[Snyk] Security upgrade lodash from 4.17.4 to 4.18.1

[philvarner-snyk]

Snyk has created this PR to fix 2 vulnerabilities in the npm dependencies of this project.

Snyk changed the following file(s):

• package.json
• package-lock.json

Vulnerabilities that will be fixed with an upgrade:

	Issue	Score
	Arbitrary Code Injection SNYK-JS-LODASH-15869625	243
	Prototype Pollution SNYK-JS-LODASH-15869619	117

Breaking Change Risk

Notice: This assessment is enhanced by AI.

---

Important

• Check the changes in this PR to ensure they won't cause issues with your project.
• Max score is 1000. Note that the real score may have changed since the PR was raised.
• This PR was automatically created by Snyk using the credentials of a real user.

---

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report
📜 Customise PR templates
🛠 Adjust project settings
📚 Read about Snyk's upgrade logic

---

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Prototype Pollution
🦉 Arbitrary Code Injection

[philvarner-snyk]

This upgrade of lodash from 4.17.4 to 4.18.1 is a minor version update that includes security fixes which may introduce behavioral changes.

Key Changes:

• Behavioral Change in _.unset / _.omit: To fix a prototype pollution vulnerability (GHSA-f23m-r3pf-42rh), attempts to use these functions to modify an object's constructor or prototype will now fail silently, returning false instead of true. Calls that previously deleted the property will now leave the target object untouched. This could affect code that relied on the previous, unsafe behavior.
• Security Fix in _.template: Patches a code injection vulnerability (GHSA-r5fr-rjxr-66jc) by adding stricter validation to the imports option.
• Build Fix: Version 4.18.1 corrects a ReferenceError issue in modular builds of template and fromPairs that was present in 4.18.0.

Recommendation: While these are primarily security-driven changes, the modification to _.unset and _.omit is a behavioral change. It is recommended to verify that your application does not rely on the old, unsafe behavior of modifying object prototypes with these functions.

Source: GitHub Releases

Notice 🤖: This content was augmented using artificial intelligence. AI-generated content may contain errors and should be reviewed for accuracy before use.

[philvarner-snyk]

✅ Snyk checks have passed. No issues have been found so far.

Status	Scan Engine	Critical	High	Medium	Low	Total (0)
✅	Open Source Security	0	0	0	0	0 issues
✅	Licenses	0	0	0	0	0 issues
✅	Code Security	0	0	0	0	0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.