[Snyk] Security upgrade lodash from 4.17.15 to 4.18.1

[lmaeda]

Snyk has created this PR to fix 2 vulnerabilities in the npm dependencies of this project.

Snyk changed the following file(s):

• package.json

Vulnerabilities that will be fixed with an upgrade:

	Issue	Score
	Arbitrary Code Injection SNYK-JS-LODASH-15869625	183
	Prototype Pollution SNYK-JS-LODASH-15869619	88

Breaking Change Risk

Notice: This assessment is enhanced by AI.

---

Important

• Check the changes in this PR to ensure they won't cause issues with your project.
• Max score is 1000. Note that the real score may have changed since the PR was raised.
• This PR was automatically created by Snyk using the credentials of a real user.

---

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report
📜 Customise PR templates
🛠 Adjust project settings
📚 Read about Snyk's upgrade logic

---

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Prototype Pollution
🦉 Arbitrary Code Injection

[lmaeda]

This minor version upgrade for lodash includes several security patches and bug fixes. While it is not a major version change, it introduces a behavioral modification that warrants a medium risk assessment.

Key Changes:

• Behavioral Change in _.unset / _.omit: Version 4.18.0 fixes a prototype pollution vulnerability. As a result, attempts to use these functions to modify constructor or prototype properties will now be blocked. Calls that previously might have returned true and deleted a property will now return false and not modify the object. [1, 4] This is a security improvement, but it changes behavior that some applications might inadvertently rely on.
• Security Fix in _.template: A code injection vulnerability was patched in _.template. [1, 4]
• Other Fixes: The versions between 4.17.15 and 4.18.1 include various other bug fixes and performance improvements.

Recommendation:
While most applications are unlikely to be affected, it is important to verify that your code does not rely on the previous, insecure behavior of _.unset or _.omit when interacting with object prototypes.

Source: GitHub Release Notes

Notice 🤖: This content was augmented using artificial intelligence. AI-generated content may contain errors and should be reviewed for accuracy before use.