chore(deps): update lodash to 4.18.1

[kilo-code-bot]

Summary

• Bumps the lodash pnpm override from >=4.17.23 to >=4.18.1, pulling in the latest upstream release across the monorepo.
• lodash is not a direct dependency of any workspace package; it is only present transitively (archiver, discord.js shapeshift, html-webpack-plugin, stream-chat-expo, etc.). The override exists to force security patches into those transitives. The lockfile now resolves a single lodash@4.18.1 for everyone.

Why the 4.18.x changes don't impact us

lodash 4.18.0 is security-only and contains two behavioral changes (release notes):

1. _.unset / _.omit prototype pollution hardening (GHSA-f23m-r3pf-42rh). Array-wrapped path segments and primitive roots targeting constructor/prototype now fail instead of deleting. A repo-wide search shows no first-party code imports lodash, so none of our code calls _.unset or _.omit. The transitive consumers (archiver/zip-stream, discord.js builders, webpack's html-plugin, stream-chat's react-native markdown) use lodash for array/object helpers, not prototype path manipulation, so the tightened guard does not affect them.
2. _.template imports-key validation (fix for CVE-2026-4800). imports keys containing forbidden identifier characters now throw. We do not use _.template directly. The only transitive user is webpack's html-webpack-plugin, which calls _.template with its own fixed import map of valid identifiers — the new validation does not reject anything it was previously accepting.

4.18.1 is a pure build-fix release (restoring template/fromPairs in the modular builds) with no behavior change from 4.18.0.

Net effect: transitive consumers get the latest security patches; no workspace code paths change.

Verification

• pnpm install --lockfile-only resolves lodash@4.18.1 as the single version in pnpm-lock.yaml.
• Repo-wide search for from 'lodash' / require('lodash') returns zero first-party hits, confirming no call sites are affected.

Visual Changes

N/A

Reviewer Notes

• Only package.json (pnpm override) and pnpm-lock.yaml change.
• pnpm format was not run locally because oxfmt is not installed in this environment; the touched files (JSON/lockfile) are not subject to oxfmt output changes. Full pnpm typecheck was skipped per the repo guidance on slow full-monorepo checks — the dependency change is transitive-only and has no TS surface.

[kilo-code-bot]

Code Review Summary

Status: No Issues Found | Recommendation: Merge

Files Reviewed (2 files)

• package.json
• pnpm-lock.yaml

---

_{Reviewed by gpt-5.5-20260423 · 187,800 tokens}