@lingo.dev/_compiler@0.12.8

stackblitz-labs/bolt.diy@lingo.dev/_compiler@0.12.8Jun 19, 2026by github-actions[bot]

AI Summary

An internal compiler package patch release designed to eliminate high and critical security advisories.

Key Highlights

Fixed security issues in lodash and ws dependencies.
Updated published manifests to prevent vulnerable runtime dependencies from being installed.
All changes are patch/minor bumps within the same major version.

Full Release Notes

### Patch Changes

- [#2125](https://github.com/lingodotdev/lingo.dev/pull/2125) [`1769abe`](https://github.com/lingodotdev/lingo.dev/commit/1769abe19bed227e17b0061de5973ef135c2d3bf) Thanks [@cherkanovart](https://github.com/cherkanovart)! - Resolve all high and critical security advisories. Two layers:
  - **Repo tree / `pnpm audit`**: root pnpm `overrides` pin patched, major-capped versions of transitive dependencies (axios, vite, ws, form-data, fast-xml-parser, shell-quote, lodash, serialize-javascript, minimatch, picomatch, tmp, and others), taking `pnpm audit` from 121 high + 5 critical to 0.
  - **Published packages (consumer-facing)**: bump the vulnerable runtime dependencies that ship in the published manifests to patched versions so consumers no longer install or run them — `lodash` 4.17.23 → 4.18.1 (`lingo.dev`, `@lingo.dev/_react`, `@lingo.dev/_compiler`, `@lingo.dev/compiler`), `@modelcontextprotocol/sdk` 1.22.0 → 1.26.0 (`lingo.dev`), `ws` 8.18.3 → 8.21.0 (`@lingo.dev/compiler`). All patch/minor in-major bumps; no API changes.