fix: upgrade lodash to 4.18.1 to patch CVE-2026-4800 (Dependabot #97)

[PujaSingh7655]

Summary

• Adds "lodash": "^4.18.0" to the resolutions field in package.json to force all transitive dependents to use the patched version
• Resolves Dependabot alert #97
• yarn.lock now pins lodash to 4.18.1

Security Advisory

GHSA-r5fr-rjxr-66jc / CVE-2026-4800 — High severity
lodash versions >= 4.0.0, <= 4.17.23 are vulnerable to Code Injection via _.template imports key names. Untrusted input passed as options.imports key names flows into a Function() constructor sink, allowing arbitrary code execution at template compile time.

The fix (lodash 4.18.0+) validates importsKeys and replaces assignInWith with assignWith to avoid prototype pollution.

Impact

lodash is a transitive dev dependency only — it is not shipped in the production bundle. Risk is limited to the build/test environment.

Test plan

• All 52 unit tests pass (yarn test-unit)
• yarn.lock updated — lodash resolves to 4.18.1

🤖 Generated with Claude Code

[github-actions]

size-limit report 📦

Path	Size
src/main.js	6.71 KB (0%)

[staffbase-actions]

🎉 This PR is included in version 3.1.2 🎉

The release is available on:

• npm package (@latest dist-tag)
• GitHub release

Your semantic-release bot 📦🚀