fix(deps): update minor and patch dependencies for gatsby-source-contentful

[renovate]

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
@contentful/rich-text-react-renderer	^15.12.1 → ^15.22.11
@contentful/rich-text-types	^15.12.1 → ^15.15.1
contentful (source)	^9.1.33 → ^9.3.7
lodash (source)	^4.17.21 → ^4.18.1
node-fetch	^2.6.7 → ^2.7.0
url	^0.11.0 → ^0.11.4

---

Release Notes

contentful/rich-text (@​contentful/rich-text-react-renderer)

v15.22.11

Compare Source

Note: Version bump only for package @​contentful/rich-text-react-renderer

v15.22.10

Compare Source

Note: Version bump only for package @​contentful/rich-text-react-renderer

v15.22.9

Compare Source

Note: Version bump only for package @​contentful/rich-text-react-renderer

v15.22.8

Compare Source

Note: Version bump only for package @​contentful/rich-text-react-renderer

v15.22.7

Compare Source

Note: Version bump only for package @​contentful/rich-text-react-renderer

v15.22.6

Compare Source

Note: Version bump only for package @​contentful/rich-text-react-renderer

v15.22.5

Compare Source

Note: Version bump only for package @​contentful/rich-text-react-renderer

v15.22.4

Compare Source

Note: Version bump only for package @​contentful/rich-text-react-renderer

v15.22.3

Compare Source

Bug Fixes

• preserveWhitespace option conflicting with renderText (#​618) (c146dc4)

v15.22.2

Compare Source

Note: Version bump only for package @​contentful/rich-text-react-renderer

v15.22.1

Compare Source

Note: Version bump only for package @​contentful/rich-text-react-renderer

v15.22.0

Compare Source

Features

• switch from tslint to eslint [TOL-2218][TOL-2203] (#​594) (c077b5a)

v15.21.4

Compare Source

Note: Version bump only for package @​contentful/rich-text-react-renderer

v15.21.3

Compare Source

Note: Version bump only for package @​contentful/rich-text-react-renderer

v15.21.2

Compare Source

Note: Version bump only for package @​contentful/rich-text-react-renderer

v15.21.1

Compare Source

Note: Version bump only for package @​contentful/rich-text-react-renderer

v15.21.0

Compare Source

Features

• add strikethrough support (#​562) (b87d0c3)

v15.20.0

Compare Source

Features

• upgrading rollup to latest version [TOL-2097] (#​559) (f14d197)

v15.19.6

Compare Source

Note: Version bump only for package @​contentful/rich-text-react-renderer

v15.19.5

Compare Source

Bug Fixes

• 🐛 handle multiple space rendering when using preserveWhitespace (#​531) (982b21b), closes #​514

v15.19.4

Compare Source

Note: Version bump only for package @​contentful/rich-text-react-renderer

v15.19.3

Compare Source

Note: Version bump only for package @​contentful/rich-text-react-renderer

v15.19.2

Compare Source

Note: Version bump only for package @​contentful/rich-text-react-renderer

v15.19.1

Compare Source

Note: Version bump only for package @​contentful/rich-text-react-renderer

v15.19.0

Compare Source

Features

• add default renderers for new resource nodes (#​504) (f748e6b)

v15.18.0

Compare Source

Features

• preserve formatting linebreak whitespace (#​497) (e62ab92)

v15.17.2

Compare Source

Note: Version bump only for package @​contentful/rich-text-react-renderer

v15.17.1

Compare Source

Note: Version bump only for package @​contentful/rich-text-react-renderer

v15.17.0

Compare Source

Features

• add default renderer for the embedded-resource-block node (#​474) (844c011)

v15.16.5

Compare Source

Note: Version bump only for package @​contentful/rich-text-react-renderer

v15.16.4

Compare Source

Note: Version bump only for package @​contentful/rich-text-react-renderer

v15.16.3

Compare Source

Note: Version bump only for package @​contentful/rich-text-react-renderer

v15.16.2

Compare Source

Note: Version bump only for package @​contentful/rich-text-react-renderer

v15.16.0

Compare Source

15.16.0 (2022-12-01)

15.15.1 (2022-11-30)

Bug Fixes

• release: switch to yarn (#​420) (0e53501)

15.15.0 (2022-11-29)

15.14.1 (2022-11-23)

15.14.0 (2022-11-14)

Features

• add super/sub script types (#​391) (2562f66)

15.13.2 (2022-09-07)

Bug Fixes

• add prettier write command (#​345) (0edad4c)

15.12.1 (2022-04-21)

Bug Fixes

• upgrade react peerDependencies to support react^18.0.0 (#​323) (7a0bfdf)

15.12.0 (2022-03-25)

15.11.1 (2022-01-04)

15.11.0 (2021-12-27)

Bug Fixes

• react-renderer: wrap table rows in tbody (#​300) (e23d1f4)

15.10.1 (2021-12-21)

15.10.0 (2021-12-15)

15.9.1 (2021-12-10)

15.9.0 (2021-12-09)

15.7.0 (2021-11-11)

15.6.2 (2021-11-05)

15.6.1 (2021-11-05)

15.6.0 (2021-11-04)

15.5.1 (2021-10-25)

15.5.0 (2021-10-25)

15.4.0 (2021-09-16)

Features

• html+react: render Table header as (#​269) (0f82905)

15.3.6 (2021-09-15)

15.3.5 (2021-09-13)

15.3.3 (2021-09-07)

15.3.2 (2021-09-07)

15.3.1 (2021-09-07)

15.3.0 (2021-09-06)

15.2.0 (2021-08-16)

Bug Fixes

• audit fix aiming mixing-deep vulnerability (2b98cbd)

15.1.0 (2021-08-02)

Features

• 🎸 add RT react renderer tables support (fddfb8a)

15.0.0 (2021-06-15)

14.1.3 (2021-04-12)

14.1.2 (2020-11-02)

14.0.1 (2020-01-30)

14.0.0 (2020-01-28)

13.4.0 (2019-08-01)

Features

• 🎸 Adds BLOCKS.DOCUMENT renderer support to react-renderer (57c922c), closes #​104

13.2.0 (2019-03-18)

Features

• 🎸 renderText option to alter all text (f684a6e)

13.1.0 (2019-03-04)

13.0.1 (2019-02-11)

Bug Fixes

• 🐛 Fix wrong import in tests (bead583)

Features

• 🎸 Initial rich-text-react-renderer implementation (06dad9b)

v15.15.1

Compare Source

Bug Fixes

• release: switch to yarn (#​420) (0e53501)

contentful/contentful.js (contentful)

v9.3.7

Compare Source

Bug Fixes

• bump axios to address CVE (#​2306) (8a358a8)

v9.3.6

Compare Source

Bug Fixes

• bump axios version (9766726)

v9.3.5

Compare Source

v9.3.4

Compare Source

v9.3.3

Compare Source

Bug Fixes

• forcing a new release (#​1693) (5ef0984)

v9.3.2

Compare Source

Bug Fixes

• webpack: adjust bundler to avoid using function constructor (#​1675) (672c9da)

v9.3.1

Compare Source

v9.3.0

Compare Source

Features

• add allowed resources to Field (d8af925)

v9.2.20

Compare Source

v9.2.19

Compare Source

Bug Fixes

• typescript: update rich-text types (#​1617) (e29760f)

v9.2.18

Compare Source

Bug Fixes

• bump contentful-sdk-core (8e1c06b)

v9.2.17

Compare Source

Bug Fixes

• docs build again [NONE] (#​1611) (ba90981)

v9.2.16

Compare Source

v9.2.15

Compare Source

v9.2.14

Compare Source

v9.2.13

Compare Source

v9.2.12

Compare Source

v9.2.11

Compare Source

v9.2.10

Compare Source

v9.2.9

Compare Source

Bug Fixes

• broken fast-copy dependency 2 (#​1514) (a3b68fb)

v9.2.8

Compare Source

Bug Fixes

• broken fast-copy dependency [NONE] (#​1511) (f20c88f)

v9.2.7

Compare Source

v9.2.6

Compare Source

v9.2.5

Compare Source

Bug Fixes

• better test assertions, remove only (dc41680)
• broken integration test (ad4ca20)
• remove only (dd525e1)

v9.2.4

Compare Source

Bug Fixes

• deps: update contentful-sdk-jsdoc to 3.0.0 (bc24326)

v9.2.3

Compare Source

v9.2.2

Compare Source

v9.1.34

Compare Source

lodash/lodash (lodash)

v4.18.1

Compare Source

Bugs

Fixes a ReferenceError issue in lodash lodash-es lodash-amd and lodash.template when using the template and fromPairs functions from the modular builds. See #​6167 (comment)

These defects were related to how lodash distributions are built from the main branch using https://github.com/lodash-archive/lodash-cli. When internal dependencies change inside lodash functions, equivalent updates need to be made to a mapping in the lodash-cli. (hey, it was ahead of its time once upon a time!). We know this, but we missed it in the last release. It's the kind of thing that passes in CI, but fails bc the build is not the same thing you tested.

There is no diff on main for this, but you can see the diffs for each of the npm packages on their respective branches:

• lodash: lodash/lodash@4.18.0-npm...4.18.1-npm
• lodash-es: lodash/lodash@4.18.0-es...4.18.1-es
• lodash-amd: lodash/lodash@4.18.0-amd...4.18.1-amd
• lodash.templatelodash/lodash@4.18.0-npm-packages...4.18.1-npm-packages

v4.18.0

Compare Source

v4.18.0

Full Changelog: lodash/lodash@4.17.23...4.18.0

Security

_.unset / _.omit: Fixed prototype pollution via constructor/prototype path traversal (GHSA-f23m-r3pf-42rh, fe8d32e). Previously, array-wrapped path segments and primitive roots could bypass the existing guards, allowing deletion of properties from built-in prototypes. Now constructor and prototype are blocked unconditionally as non-terminal path keys, matching baseSet. Calls that previously returned true and deleted the property now return false and leave the target untouched.

_.template: Fixed code injection via imports keys (GHSA-r5fr-rjxr-66jc, CVE-2026-4800, 879aaa9). Fixes an incomplete patch for CVE-2021-23337. The variable option was validated against reForbiddenIdentifierChars but importsKeys was left unguarded, allowing code injection via the same Function() constructor sink. imports keys containing forbidden identifier characters now throw "Invalid imports option passed into _.template".

Docs

• Add security notice for _.template in threat model and API docs (#​6099)
• Document lower > upper behavior in _.random (#​6115)
• Fix quotes in _.compact jsdoc (#​6090)

lodash.* modular packages

Diff

We have also regenerated and published a select number of the lodash.* modular packages.

These modular packages had fallen out of sync significantly from the minor/patch updates to lodash. Specifically, we have brought the following packages up to parity w/ the latest lodash release because they have had CVEs on them in the past:

• lodash.orderby
• lodash.tonumber
• lodash.trim
• lodash.trimend
• lodash.sortedindexby
• lodash.zipobjectdeep
• lodash.unset
• lodash.omit
• lodash.template

v4.17.23

Compare Source

node-fetch/node-fetch (node-fetch)

v2.7.0

Compare Source

Features

• AbortError (#​1744) (9b9d458)

v2.6.13

Compare Source

Bug Fixes

• Remove the default connection close header (#​1765) (65ae25a), closes #​1735 #​1473 #​1736

v2.6.12

Compare Source

Bug Fixes

• socket variable testing for undefined (#​1726) (8bc3a7c)

v2.6.11

Compare Source

Reverts

• Revert "fix: handle bom in text and json (#​1739)" (#​1741) (afb36f6), closes #​1739 #​1741

v2.6.10

Compare Source

Bug Fixes

• handle bom in text and json (#​1739) (29909d7)

v2.6.9

Compare Source

Bug Fixes

• "global is not defined" (#​1704) (70f592d)

v2.6.8

Compare Source

Bug Fixes

• headers: don't forward secure headers on protocol change (#​1605) (fddad0e), closes #​1599
• premature close with chunked transfer encoding and for async iterators in Node 12 (#​1172) (50536d1), closes #​1064 /github.com/node-fetch/node-fetch/pull/1064#issuecomment-849167400
• prevent hoisting of the undefined global variable in browser.js (#​1534) (8bb6e31)

defunctzombie/node-url (url)

v0.11.4

Compare Source

v0.11.3

Compare Source

v0.11.2

Compare Source

v0.11.1

Compare Source

---

Configuration

📅 Schedule: (in timezone GMT)

• Branch creation
  • "before 7am on the first day of the month"
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.