build(deps): bump the production-dependencies group across 1 directory with 2 updates

[dependabot]

Bumps the production-dependencies group with 2 updates in the / directory: vue and lodash-es.

Updates vue from 3.5.30 to 3.5.39

Release notes

Sourced from vue's releases.

v3.5.39

For stable releases, please refer to CHANGELOG.md for details. For pre-releases, please refer to CHANGELOG.md of the minor branch.

v3.5.38

For stable releases, please refer to CHANGELOG.md for details. For pre-releases, please refer to CHANGELOG.md of the minor branch.

v3.5.37

For stable releases, please refer to CHANGELOG.md for details. For pre-releases, please refer to CHANGELOG.md of the minor branch.

v3.5.35

For stable releases, please refer to CHANGELOG.md for details. For pre-releases, please refer to CHANGELOG.md of the minor branch.

v3.5.34

For stable releases, please refer to CHANGELOG.md for details. For pre-releases, please refer to CHANGELOG.md of the minor branch.

v3.5.33

For stable releases, please refer to CHANGELOG.md for details. For pre-releases, please refer to CHANGELOG.md of the minor branch.

v3.5.32

For stable releases, please refer to CHANGELOG.md for details. For pre-releases, please refer to CHANGELOG.md of the minor branch.

v3.5.31

For stable releases, please refer to CHANGELOG.md for details. For pre-releases, please refer to CHANGELOG.md of the minor branch.

Changelog

Sourced from vue's changelog.

3.5.39 (2026-06-25)

Bug Fixes

• compiler-core: correct filter rewrite recursion (#14959) (be7ce31)
• hydration: force patch dynamic props when hydrating (#9083) (024cf06), closes #9033
• hydration: respect data-allow-mismatch on conditional branches (#12801) (164af63), closes #12782
• reactivity: avoid triggering effects when set fails (#14964) (e450973)
• runtime-core: handle non-isomorphic block element update (#15002) (932ddd0), closes #6385
• runtime-core: normalize function children for elements and Teleport (#9108) (2f374cd), closes #9107
• runtime-core: pause tracking when invoking function refs (#14985) (3ac052b)
• runtime-core: preserve once event listener name (#8341) (87b73b6), closes #8342
• runtime-dom: preserve option modifier event names (#8338) (4b659e6), closes #8334
• ssr: dedupe inherited scope ids during vnode rendering (#15005) (027da6b), closes #12159 #12175
• ssr: resolve nested async teleport content (#9431) (31d0f23), closes #6207
• teleport: handle teleport unmount edge case (#12705) (671997a), closes #12702
• types: support named tuple emits (#12676) (232f402), closes #12673
• types: validate defineModel defaults (#14968) (747f57e), closes #14966

3.5.38 (2026-06-11)

3.5.37 (2026-06-11)

3.5.36 (2026-06-11)

Bug Fixes

• compiler-core: avoid crash on CDATA at the document root (#14916) (0ea17e2)
• compiler-core: prefix dynamic keys on v-memo elements (#14922) (68e978e), closes #14920
• compiler-sfc: handle vue-ignore on leading intersection/union type (#14950) (0dcd225), closes #12254
• compiler-sfc: respect var hoisting in props destructure (48ad452)
• reactivity: preserve watch callback return value when wrapped for once: true (#14902) (450a8a8)
• runtime-core: add dev warning for silent catch in compat mode and fix test description typo (#14891) (db3e117)
• runtime-core: force model update when reverted before sync (#14897) (7f76378), closes #13524
• runtime-core: skip async component callbacks after unmount (#14911) (5300ead)
• transition: avoid move transition for hidden v-show group children (#14895) (c11f6ee), closes #14894
• watch: trigger immediate callback for empty sources (#14914) (1f2ca7e), closes #14898

3.5.35 (2026-05-27)

Bug Fixes

• compiler-core: avoid double processing v-for keys with v-memo (#14861) (34a0ded), closes #14859
• compiler-sfc: resolve top-level exports from files registered as global types (#14805) (3d077f2), closes nuxt/nuxt#33694
• runtime-core: avoid repeated hydration mismatch checks (#14857) (170fc95), closes #14855
• runtime-core: skip idle persisted transition hooks in keep-alive moves (#14865) (80fc139), closes #14031
• server-renderer: propagate sync errors from ssrRenderSuspense (#14804) (4760997), closes nuxt/nuxt#28162

... (truncated)

Commits

• c0606e9 release: v3.5.39
• 4b659e6 fix(runtime-dom): preserve option modifier event names (#8338)
• 232f402 fix(types): support named tuple emits (#12676)
• 671997a fix(teleport): handle teleport unmount edge case (#12705)
• 164af63 fix(hydration): respect data-allow-mismatch on conditional branches (#12801)
• 2f374cd fix(runtime-core): normalize function children for elements and Teleport (#9108)
• 87b73b6 fix(runtime-core): preserve once event listener name (#8341)
• 027da6b fix(ssr): dedupe inherited scope ids during vnode rendering (#15005)
• 024cf06 fix(hydration): force patch dynamic props when hydrating (#9083)
• be7ce31 fix(compiler-core): correct filter rewrite recursion (#14959)
• Additional commits viewable in compare view

Updates lodash-es from 4.17.23 to 4.18.1

Release notes

Sourced from lodash-es's releases.

4.18.1

Bugs

Fixes a ReferenceError issue in lodash lodash-es lodash-amd and lodash.template when using the template and fromPairs functions from the modular builds. See lodash/lodash#6167

These defects were related to how lodash distributions are built from the main branch using https://github.com/lodash-archive/lodash-cli. When internal dependencies change inside lodash functions, equivalent updates need to be made to a mapping in the lodash-cli. (hey, it was ahead of its time once upon a time!). We know this, but we missed it in the last release. It's the kind of thing that passes in CI, but fails bc the build is not the same thing you tested.

There is no diff on main for this, but you can see the diffs for each of the npm packages on their respective branches:

• lodash: lodash/lodash@4.18.0-npm...4.18.1-npm
• lodash-es: lodash/lodash@4.18.0-es...4.18.1-es
• lodash-amd: lodash/lodash@4.18.0-amd...4.18.1-amd
• lodash.templatelodash/lodash@4.18.0-npm-packages...4.18.1-npm-packages

4.18.0

v4.18.0

Full Changelog: lodash/lodash@4.17.23...4.18.0

Security

_.unset / _.omit: Fixed prototype pollution via constructor/prototype path traversal (GHSA-f23m-r3pf-42rh, fe8d32e). Previously, array-wrapped path segments and primitive roots could bypass the existing guards, allowing deletion of properties from built-in prototypes. Now constructor and prototype are blocked unconditionally as non-terminal path keys, matching baseSet. Calls that previously returned true and deleted the property now return false and leave the target untouched.

_.template: Fixed code injection via imports keys (GHSA-r5fr-rjxr-66jc, CVE-2026-4800, 879aaa9). Fixes an incomplete patch for CVE-2021-23337. The variable option was validated against reForbiddenIdentifierChars but importsKeys was left unguarded, allowing code injection via the same Function() constructor sink. imports keys containing forbidden identifier characters now throw "Invalid imports option passed into _.template".

Docs

• Add security notice for _.template in threat model and API docs (#6099)
• Document lower > upper behavior in _.random (#6115)
• Fix quotes in _.compact jsdoc (#6090)

lodash.* modular packages

Diff

We have also regenerated and published a select number of the lodash.* modular packages.

These modular packages had fallen out of sync significantly from the minor/patch updates to lodash. Specifically, we have brought the following packages up to parity w/ the latest lodash release because they have had CVEs on them in the past:

• lodash.orderby
• lodash.tonumber
• lodash.trim
• lodash.trimend
• lodash.sortedindexby
• lodash.zipobjectdeep
• lodash.unset
• lodash.omit
• lodash.template

Commits

• cb0b9b9 release(patch): bump main to 4.18.1 (#6177)
• 75535f5 chore: prune stale advisory refs (#6170)
• 62e91bc docs: remove n_ Node.js < 6 REPL note from README (#6165)
• 59be2de release(minor): bump to 4.18.0 (#6161)
• af63457 fix: broken tests for _.template 879aaa9
• 1073a76 fix: linting issues
• 879aaa9 fix: validate imports keys in _.template
• fe8d32e fix: block prototype pollution in baseUnset via constructor/prototype traversal
• 18ba0a3 refactor(fromPairs): use baseAssignValue for consistent assignment (#6153)
• b819080 ci: add dist sync validation workflow (#6137)
• Additional commits viewable in compare view