Address CVEs

[mluypaert]

Describe the usability issue
Several nightingale components currently depend on an old lodash-es which has one or more know CVEs (see below). These CVEs have been fixed in 4.17.21, but several nightingale components currently pin an exact older version, preventing upgrade to patched version.

• GHSA-p6mc-m468-83gw
• GHSA-35jh-r3h4-6jhm
• GHSA-29mw-wpgm-hmr9

How does the solution address the problem?
I've created PR #324 which I hope addresses this problem by allowing patch and minor upgrades to es-lodash.

Additional context
Please review and publish (as 5.6.3?) to npm, so projects depending on these libraries (like alliance-genome/agr_pavi ) can address security vulnerabilities introduced by dependence on the nightingale components.

[cycle20]

Hi,
Any update on this?
I got these messages during development:

ubuntu@49c475dc5652:~$ node -v                                              
v24.14.0          
ubuntu@49c475dc5652:~$ npm -v 
11.11.0                
ubuntu@49c475dc5652:~$ npm audit fix

up to date, audited 156 packages in 2s 

24 packages are looking for funding
  run `npm fund` for details

# npm audit report

lodash-es  <=4.17.22
Severity: high
Prototype Pollution in lodash - https://github.com/advisories/GHSA-p6mc-m468-83gw
Command Injection in lodash - https://github.com/advisories/GHSA-35jh-r3h4-6jhm
Regular Expression Denial of Service (ReDoS) in lodash - https://github.com/advisories/GHSA-29mw-wpgm-hmr9
Lodash has Prototype Pollution Vulnerability in `_.unset` and `_.omit` functions - https://github.com/advisories/GHSA-xxjr-mmjv-4gpg
fix available via `npm audit fix --force`
Will install @nightingale-elements/nightingale-track@5.2.0, which is a breaking change
node_modules/lodash-es
  @nightingale-elements/nightingale-track  >=5.3.0
  Depends on vulnerable versions of lodash-es
  node_modules/@nightingale-elements/nightingale-track

2 high severity vulnerabilities

To address all issues (including breaking changes), run:
  npm audit fix --force

my config:

jq .dependencies package.json                                                                                                     
{
  "@nightingale-elements/nightingale-manager": "^5.6.0",
  "@nightingale-elements/nightingale-navigation": "^5.6.0",
  "@nightingale-elements/nightingale-sequence": "^5.6.0",
  "@nightingale-elements/nightingale-track": "^5.6.0",
  "pako": "^2.1.0"
}

Could you manage the created PR?

Best regards,
Csongor

[cycle20]

@mluypaert: another related PR: #313

---

edit

Can we bump up by the referred PR? I have no experience with dependabot at all.

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself.
You can also trigger a rebase manually by commenting @dependabot rebase.

Probably the magic @dependabot rebase comment just rebases the PR, but doesn't merge it automatically