lingo.dev@0.137.2

lingodotdev/lingo.devlingo.dev@0.137.2Jun 19, 2026by github-actions[bot]

AI Summary

A comprehensive security patch release that eliminates all high and critical security advisories by updating vulnerable runtime dependencies and enforcing overrides in the repository tree.

Key Highlights

Resolved all high and critical security advisories via pnpm overrides.
Updated lodash to 4.18.1 in published packages.
Updated ws to 8.21.0 and @modelcontextprotocol/sdk to 1.26.0.

Full Release Notes

### Patch Changes

- [#2125](https://github.com/lingodotdev/lingo.dev/pull/2125) [`1769abe`](https://github.com/lingodotdev/lingo.dev/commit/1769abe19bed227e17b0061de5973ef135c2d3bf) Thanks [@cherkanovart](https://github.com/cherkanovart)! - Resolve all high and critical security advisories. Two layers:
  - **Repo tree / `pnpm audit`**: root pnpm `overrides` pin patched, major-capped versions of transitive dependencies (axios, vite, ws, form-data, fast-xml-parser, shell-quote, lodash, serialize-javascript, minimatch, picomatch, tmp, and others), taking `pnpm audit` from 121 high + 5 critical to 0.
  - **Published packages (consumer-facing)**: bump the vulnerable runtime dependencies that ship in the published manifests to patched versions so consumers no longer install or run them — `lodash` 4.17.23 → 4.18.1 (`lingo.dev`, `@lingo.dev/_react`, `@lingo.dev/_compiler`, `@lingo.dev/compiler`), `@modelcontextprotocol/sdk` 1.22.0 → 1.26.0 (`lingo.dev`), `ws` 8.18.3 → 8.21.0 (`@lingo.dev/compiler`). All patch/minor in-major bumps; no API changes.

- Updated dependencies [[`1769abe`](https://github.com/lingodotdev/lingo.dev/commit/1769abe19bed227e17b0061de5973ef135c2d3bf)]:
  - @lingo.dev/_react@0.7.8
  - @lingo.dev/_compiler@0.12.8