From c3da7038761afabc290790efe29974295799aa99 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Thu, 22 Jan 2026 01:39:31 +0000 Subject: [PATCH 1/2] Bump lodash from 4.17.21 to 4.17.23 Bumps [lodash](https://github.com/lodash/lodash) from 4.17.21 to 4.17.23. - [Release notes](https://github.com/lodash/lodash/releases) - [Commits](https://github.com/lodash/lodash/compare/4.17.21...4.17.23) --- updated-dependencies: - dependency-name: lodash dependency-version: 4.17.23 dependency-type: direct:production ... Signed-off-by: dependabot[bot] --- package-lock.json | 14 +++++++------- package.json | 2 +- 2 files changed, 8 insertions(+), 8 deletions(-) diff --git a/package-lock.json b/package-lock.json index d8a7b9a..a489213 100644 --- a/package-lock.json +++ b/package-lock.json @@ -11,7 +11,7 @@ "@actions/core": "^1.11.1", "@actions/exec": "^1.1.1", "@zaproxy/actions-common-scans": "^1.4.0", - "lodash": "^4.17.21" + "lodash": "^4.17.23" }, "devDependencies": { "@vercel/ncc": "^0.36.1" @@ -4289,9 +4289,9 @@ } }, "node_modules/lodash": { - "version": "4.17.21", - "resolved": "https://registry.npmjs.org/lodash/-/lodash-4.17.21.tgz", - "integrity": "sha512-v2kDEe57lecTulaDIuNTPy3Ry4gLGJ6Z1O3vE1krgXZNrsQ+LFTGHVxVjcXPs17LhbZVGedAJv8XZ1tvj5FvSg==" + "version": "4.17.23", + "resolved": "https://registry.npmjs.org/lodash/-/lodash-4.17.23.tgz", + "integrity": "sha512-LgVTMpQtIopCi79SJeDiP0TfWi5CNEc/L/aRdTh3yIvmZXTnheWpKjSZhnvMl8iXbC1tFg9gdHHDMLoV7CnG+w==" }, "node_modules/lodash.debounce": { "version": "4.0.8", @@ -8281,9 +8281,9 @@ } }, "lodash": { - "version": "4.17.21", - "resolved": "https://registry.npmjs.org/lodash/-/lodash-4.17.21.tgz", - "integrity": "sha512-v2kDEe57lecTulaDIuNTPy3Ry4gLGJ6Z1O3vE1krgXZNrsQ+LFTGHVxVjcXPs17LhbZVGedAJv8XZ1tvj5FvSg==" + "version": "4.17.23", + "resolved": "https://registry.npmjs.org/lodash/-/lodash-4.17.23.tgz", + "integrity": "sha512-LgVTMpQtIopCi79SJeDiP0TfWi5CNEc/L/aRdTh3yIvmZXTnheWpKjSZhnvMl8iXbC1tFg9gdHHDMLoV7CnG+w==" }, "lodash.debounce": { "version": "4.0.8", diff --git a/package.json b/package.json index 94d170d..6b6d0d4 100644 --- a/package.json +++ b/package.json @@ -24,7 +24,7 @@ "@actions/core": "^1.11.1", "@actions/exec": "^1.1.1", "@zaproxy/actions-common-scans": "^1.4.0", - "lodash": "^4.17.21" + "lodash": "^4.17.23" }, "devDependencies": { "@vercel/ncc": "^0.36.1" From 75dd7c97faef3b127baacae033b23a5c5a6febb3 Mon Sep 17 00:00:00 2001 From: thc202 Date: Thu, 22 Jan 2026 08:53:51 +0000 Subject: [PATCH 2/2] Update dist file and changelog Update dist file with latest changes. Add entry to the changelog. Signed-off-by: thc202 --- CHANGELOG.md | 2 ++ dist/index.js | 47 +++++++++++++++++++++++++++++++++++++++++++---- 2 files changed, 45 insertions(+), 4 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 7bd2d64..1660047 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -5,6 +5,8 @@ All notable changes to this GitHub action will be documented in this file. The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/). ## [Unreleased] +### Changed +- Update dependencies. ## [0.10.0] - 2025-10-24 ### Changed diff --git a/dist/index.js b/dist/index.js index 699d962..f1b397c 100644 --- a/dist/index.js +++ b/dist/index.js @@ -39901,7 +39901,7 @@ module.exports = keysIn; var undefined; /** Used as the semantic version number. */ - var VERSION = '4.17.21'; + var VERSION = '4.17.23'; /** Used as the size to enable large array optimizations. */ var LARGE_ARRAY_SIZE = 200; @@ -43655,7 +43655,7 @@ module.exports = keysIn; if (isArray(iteratee)) { return function(value) { return baseGet(value, iteratee.length === 1 ? iteratee[0] : iteratee); - } + }; } return iteratee; }); @@ -44259,8 +44259,47 @@ module.exports = keysIn; */ function baseUnset(object, path) { path = castPath(path, object); - object = parent(object, path); - return object == null || delete object[toKey(last(path))]; + + // Prevent prototype pollution, see: https://github.com/lodash/lodash/security/advisories/GHSA-xxjr-mmjv-4gpg + var index = -1, + length = path.length; + + if (!length) { + return true; + } + + var isRootPrimitive = object == null || (typeof object !== 'object' && typeof object !== 'function'); + + while (++index < length) { + var key = path[index]; + + // skip non-string keys (e.g., Symbols, numbers) + if (typeof key !== 'string') { + continue; + } + + // Always block "__proto__" anywhere in the path if it's not expected + if (key === '__proto__' && !hasOwnProperty.call(object, '__proto__')) { + return false; + } + + // Block "constructor.prototype" chains + if (key === 'constructor' && + (index + 1) < length && + typeof path[index + 1] === 'string' && + path[index + 1] === 'prototype') { + + // Allow ONLY when the path starts at a primitive root, e.g., _.unset(0, 'constructor.prototype.a') + if (isRootPrimitive && index === 0) { + continue; + } + + return false; + } + } + + var obj = parent(object, path); + return obj == null || delete obj[toKey(last(path))]; } /**