Update dependency lodash-es to v4.18.1 [SECURITY]

This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [lodash-es](https://lodash.com/custom-builds) ([source](https://redirect.github.com/lodash/lodash)) | [`4.17.21` → `4.18.1`](https://renovatebot.com/diffs/npm/lodash-es/4.17.21/4.18.1) |  |  | --- ### Lodash has Prototype Pollution Vulnerability in `_.unset` and `_.omit` functions [CVE-2025-13465](https://nvd.nist.gov/vuln/detail/CVE-2025-13465) / [GHSA-xxjr-mmjv-4gpg](https://redirect.github.com/advisories/GHSA-xxjr-mmjv-4gpg) <details> <summary>More information</summary> #### Details ##### Impact Lodash versions 4.0.0 through 4.17.22 are vulnerable to prototype pollution in the `_.unset` and `_.omit` functions. An attacker can pass crafted paths which cause Lodash to delete methods from global prototypes. The issue permits deletion of properties but does not allow overwriting their original behavior. ##### Patches This issue is patched on 4.17.23. #### Severity - CVSS Score: 6.9 / 10 (Medium) - Vector String: `CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:H/SI:H/SA:H/E:P` #### References - [https://github.com/lodash/lodash/security/advisories/GHSA-xxjr-mmjv-4gpg](https://redirect.github.com/lodash/lodash/security/advisories/GHSA-xxjr-mmjv-4gpg) - [https://nvd.nist.gov/vuln/detail/CVE-2025-13465](https://nvd.nist.gov/vuln/detail/CVE-2025-13465) - [https://github.com/lodash/lodash/commit/edadd452146f7e4bad4ea684e955708931d84d81](https://redirect.github.com/lodash/lodash/commit/edadd452146f7e4bad4ea684e955708931d84d81) - [https://github.com/advisories/GHSA-xxjr-mmjv-4gpg](https://redirect.github.com/advisories/GHSA-xxjr-mmjv-4gpg) This data is provided by the [GitHub Advisory Database](https://redirect.github.com/advisories/GHSA-xxjr-mmjv-4gpg) ([CC-BY 4.0](https://redirect.github.com/github/advisory-database/blob/main/LICENSE.md)). </details> --- ### lodash vulnerable to Code Injection via `_.template` imports key names [CVE-2026-4800](https://nvd.nist.gov/vuln/detail/CVE-2026-4800) / [GHSA-r5fr-rjxr-66jc](https://redirect.github.com/advisories/GHSA-r5fr-rjxr-66jc) <details> <summary>More information</summary> #### Details ##### Impact The fix for [CVE-2021-23337](https://redirect.github.com/advisories/GHSA-35jh-r3h4-6jhm) added validation for the `variable` option in `_.template` but did not apply the same validation to `options.imports` key names. Both paths flow into the same `Function()` constructor sink. When an application passes untrusted input as `options.imports` key names, an attacker can inject default-parameter expressions that execute arbitrary code at template compilation time. Additionally, `_.template` uses `assignInWith` to merge imports, which enumerates inherited properties via `for..in`. If `Object.prototype` has been polluted by any other vector, the polluted keys are copied into the imports object and passed to `Function()`. ##### Patches Users should upgrade to version 4.18.0. The fix applies two changes: 1. Validate `importsKeys` against the existing `reForbiddenIdentifierChars` regex (same check already used for the `variable` option) 2. Replace `assignInWith` with `assignWith` when merging imports, so only own properties are enumerated ##### Workarounds Do not pass untrusted input as key names in `options.imports`. Only use developer-controlled, static key names. #### Severity - CVSS Score: 8.1 / 10 (High) - Vector String: `CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H` #### References - [https://github.com/lodash/lodash/security/advisories/GHSA-r5fr-rjxr-66jc](https://redirect.github.com/lodash/lodash/security/advisories/GHSA-r5fr-rjxr-66jc) - [https://nvd.nist.gov/vuln/detail/CVE-2026-4800](https://nvd.nist.gov/vuln/detail/CVE-2026-4800) - [https://github.com/lodash/lodash/commit/3469357cff396a26c363f8c1b5a91dde28ba4b1c](https://redirect.github.com/lodash/lodash/commit/3469357cff396a26c363f8c1b5a91dde28ba4b1c) - [https://cna.openjsf.org/security-advisories.html](https://cna.openjsf.org/security-advisories.html) - [https://github.com/advisories/GHSA-35jh-r3h4-6jhm](https://redirect.github.com/advisories/GHSA-35jh-r3h4-6jhm) - [https://github.com/advisories/GHSA-r5fr-rjxr-66jc](https://redirect.github.com/advisories/GHSA-r5fr-rjxr-66jc) This data is provided by the [GitHub Advisory Database](https://redirect.github.com/advisories/GHSA-r5fr-rjxr-66jc) ([CC-BY 4.0](https://redirect.github.com/github/advisory-database/blob/main/LICENSE.md)). </details> --- ### lodash vulnerable to Prototype Pollution via array path bypass in `_.unset` and `_.omit` [CVE-2026-2950](https://nvd.nist.gov/vuln/detail/CVE-2026-2950) / [GHSA-f23m-r3pf-42rh](https://redirect.github.com/advisories/GHSA-f23m-r3pf-42rh) <details> <summary>More information</summary> #### Details ##### Impact Lodash versions 4.17.23 and earlier are vulnerable to prototype pollution in the `_.unset` and `_.omit` functions. The fix for [CVE-2025-13465](https://redirect.github.com/lodash/lodash/security/advisories/GHSA-xxjr-mmjv-4gpg) only guards against string key members, so an attacker can bypass the check by passing array-wrapped path segments. This allows deletion of properties from built-in prototypes such as `Object.prototype`, `Number.prototype`, and `String.prototype`. The issue permits deletion of prototype properties but does not allow overwriting their original behavior. ##### Patches This issue is patched in 4.18.0. ##### Workarounds None. Upgrade to the patched version. #### Severity - CVSS Score: 6.5 / 10 (Medium) - Vector String: `CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L` #### References - [https://github.com/lodash/lodash/security/advisories/GHSA-f23m-r3pf-42rh](https://redirect.github.com/lodash/lodash/security/advisories/GHSA-f23m-r3pf-42rh) - [https://github.com/lodash/lodash/security/advisories/GHSA-xxjr-mmjv-4gpg](https://redirect.github.com/lodash/lodash/security/advisories/GHSA-xxjr-mmjv-4gpg) - [https://nvd.nist.gov/vuln/detail/CVE-2026-2950](https://nvd.nist.gov/vuln/detail/CVE-2026-2950) - [https://github.com/advisories/GHSA-f23m-r3pf-42rh](https://redirect.github.com/advisories/GHSA-f23m-r3pf-42rh) This data is provided by the [GitHub Advisory Database](https://redirect.github.com/advisories/GHSA-f23m-r3pf-42rh) ([CC-BY 4.0](https://redirect.github.com/github/advisory-database/blob/main/LICENSE.md)). </details> --- ### Release Notes <details> <summary>lodash/lodash (lodash-es)</summary> ### [`v4.18.1`]() [Compare Source](https://redirect.github.com/lodash/lodash/compare/4.18.0...4.18.1) ### [`v4.18.0`]() [Compare Source](https://redirect.github.com/lodash/lodash/compare/4.17.23...4.18.0) ### [`v4.17.23`](https://redirect.github.com/lodash/lodash/compare/0082be44648961341600e879042f74cd29d65d05...4.17.23) [Compare Source](https://redirect.github.com/lodash/lodash/compare/0082be44648961341600e879042f74cd29d65d05...4.17.23) ### [`v4.17.22`](https://redirect.github.com/lodash/lodash/compare/4.17.21...0082be44648961341600e879042f74cd29d65d05) [Compare Source](https://redirect.github.com/lodash/lodash/compare/4.17.21...0082be44648961341600e879042f74cd29d65d05) </details> --- ### Configuration 📅 **Schedule**: (in timezone EST) - Branch creation - "" - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/techniq/svelte-ux). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4xNzkuMyIsInVwZGF0ZWRJblZlciI6IjQzLjE3OS4zIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJkZXBlbmRlbmNpZXMiXX0=-->