[Snyk] Upgrade lodash-es from 4.17.10 to 4.18.1

[newf-bgreet]

Snyk has created this PR to upgrade lodash-es from 4.17.10 to 4.18.1.

ℹ️ Keep your dependencies up-to-date. This makes it easier to fix existing vulnerabilities and to more quickly identify and fix newly disclosed vulnerabilities when they affect your project.

---

• The recommended version is 11 versions ahead of your current version.

• The recommended version was released 3 months ago.

Issues fixed by the recommended upgrade:

	Issue	Score	Exploit Maturity
	Arbitrary Code Injection SNYK-JS-LODASHES-15869627	559	No Known Exploit
	Prototype Pollution SNYK-JS-LODASHES-2434283	559	Proof of Concept
	Code Injection SNYK-JS-LODASHES-2434284	559	Proof of Concept
	Prototype Pollution SNYK-JS-LODASHES-2434285	559	Proof of Concept
	Prototype Pollution SNYK-JS-LODASHES-2434287	559	Proof of Concept
	Prototype Pollution SNYK-JS-LODASHES-2434290	559	Proof of Concept
	Prototype Pollution SNYK-JS-LODASHES-15053836	559	No Known Exploit
	Prototype Pollution SNYK-JS-LODASHES-15869621	559	No Known Exploit
	Regular Expression Denial of Service (ReDoS) SNYK-JS-LODASHES-2434286	559	Proof of Concept
	Regular Expression Denial of Service (ReDoS) SNYK-JS-LODASHES-2434289	559	Proof of Concept

Breaking Change Risk

Notice: This assessment is enhanced by AI.

---

Important

• Check the changes in this PR to ensure they won't cause issues with your project.
• This PR was automatically created by Snyk using the credentials of a real user.
• Max score is 1000. Note that the real score may have changed since the PR was raised.

---

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open upgrade PRs.

For more information:

• 🧐 View latest project report
• 📜 Customise PR templates
• 🛠 Adjust upgrade PR settings
• 🔕 Ignore this dependency or unsubscribe from future upgrade PRs

[newf-bgreet]

This is a minor version upgrade for lodash-es, which corresponds to the main lodash package. The primary changes are in version 4.18.0 and consist of security fixes that introduce stricter behavior.

Behavioral Changes:

• _.unset / _.omit: As part of a security fix for prototype pollution, calls attempting to traverse constructor or prototype will now return false and not modify the object. Previously, these calls might have returned true.
• _.template: To prevent code injection, the imports option is now validated more strictly. An error will be thrown if keys contain forbidden characters, which may not have happened in previous versions.

Recommendation:
While these changes are part of security hardening and unlikely to impact typical usage, they represent a behavioral change. It is recommended to verify any application code that relies on the specific edge-case behaviors of _.unset, _.omit, or _.template.

Source: GitHub Release Notes

Notice 🤖: This content was augmented using artificial intelligence. AI-generated content may contain errors and should be reviewed for accuracy before use.