fix: bump lodash to ^4.18.1 (CVE-2026-4800)

[Copilot]

CVE-2026-4800 (GHSA-r5fr-rjxr-66jc) is a code-injection vulnerability in lodash's _.template via the imports key, patched in 4.18.0. Lodash 4.17.21–4.17.23 remain vulnerable.

Changes

• package.json — Added "lodash": "^4.18.1" to the resolutions field. Lodash is a transitive-only dependency, so a resolution override is the correct forcing mechanism.
• yarn.lock — Regenerated; all transitive consumers now resolve to lodash 4.18.1.

"resolutions": {
  "cross-spawn": "^7.0.6",
  "lodash": "^4.18.1",
  ...
}

Original prompt

fix: bump lodash to >=4.18.0 (CVE-2026-4800)

CVE-2026-4800 / GHSA-r5fr-rjxr-66jc: code injection via _.template imports key. Patched in 4.18.0.

The currently open dependabot PR #281 (lodash 4.17.21 -> 4.17.23) is insufficient — 4.17.23 is still listed as vulnerable.

Steps:

1. Close PR chore(deps): bump lodash from 4.17.21 to 4.17.23 #281.
2. yarn why lodash (or npm equivalent) — identify whether lodash is a direct dep, devDep, or transitive.
3. If direct: bump to ^4.18.1 in package.json.
4. If transitive: add "lodash": "4.18.1" to root resolutions (or overrides for npm).
5. yarn install, run tests, commit lockfile.
6. Verify: yarn why lodash shows only >= 4.18.0.

Acceptance: CVE-2026-4800 cleared in next scan.

[github-actions]

size-limit report 📦

Path	Size
src/main.js	6.71 KB (0%)

[Ninerian]

@dependabot rebase

[Ninerian]

main already contains 'lodash': '^4.18.0' in resolutions — this PR is superseded.