Update dependency lodash to v4.18.1

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
lodash (source)	4.17.23 → 4.18.1

---

Release Notes

lodash/lodash (lodash)

v4.18.1

Compare Source

Bugs

Fixes a ReferenceError issue in lodash lodash-es lodash-amd and lodash.template when using the template and fromPairs functions from the modular builds. See #​6167 (comment)

These defects were related to how lodash distributions are built from the main branch using https://github.com/lodash-archive/lodash-cli. When internal dependencies change inside lodash functions, equivalent updates need to be made to a mapping in the lodash-cli. (hey, it was ahead of its time once upon a time!). We know this, but we missed it in the last release. It's the kind of thing that passes in CI, but fails bc the build is not the same thing you tested.

There is no diff on main for this, but you can see the diffs for each of the npm packages on their respective branches:

• lodash: lodash/lodash@4.18.0-npm...4.18.1-npm
• lodash-es: lodash/lodash@4.18.0-es...4.18.1-es
• lodash-amd: lodash/lodash@4.18.0-amd...4.18.1-amd
• lodash.templatelodash/lodash@4.18.0-npm-packages...4.18.1-npm-packages

v4.18.0

Compare Source

v4.18.0

Full Changelog: lodash/lodash@4.17.23...4.18.0

Security

_.unset / _.omit: Fixed prototype pollution via constructor/prototype path traversal (GHSA-f23m-r3pf-42rh, fe8d32e). Previously, array-wrapped path segments and primitive roots could bypass the existing guards, allowing deletion of properties from built-in prototypes. Now constructor and prototype are blocked unconditionally as non-terminal path keys, matching baseSet. Calls that previously returned true and deleted the property now return false and leave the target untouched.

_.template: Fixed code injection via imports keys (GHSA-r5fr-rjxr-66jc, CVE-2026-4800, 879aaa9). Fixes an incomplete patch for CVE-2021-23337. The variable option was validated against reForbiddenIdentifierChars but importsKeys was left unguarded, allowing code injection via the same Function() constructor sink. imports keys containing forbidden identifier characters now throw "Invalid imports option passed into _.template".

Docs

• Add security notice for _.template in threat model and API docs (#​6099)
• Document lower > upper behavior in _.random (#​6115)
• Fix quotes in _.compact jsdoc (#​6090)

lodash.* modular packages

Diff

We have also regenerated and published a select number of the lodash.* modular packages.

These modular packages had fallen out of sync significantly from the minor/patch updates to lodash. Specifically, we have brought the following packages up to parity w/ the latest lodash release because they have had CVEs on them in the past:

• lodash.orderby
• lodash.tonumber
• lodash.trim
• lodash.trimend
• lodash.sortedindexby
• lodash.zipobjectdeep
• lodash.unset
• lodash.omit
• lodash.template

---

Configuration

📅 Schedule: (in timezone America/New_York)

• Branch creation
  • Between 12:00 AM and 11:59 PM (* 0-23 * * *)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[renovate]

⚠️ Artifact update problem

Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

• any of the package files in this branch needs updating, or
• the branch becomes conflicted, or
• you click the rebase/retry checkbox if found above, or
• you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: package-lock.json

npm warn Unknown env config "store". This will stop working in the next major version of npm. See `npm help npmrc` for supported config options.
npm error code ERESOLVE
npm error ERESOLVE could not resolve
npm error
npm error While resolving: react-beautiful-dnd@13.1.1
npm error Found: react@19.2.4
npm error node_modules/react
npm error   peer react@">=16.8.0" from @emotion/react@11.14.0
npm error   node_modules/@emotion/react
npm error     peer @emotion/react@"^11.0.0-rc.0" from @emotion/styled@11.14.1
npm error     node_modules/@emotion/styled
npm error       peerOptional @emotion/styled@"^11.3.0" from @mui/lab@7.0.1-beta.23
npm error       node_modules/@mui/lab
npm error         @mui/lab@"^7.0.1-beta.19" from the root project
npm error       4 more (@mui/material, @mui/styled-engine, @mui/system, the root project)
npm error     peerOptional @emotion/react@"^11.5.0" from @mui/lab@7.0.1-beta.23
npm error     node_modules/@mui/lab
npm error       @mui/lab@"^7.0.1-beta.19" from the root project
npm error     5 more (@mui/material, @mui/styled-engine, @mui/system, ...)
npm error   peer react@">=16.8.0" from @emotion/styled@11.14.1
npm error   node_modules/@emotion/styled
npm error     peerOptional @emotion/styled@"^11.3.0" from @mui/lab@7.0.1-beta.23
npm error     node_modules/@mui/lab
npm error       @mui/lab@"^7.0.1-beta.19" from the root project
npm error     peerOptional @emotion/styled@"^11.3.0" from @mui/material@7.3.9
npm error     node_modules/@mui/material
npm error       peer @mui/material@"^7.3.9" from @mui/icons-material@7.3.9
npm error       node_modules/@mui/icons-material
npm error         @mui/icons-material@"^7.3.5" from the root project
npm error       2 more (@mui/lab, the root project)
npm error     3 more (@mui/styled-engine, @mui/system, the root project)
npm error   29 more (@emotion/use-insertion-effect-with-fallbacks, ...)
npm error
npm error Could not resolve dependency:
npm error peer react@"^16.8.5 || ^17.0.0 || ^18.0.0" from react-beautiful-dnd@13.1.1
npm error node_modules/react-beautiful-dnd
npm error   react-beautiful-dnd@"^13.1.1" from the root project
npm error
npm error Conflicting peer dependency: react@18.3.1
npm error node_modules/react
npm error   peer react@"^16.8.5 || ^17.0.0 || ^18.0.0" from react-beautiful-dnd@13.1.1
npm error   node_modules/react-beautiful-dnd
npm error     react-beautiful-dnd@"^13.1.1" from the root project
npm error
npm error Fix the upstream dependency conflict, or retry this command with --force or --legacy-peer-deps to accept an incorrect (and potentially broken) dependency resolution.
npm error
npm error
npm error For a full report see:
npm error /runner/cache/others/npm/_logs/2026-08-20T21_55_21_489Z-eresolve-report.txt
npm error A complete log of this run can be found in: /runner/cache/others/npm/_logs/2026-08-20T21_55_21_489Z-debug-0.log

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
adminv2	Ready	Preview	Aug 20, 2026 10:11pm