@lingo.dev/compiler@0.4.6

stackblitz-labs/bolt.diy@lingo.dev/compiler@0.4.6Jun 19, 2026by github-actions[bot]

AI Summary

A patch release for the compiler package addressing high and critical security advisories found in transitive dependencies.

Key Highlights

Resolved security vulnerabilities in lodash and ws.
Updated to patched versions of vulnerable runtime dependencies.
Maintains backward compatibility with no API changes.

Full Release Notes

### Patch Changes

- [#2125](https://github.com/lingodotdev/lingo.dev/pull/2125) [`1769abe`](https://github.com/lingodotdev/lingo.dev/commit/1769abe19bed227e17b0061de5973ef135c2d3bf) Thanks [@cherkanovart](https://github.com/cherkanovart)! - Resolve all high and critical security advisories. Two layers:
  - **Repo tree / `pnpm audit`**: root pnpm `overrides` pin patched, major-capped versions of transitive dependencies (axios, vite, ws, form-data, fast-xml-parser, shell-quote, lodash, serialize-javascript, minimatch, picomatch, tmp, and others), taking `pnpm audit` from 121 high + 5 critical to 0.
  - **Published packages (consumer-facing)**: bump the vulnerable runtime dependencies that ship in the published manifests to patched versions so consumers no longer install or run them — `lodash` 4.17.23 → 4.18.1 (`lingo.dev`, `@lingo.dev/_react`, `@lingo.dev/_compiler`, `@lingo.dev/compiler`), `@modelcontextprotocol/sdk` 1.22.0 → 1.26.0 (`lingo.dev`), `ws` 8.18.3 → 8.21.0 (`@lingo.dev/compiler`). All patch/minor in-major bumps; no API changes.

- Updated dependencies [[`1769abe`](https://github.com/lingodotdev/lingo.dev/commit/1769abe19bed227e17b0061de5973ef135c2d3bf)]:
  - lingo.dev@0.137.2