Resolve CVE-2026-4800 by bumping lodash and lodash-es to ^4.18.0

Details:
The fix for CVE-2021-23337 added validation for the variable option in
_.template but did not apply the same validation to options.imports key
names. Both paths flow into the same Function() constructor sink. When
an application passes untrusted input as options.imports key names, an
attacker can inject default-parameter expressions that execute arbitrary
code at template compilation time. Additionally, _.template uses
assignInWith to merge imports, which enumerates inherited properties
via for..in. If Object.prototype has been polluted by any other vector,
the polluted keys are copied into the imports object and passed to
Function().

Impact:
When an application passes untrusted input as options.imports key names
to _.template, an attacker can inject default-parameter expressions
that execute arbitrary code at template compilation time. Additionally,
prototype pollution can be exploited via assignInWith to inject keys
into the Function() constructor.

Fix:
Bumped lodash and lodash-es resolutions to ^4.18.0 in package.json.
Version 4.18.0 validates importsKeys against reForbiddenIdentifierChars
and replaces assignInWith with assignWith when merging imports.

Signed-off-by: KashKondaka <37753523+KashKondaka@users.noreply.github.com>

Author: KashKondaka

package.json

@@ -37,7 +37,7 @@
     "kind-of": "^6.0.3",
     "glob-parent": "^5.1.2",
     "ssri": "^6.0.2",
-    "lodash": "^4.17.21",
+    "lodash": "^4.18.0",
     "hosted-git-info": "^2.8.9",
     "json-schema": "^0.4.0",
     "ansi-regex": "^5.0.1",
@@ -51,7 +51,8 @@
     "@babel/traverse": "^7.20.12",
     "word-wrap": "^1.2.4",
     "@cypress/request": "^3.0.0",
-    "vis-data": "7.1.6"
+    "vis-data": "7.1.6",
+    "lodash-es": "^4.18.0"
   },
   "devDependencies": {
     "@babel/plugin-transform-class-properties": "^7.22.9",