Merge pull request #8409 from BitGo/CSHLD-407-v2

abhishekagrawal080 · web-flow · commit 19164bc09802 · 2026-04-07T23:12:37.000+05:30
chore: fix lodash vulnerability
diff --git a/modules/abstract-cosmos/package.json b/modules/abstract-cosmos/package.json
@@ -49,7 +49,7 @@
     "@cosmjs/stargate": "^0.29.5",
     "bignumber.js": "^9.1.1",
     "cosmjs-types": "^0.6.1",
-    "lodash": "^4.17.21",
+    "lodash": "^4.18.0",
     "protobufjs": "^7.4.0",
     "superagent": "^9.0.1"
   },
diff --git a/modules/abstract-eth/package.json b/modules/abstract-eth/package.json
@@ -55,7 +55,7 @@
     "ethereumjs-util": "7.1.5",
     "ethers": "^5.1.3",
     "keccak": "^3.0.3",
-    "lodash": "4.17.21",
+    "lodash": "^4.18.0",
     "secp256k1": "5.0.1",
     "superagent": "^9.0.1"
   },
diff --git a/modules/abstract-substrate/package.json b/modules/abstract-substrate/package.json
@@ -53,7 +53,7 @@
     "bs58": "^4.0.1",
     "hi-base32": "^0.5.1",
     "joi": "^17.4.0",
-    "lodash": "^4.17.15",
+    "lodash": "^4.18.0",
     "tweetnacl": "^1.0.3"
   },
   "gitHead": "18e460ddf02de2dbf13c2aa243478188fb539f0c",
diff --git a/modules/abstract-utxo/package.json b/modules/abstract-utxo/package.json
@@ -72,7 +72,7 @@
     "bignumber.js": "^9.0.2",
     "debug": "^3.1.0",
     "io-ts": "npm:@bitgo-forks/io-ts@2.1.4",
-    "lodash": "^4.17.14",
+    "lodash": "^4.18.0",
     "superagent": "^9.0.1"
   },
   "devDependencies": {
diff --git a/modules/bitgo/package.json b/modules/bitgo/package.json
@@ -132,7 +132,7 @@
     "@bitgo/utxo-lib": "^11.22.0",
     "@types/superagent": "^4.1.3",
     "bignumber.js": "^9.1.1",
-    "lodash": "^4.17.14",
+    "lodash": "^4.18.0",
     "openpgp": "5.11.3",
     "stellar-sdk": "^10.0.1",
     "superagent": "^9.0.1"
diff --git a/modules/express/package.json b/modules/express/package.json
@@ -53,7 +53,7 @@
     "express": "4.21.2",
     "io-ts": "npm:@bitgo-forks/io-ts@2.1.4",
     "io-ts-types": "^0.5.19",
-    "lodash": "^4.17.20",
+    "lodash": "^4.18.0",
     "morgan": "^1.9.1",
     "proxy-agent": "6.4.0",
     "proxyquire": "^2.1.3",
diff --git a/modules/sdk-api/package.json b/modules/sdk-api/package.json
@@ -49,7 +49,7 @@
     "bitcoinjs-message": "npm:@bitgo-forks/bitcoinjs-message@1.0.0-master.3",
     "debug": "3.1.0",
     "eol": "^0.5.0",
-    "lodash": "^4.17.15",
+    "lodash": "^4.18.0",
     "proxy-agent": "6.4.0",
     "sanitize-html": "^2.11",
     "secp256k1": "5.0.1",
diff --git a/modules/sdk-coin-ada/package.json b/modules/sdk-coin-ada/package.json
@@ -49,7 +49,7 @@
     "bignumber.js": "^9.0.2",
     "bs58": "^6.0.0",
     "cbor": "^10.0.3",
-    "lodash": "^4.17.21",
+    "lodash": "^4.18.0",
     "superagent": "^9.0.1",
     "tweetnacl": "^1.0.3"
   },
diff --git a/modules/sdk-coin-algo/package.json b/modules/sdk-coin-algo/package.json
@@ -49,7 +49,7 @@
     "hi-base32": "^0.5.1",
     "joi": "^17.4.0",
     "js-sha512": "0.8.0",
-    "lodash": "^4.17.14",
+    "lodash": "^4.18.0",
     "stellar-sdk": "^10.0.1",
     "tweetnacl": "^1.0.3"
   },
diff --git a/modules/sdk-coin-apt/package.json b/modules/sdk-coin-apt/package.json
@@ -45,7 +45,7 @@
     "@bitgo/sdk-core": "^36.37.0",
     "@bitgo/statics": "^58.32.0",
     "bignumber.js": "^9.1.2",
-    "lodash": "^4.17.21"
+    "lodash": "^4.18.0"
   },
   "devDependencies": {
     "@bitgo/sdk-api": "^1.76.1",
diff --git a/modules/sdk-coin-avaxc/package.json b/modules/sdk-coin-avaxc/package.json
@@ -51,7 +51,7 @@
     "ethereumjs-abi": "^0.6.5",
     "ethereumjs-util": "7.1.5",
     "keccak": "^3.0.3",
-    "lodash": "^4.17.14",
+    "lodash": "^4.18.0",
     "secp256k1": "5.0.1",
     "superagent": "^9.0.1"
   },
diff --git a/modules/sdk-coin-avaxp/package.json b/modules/sdk-coin-avaxp/package.json
@@ -56,7 +56,7 @@
     "bignumber.js": "^9.0.0",
     "create-hash": "^1.2.0",
     "ethereumjs-util": "7.1.5",
-    "lodash": "^4.17.14",
+    "lodash": "^4.18.0",
     "safe-buffer": "^5.2.1"
   },
   "gitHead": "18e460ddf02de2dbf13c2aa243478188fb539f0c",
diff --git a/modules/sdk-coin-cspr/package.json b/modules/sdk-coin-cspr/package.json
@@ -47,7 +47,7 @@
     "@stablelib/hex": "^1.0.0",
     "bignumber.js": "^9.0.0",
     "casper-js-sdk": "2.7.6",
-    "lodash": "^4.17.15",
+    "lodash": "^4.18.0",
     "secp256k1": "5.0.1"
   },
   "devDependencies": {
diff --git a/modules/sdk-coin-dot/package.json b/modules/sdk-coin-dot/package.json
@@ -72,7 +72,7 @@
     "bs58": "^4.0.1",
     "hi-base32": "^0.5.1",
     "joi": "^17.4.0",
-    "lodash": "^4.17.15",
+    "lodash": "^4.18.0",
     "tweetnacl": "^1.0.3"
   },
   "devDependencies": {
diff --git a/modules/sdk-coin-eos/package.json b/modules/sdk-coin-eos/package.json
@@ -46,7 +46,7 @@
     "bignumber.js": "^9.0.2",
     "eosjs": "^21.0.2",
     "eosjs-ecc": "^4.0.4",
-    "lodash": "^4.17.14",
+    "lodash": "^4.18.0",
     "superagent": "^9.0.1"
   },
   "devDependencies": {
diff --git a/modules/sdk-coin-etc/package.json b/modules/sdk-coin-etc/package.json
@@ -49,7 +49,7 @@
     "bignumber.js": "^9.1.1",
     "ethereumjs-abi": "^0.6.5",
     "ethereumjs-util": "7.1.5",
-    "lodash": "^4.17.14",
+    "lodash": "^4.18.0",
     "superagent": "^9.0.1"
   },
   "devDependencies": {
diff --git a/modules/sdk-coin-eth/package.json b/modules/sdk-coin-eth/package.json
@@ -50,7 +50,7 @@
     "ethereumjs-abi": "^0.6.5",
     "ethereumjs-util": "7.1.5",
     "ethers": "^5.1.3",
-    "lodash": "^4.17.14",
+    "lodash": "^4.18.0",
     "secp256k1": "5.0.1",
     "superagent": "^9.0.1"
   },
diff --git a/modules/sdk-coin-flr/package.json b/modules/sdk-coin-flr/package.json
@@ -51,7 +51,7 @@
     "bignumber.js": "^9.0.0",
     "ethereumjs-util": "7.1.5",
     "keccak": "^3.0.0",
-    "lodash": "^4.17.21",
+    "lodash": "^4.18.0",
     "secp256k1": "^5.0.0"
   },
   "devDependencies": {
diff --git a/modules/sdk-coin-hbar/package.json b/modules/sdk-coin-hbar/package.json
@@ -47,7 +47,7 @@
     "@hashgraph/sdk": "2.72.0",
     "@stablelib/sha384": "^1.0.0",
     "bignumber.js": "^9.0.0",
-    "lodash": "^4.17.15",
+    "lodash": "^4.18.0",
     "long": "^5.2.3",
     "protobufjs": "7.2.5",
     "stellar-sdk": "^10.0.1",
diff --git a/modules/sdk-coin-iota/package.json b/modules/sdk-coin-iota/package.json
@@ -46,7 +46,7 @@
     "@iota/bcs": "^1.2.0",
     "@iota/iota-sdk": "^1.6.0",
     "bignumber.js": "^9.1.2",
-    "lodash": "^4.17.21"
+    "lodash": "^4.18.0"
   },
   "devDependencies": {
     "@bitgo/sdk-api": "^1.76.1",
diff --git a/modules/sdk-coin-near/package.json b/modules/sdk-coin-near/package.json
@@ -49,7 +49,7 @@
     "bignumber.js": "^9.0.0",
     "bs58": "^4.0.1",
     "js-sha256": "^0.9.0",
-    "lodash": "^4.17.14",
+    "lodash": "^4.18.0",
     "near-api-js": "^5.1.1",
     "superagent": "^9.0.1",
     "tweetnacl": "^1.0.3"
diff --git a/modules/sdk-coin-rune/package.json b/modules/sdk-coin-rune/package.json
@@ -49,7 +49,7 @@
     "@cosmjs/stargate": "^0.29.5",
     "bech32-buffer": "^0.2.1",
     "bignumber.js": "^9.1.1",
-    "lodash": "^4.17.21"
+    "lodash": "^4.18.0"
   },
   "devDependencies": {
     "@bitgo/sdk-api": "^1.76.1",
diff --git a/modules/sdk-coin-sol/package.json b/modules/sdk-coin-sol/package.json
@@ -67,7 +67,7 @@
     "@solana/web3.js": "1.92.1",
     "bignumber.js": "^9.0.0",
     "bs58": "^4.0.1",
-    "lodash": "^4.17.14",
+    "lodash": "^4.18.0",
     "superagent": "^9.0.1",
     "tweetnacl": "^1.0.3"
   },
diff --git a/modules/sdk-coin-stx/package.json b/modules/sdk-coin-stx/package.json
@@ -49,7 +49,7 @@
     "bignumber.js": "^9.0.0",
     "bn.js": "^5.2.1",
     "ethereumjs-util": "7.1.5",
-    "lodash": "^4.17.15"
+    "lodash": "^4.18.0"
   },
   "devDependencies": {
     "@bitgo/sdk-api": "^1.76.1",
diff --git a/modules/sdk-coin-sui/package.json b/modules/sdk-coin-sui/package.json
@@ -47,7 +47,7 @@
     "@mysten/bcs": "^0.7.0",
     "bignumber.js": "^9.0.0",
     "bs58": "^4.0.1",
-    "lodash": "^4.17.21",
+    "lodash": "^4.18.0",
     "superagent": "3.8.2",
     "superstruct": "^1.0.3",
     "tweetnacl": "^1.0.3"
diff --git a/modules/sdk-coin-ton/package.json b/modules/sdk-coin-ton/package.json
@@ -46,7 +46,7 @@
     "@bitgo/wasm-ton": "^1.1.1",
     "bignumber.js": "^9.0.0",
     "bn.js": "^5.2.1",
-    "lodash": "^4.17.21",
+    "lodash": "^4.18.0",
     "tonweb": "^0.0.62",
     "tweetnacl": "^1.0.3"
   },
diff --git a/modules/sdk-coin-trx/package.json b/modules/sdk-coin-trx/package.json
@@ -53,7 +53,7 @@
     "@stablelib/hex": "^1.0.0",
     "bignumber.js": "^9.0.0",
     "ethers": "^5.7.2",
-    "lodash": "^4.17.14",
+    "lodash": "^4.18.0",
     "long": "^5.3.2",
     "protobufjs": "7.2.5",
     "secp256k1": "5.0.1",
diff --git a/modules/sdk-coin-vet/package.json b/modules/sdk-coin-vet/package.json
@@ -52,7 +52,7 @@
     "bignumber.js": "^9.1.1",
     "ethereumjs-abi": "^0.6.5",
     "ethereumjs-util": "7.1.5",
-    "lodash": "^4.17.21",
+    "lodash": "^4.18.0",
     "tweetnacl": "^1.0.3"
   },
   "devDependencies": {
diff --git a/modules/sdk-coin-xlm/package.json b/modules/sdk-coin-xlm/package.json
@@ -43,7 +43,7 @@
     "@bitgo/sdk-core": "^36.37.0",
     "@bitgo/statics": "^58.32.0",
     "bignumber.js": "^9.1.1",
-    "lodash": "^4.17.14",
+    "lodash": "^4.18.0",
     "stellar-sdk": "^10.0.1",
     "superagent": "^9.0.1"
   },
diff --git a/modules/sdk-coin-xrp/package.json b/modules/sdk-coin-xrp/package.json
@@ -44,7 +44,7 @@
     "@bitgo/secp256k1": "^1.11.0",
     "@bitgo/statics": "^58.32.0",
     "bignumber.js": "^9.0.0",
-    "lodash": "^4.17.14",
+    "lodash": "^4.18.0",
     "ripple-binary-codec": "2.1.0",
     "ripple-keypairs": "2.0.0",
     "xrpl": "4.0.0"
diff --git a/modules/sdk-coin-xtz/package.json b/modules/sdk-coin-xtz/package.json
@@ -51,7 +51,7 @@
     "bignumber.js": "^9.0.0",
     "bs58check": "^2.1.2",
     "libsodium-wrappers": "^0.7.6",
-    "lodash": "^4.17.15",
+    "lodash": "^4.18.0",
     "superagent": "^9.0.1"
   },
   "devDependencies": {
diff --git a/modules/sdk-core/package.json b/modules/sdk-core/package.json
@@ -61,7 +61,7 @@
     "io-ts-types": "^0.5.16",
     "keccak": "3.0.3",
     "libsodium-wrappers-sumo": "^0.7.9",
-    "lodash": "^4.17.15",
+    "lodash": "^4.18.0",
     "noble-bls12-381": "0.7.2",
     "openpgp": "5.11.3",
     "paillier-bigint": "3.3.0",
diff --git a/modules/unspents/package.json b/modules/unspents/package.json
@@ -37,7 +37,7 @@
   },
   "dependencies": {
     "@bitgo/utxo-lib": "^11.22.0",
-    "lodash": "~4.17.21",
+    "lodash": "^4.18.0",
     "tcomb": "~3.2.29",
     "varuint-bitcoin": "^1.0.4"
   },
diff --git a/modules/web-demo/package.json b/modules/web-demo/package.json
@@ -66,7 +66,7 @@
     "@bitgo/sjcl": "^1.1.0",
     "@bitgo/statics": "^58.32.0",
     "bitgo": "^50.29.0",
-    "lodash": "^4.17.15",
+    "lodash": "^4.18.0",
     "react": "^18.0.0",
     "react-dom": "^18.0.0",
     "react-json-view": "^1.21.3",
diff --git a/package.json b/package.json
@@ -62,6 +62,7 @@
   },
   "resolutions": {
     "qs": "6.14.1",
+    "**/lodash": ">=4.18.1",
     "**/lerna/**/glob": "11.1.0",
     "**/yeoman-generator/**/glob": "11.1.0",
     "**/cacache/glob": "11.1.0",
diff --git a/yarn.lock b/yarn.lock
@@ -14591,10 +14591,10 @@ lodash.upperfirst@^4.3.1:
   resolved "https://registry.npmjs.org/lodash.upperfirst/-/lodash.upperfirst-4.3.1.tgz"
   integrity sha512-sReKOYJIJf74dhJONhU4e0/shzi1trVbSWDOhKYE5XV2O+H7Sb2Dihwuc7xWxVl+DgFPyTqIN3zMfT9cq5iWDg==
 
-lodash@4.17.21, lodash@^4.17.11, lodash@^4.17.14, lodash@^4.17.15, lodash@^4.17.19, lodash@^4.17.20, lodash@^4.17.21, lodash@^4.17.5, lodash@~4.17.21:
-  version "4.17.21"
-  resolved "https://registry.npmjs.org/lodash/-/lodash-4.17.21.tgz"
-  integrity sha512-v2kDEe57lecTulaDIuNTPy3Ry4gLGJ6Z1O3vE1krgXZNrsQ+LFTGHVxVjcXPs17LhbZVGedAJv8XZ1tvj5FvSg==
+lodash@>=4.18.1, lodash@^4.17.11, lodash@^4.17.15, lodash@^4.17.19, lodash@^4.17.20, lodash@^4.17.21, lodash@^4.17.5, lodash@^4.18.0:
+  version "4.18.1"
+  resolved "https://registry.npmjs.org/lodash/-/lodash-4.18.1.tgz#ff2b66c1f6326d59513de2407bf881439812771c"
+  integrity sha512-dMInicTPVE8d1e5otfwmmjlxkZoUpiVLwyeTdUsi/Caj/gfzzblBcCE5sRHV/AsjuCmxWrte2TNGSYuCeCq+0Q==
 
 log-symbols@^4.0.0, log-symbols@^4.1.0:
   version "4.1.0"
