Bump lodash to >= 4.18.0 (security)

[jencarlucci]

Security Dependency Updates

Dependency	From	To	Vulnerability	Advisory
lodash	4.17.21	4.18.1	Code Injection via _.template imports key names (CVE-2026-4800)	GHSA-r5fr-rjxr-66jc

Details

• lodash is a transitive dev dependency (via eslint-plugin-json)
• Added an overrides entry in package.json to force lodash >= 4.18.0
• This resolves Dependabot alert #18

Closes https://github.com/github/vuln-mgmt/issues/192979

[Copilot]

Pull request overview

Updates the repository’s Node.js dependency resolution to mitigate a lodash security advisory by forcing lodash to resolve to a patched version.

Changes:

• Add an overrides rule in package.json to require lodash >= 4.18.0.
• Update package-lock.json to resolve lodash to 4.18.1.

Show a summary per file

File	Description
package.json	Adds lodash override (and minor formatting change to eslintConfig).
package-lock.json	Updates resolved lodash version to 4.18.1 and adjusts lock entries accordingly.

Copilot's findings

Tip

Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

• Files reviewed: 1/2 changed files
• Comments generated: 1

[Copilot]

The override range >=4.18.0 will allow future major versions (e.g. 5.x) if/when they’re published, which can introduce unexpected breakage even for transitive deps. Consider constraining this to the current major (e.g. ^4.18.1 or pinning 4.18.1) while still satisfying the advisory.

Suggested change

	"lodash": ">=4.18.0"
	"lodash": "^4.18.0"