fix: [lodash] Upgrade lodash from 4.17.4 to 4.18.1 to resolve CVE-2026-4800 (Arbitrary Code Injection)

[devin-ai-integration]

Summary

Resolves a High (CVSS 8.6) Snyk SCA finding in the direct dependency lodash, and clears the long tail of lodash@4.17.4 prototype-pollution / code-injection findings on the direct path.

• Vulnerability: Arbitrary Code Injection
• CVE: CVE-2026-4800 · Snyk ID: SNYK-JS-LODASH-15869625
• Severity: High (CVSS 8.6)
• Package: lodash@4.17.4 (direct dependency)
• Fixed in: 4.18.1 (Snyk-recommended; latest dist-tag, published 2026-04-01)

Upgrading the direct lodash also remediates the earlier high-severity findings reachable on this path: CVE-2019-10744, CVE-2020-8203, CVE-2021-23337, CVE-2018-16487, and related prototype-pollution advisories.

Change

- "lodash": "4.17.4"
+ "lodash": "^4.18.1"   // stays within major 4 (no breaking change)

package-lock.json updated accordingly (lockfile version preserved at 2); the bump also dedupes several nested lodash copies.

Verification

snyk test after the bump reports 0 direct-path lodash vulnerabilities. (Separate transitive lodash@4.17.x copies pulled by other packages remain as distinct findings and are out of scope for this PR.)

Reference: https://security.snyk.io/vuln/SNYK-JS-LODASH-15869625

Generated by the scheduled Snyk MCP security scan (Snyk org 9e26acce…).

Link to Devin session: https://app.devin.ai/sessions/8d13ec8d010540e3b119dc5073862335
Requested by: @hannahhuh-cog

---

Devin Review

Status	Commit
⚪ Not started	—

Run Devin Review

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment, CI, and merge conflict monitoring