allowing deletion of properties from built-in prototypes. Now constructor and prototype are blocked unconditionally as non-terminal path keys, matching baseSet. Calls that previously returned true and deleted the property now return false and leave the target untouched.

_.template: Fixed code injection via imports keys (GHSA-r5fr-rjxr-66jc, CVE-2026-4800, 879aaa9). Fixes an incomplete patch for CVE-2021-23337. The variable option was validated against reForbiddenIdentifierChars but importsKeys was left unguarded, allowing code injection via the same Function() constructor sink. imports keys containing forbidden identifier characters now throw "Invalid imports option passed into _.template".

Docs
  • Add security notice for _.template in threat model and API docs (#​6099)
  • Document lower > upper behavior in _.random (#​6115)
  • Fix quotes in _.compact jsdoc (#​6090)
lodash.* modular packages

Diff

We have also regenerated and published a select number of the lodash.* modular packages.

These modular packages had fallen out of sync significantly from the minor/patch updates to lodash. Specifically, we have brought the following packages up to parity w/ the latest lodash release because they have had CVEs on them in the past:

v4.17.23

Compare Source

v4.17.21

Compare Source

v4.17.20

Compare Source

isaacs/node-tar (tar)

v7.5.13

Compare Source

v7.5.12

Compare Source

v7.5.11

Compare Source

v7.5.10

Compare Source

v7.5.9

Compare Source

Configuration

📅 Schedule: (UTC)

  • Branch creation
    • At any time (no schedule defined)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

  • If you want to rebase/retry this PR, check this box

This PR has been generated by Renovate Bot.

@justfalter justfalter closed this Apr 15, 2026
@justfalter
justfalter deleted the renovate/group-of-unrelated-packages branch April 15, 2026 22:29
justfalter added a commit to justfalter/renovate that referenced this pull request Apr 15, 2026
@justfalter
fix(package-rules): respect each dep update's fetchChangeLogs value
4f61e5e 
Ensures that changelog fetching respects each dep update's specific `fetchChangeLogs` value.

Given the following renovate configuration: https://github.com/justfalter/renovate-test-packagerules-fetchchangelogs/blob/fb9e070d0f9a4d6fc742c4a22edee2c9b055fece/.github/renovate.json5#L42-L61

My expectation is that Renovate would never fetch changelogs for `lodash`. However, when grouped
together with `chalk` and `tar` under `group of unrelated packages`, we find that
renovate fetches changelogs all packages, including `lodash`.

Before this change (`lodash` logs fetched):
- Run: https://github.com/justfalter/renovate-test-packagerules-fetchchangelogs/actions/runs/24480887343/job/71544876893
- (wrong) lodash, tar, and chalk all have changelogs: justfalter/renovate-test-packagerules-fetchchangelogs#9

After this change, the PR created by renovate only contains changelogs for `chalk` and `tar`, but not `lodash`:

- Run: https://github.com/justfalter/renovate-test-packagerules-fetchchangelogs/actions/runs/24481738609/job/71547632550
- (expected) lodash does not have changelogs, but tar and chalk have changelogs: justfalter/renovate-test-packagerules-fetchchangelogs#10

----

We can further explore the effectiveness of the change with a more elaborate configuration, where the top-level has `fetchChangeLogs: off`: https://github.com/justfalter/renovate-test-packagerules-fetchchangelogs/blob/0ea69c18b9171e38c56440c762faa68109d3d0d5/.github/renovate.json5#L41-L95

Before the change:

- Run: https://github.com/justfalter/renovate-test-packagerules-fetchchangelogs/actions/runs/24482213234/job/71549162174
- (wrong) lodash, tar, and chalk all have changelogs: justfalter/renovate-test-packagerules-fetchchangelogs#15
- (expected) typescript (inherited `off`) does not have changelogs: justfalter/renovate-test-packagerules-fetchchangelogs#17
- (expected) grunt (overridden `pr`) has changelogs: justfalter/renovate-test-packagerules-fetchchangelogs#13

After the change::

- Run: https://github.com/justfalter/renovate-test-packagerules-fetchchangelogs/actions/runs/24482561172/job/71550255278
- (expected) lodash does not have changelogs, but tar and chalk have changelogs: justfalter/renovate-test-packagerules-fetchchangelogs#22
- (expected) typescript (inherited `off`) does not have changelogs: justfalter/renovate-test-packagerules-fetchchangelogs#24
- (expected) grunt (overridden `pr`) has changelogs: justfalter/renovate-test-packagerules-fetchchangelogs#20

Portions of this PR previously appeared in renovatebot#42368
@justfalter justfalter mentioned this pull request Apr 15, 2026
Merged
4 of 12 tasks
pull Bot pushed a commit to moovy2/renovate that referenced this pull request Apr 27, 2026
@justfalter
fix(package-rules): respect each dep update's fetchChangeLogs value (r…
525f80d 
…enovatebot#42671)

* fix(package-rules): respect each dep update's fetchChangeLogs value

Ensures that changelog fetching respects each dep update's specific `fetchChangeLogs` value.

Given the following renovate configuration: https://github.com/justfalter/renovate-test-packagerules-fetchchangelogs/blob/fb9e070d0f9a4d6fc742c4a22edee2c9b055fece/.github/renovate.json5#L42-L61

My expectation is that Renovate would never fetch changelogs for `lodash`. However, when grouped
together with `chalk` and `tar` under `group of unrelated packages`, we find that
renovate fetches changelogs all packages, including `lodash`.

Before this change (`lodash` logs fetched):
- Run: https://github.com/justfalter/renovate-test-packagerules-fetchchangelogs/actions/runs/24480887343/job/71544876893
- (wrong) lodash, tar, and chalk all have changelogs: justfalter/renovate-test-packagerules-fetchchangelogs#9

After this change, the PR created by renovate only contains changelogs for `chalk` and `tar`, but not `lodash`:

- Run: https://github.com/justfalter/renovate-test-packagerules-fetchchangelogs/actions/runs/24481738609/job/71547632550
- (expected) lodash does not have changelogs, but tar and chalk have changelogs: justfalter/renovate-test-packagerules-fetchchangelogs#10

----

We can further explore the effectiveness of the change with a more elaborate configuration, where the top-level has `fetchChangeLogs: off`: https://github.com/justfalter/renovate-test-packagerules-fetchchangelogs/blob/0ea69c18b9171e38c56440c762faa68109d3d0d5/.github/renovate.json5#L41-L95

Before the change:

- Run: https://github.com/justfalter/renovate-test-packagerules-fetchchangelogs/actions/runs/24482213234/job/71549162174
- (wrong) lodash, tar, and chalk all have changelogs: justfalter/renovate-test-packagerules-fetchchangelogs#15
- (expected) typescript (inherited `off`) does not have changelogs: justfalter/renovate-test-packagerules-fetchchangelogs#17
- (expected) grunt (overridden `pr`) has changelogs: justfalter/renovate-test-packagerules-fetchchangelogs#13

After the change::

- Run: https://github.com/justfalter/renovate-test-packagerules-fetchchangelogs/actions/runs/24482561172/job/71550255278
- (expected) lodash does not have changelogs, but tar and chalk have changelogs: justfalter/renovate-test-packagerules-fetchchangelogs#22
- (expected) typescript (inherited `off`) does not have changelogs: justfalter/renovate-test-packagerules-fetchchangelogs#24
- (expected) grunt (overridden `pr`) has changelogs: justfalter/renovate-test-packagerules-fetchchangelogs#20

Portions of this PR previously appeared in renovatebot#42368

* pre feedback: just use fetchChangeLogs from upgrade

* revert documentation.spec.ts changes

They've already been integrated with renovatebot#42846
QuentinBtd pushed a commit to QuentinBtd/fork_renovatebot_renovate that referenced this pull request Jul 7, 2026
@justfalter @QuentinBtd
fix(package-rules): respect each dep update's fetchChangeLogs value (r…
60ba8a0 
…enovatebot#42671)

* fix(package-rules): respect each dep update's fetchChangeLogs value

Ensures that changelog fetching respects each dep update's specific `fetchChangeLogs` value.

Given the following renovate configuration: https://github.com/justfalter/renovate-test-packagerules-fetchchangelogs/blob/fb9e070d0f9a4d6fc742c4a22edee2c9b055fece/.github/renovate.json5#L42-L61

My expectation is that Renovate would never fetch changelogs for `lodash`. However, when grouped
together with `chalk` and `tar` under `group of unrelated packages`, we find that
renovate fetches changelogs all packages, including `lodash`.

Before this change (`lodash` logs fetched):
- Run: https://github.com/justfalter/renovate-test-packagerules-fetchchangelogs/actions/runs/24480887343/job/71544876893
- (wrong) lodash, tar, and chalk all have changelogs: justfalter/renovate-test-packagerules-fetchchangelogs#9

After this change, the PR created by renovate only contains changelogs for `chalk` and `tar`, but not `lodash`:

- Run: https://github.com/justfalter/renovate-test-packagerules-fetchchangelogs/actions/runs/24481738609/job/71547632550
- (expected) lodash does not have changelogs, but tar and chalk have changelogs: justfalter/renovate-test-packagerules-fetchchangelogs#10

----

We can further explore the effectiveness of the change with a more elaborate configuration, where the top-level has `fetchChangeLogs: off`: https://github.com/justfalter/renovate-test-packagerules-fetchchangelogs/blob/0ea69c18b9171e38c56440c762faa68109d3d0d5/.github/renovate.json5#L41-L95

Before the change:

- Run: https://github.com/justfalter/renovate-test-packagerules-fetchchangelogs/actions/runs/24482213234/job/71549162174
- (wrong) lodash, tar, and chalk all have changelogs: justfalter/renovate-test-packagerules-fetchchangelogs#15
- (expected) typescript (inherited `off`) does not have changelogs: justfalter/renovate-test-packagerules-fetchchangelogs#17
- (expected) grunt (overridden `pr`) has changelogs: justfalter/renovate-test-packagerules-fetchchangelogs#13

After the change::

- Run: https://github.com/justfalter/renovate-test-packagerules-fetchchangelogs/actions/runs/24482561172/job/71550255278
- (expected) lodash does not have changelogs, but tar and chalk have changelogs: justfalter/renovate-test-packagerules-fetchchangelogs#22
- (expected) typescript (inherited `off`) does not have changelogs: justfalter/renovate-test-packagerules-fetchchangelogs#24
- (expected) grunt (overridden `pr`) has changelogs: justfalter/renovate-test-packagerules-fetchchangelogs#20

Portions of this PR previously appeared in renovatebot#42368

* pre feedback: just use fetchChangeLogs from upgrade

* revert documentation.spec.ts changes

They've already been integrated with renovatebot#42846
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@justfalter justfalter Awaiting requested review from justfalter

Assignees

@justfalter justfalter

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@justfalter