From dbb83bc153d4481ba6ecd3ddf3db135fac184f2f Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Mon, 18 May 2026 12:55:11 +0000
Subject: [PATCH 1/2] Bump lodash in the external-miscellaneous group across 1
 directory

Bumps the external-miscellaneous group with 1 update in the / directory: [lodash](https://github.com/lodash/lodash).


Updates `lodash` from 4.17.23 to 4.18.1
- [Release notes](https://github.com/lodash/lodash/releases)
- [Commits](https://github.com/lodash/lodash/compare/4.17.23...4.18.1)

---
updated-dependencies:
- dependency-name: lodash
  dependency-version: 4.18.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: external-miscellaneous
...

Signed-off-by: dependabot[bot] <support@github.com>
---
 package-lock.json | 36 ++++++++++++++++++++++++++++++++----
 package.json      |  2 +-
 2 files changed, 33 insertions(+), 5 deletions(-)

diff --git a/package-lock.json b/package-lock.json
index c38fbe1426fa3..c043f24fa34c5 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -26,7 +26,7 @@
 				"jquery-form": "4.3.0",
 				"jquery-hoverintent": "1.10.2",
 				"jsonlint": "1.6.3",
-				"lodash": "4.17.23",
+				"lodash": "4.18.1",
 				"masonry-layout": "4.2.2",
 				"moment": "2.30.1",
 				"objectFitPolyfill": "2.3.5",
@@ -17290,6 +17290,13 @@
 				"node": ">=8"
 			}
 		},
+		"node_modules/grunt-legacy-log-utils/node_modules/lodash": {
+			"version": "4.17.23",
+			"resolved": "https://registry.npmjs.org/lodash/-/lodash-4.17.23.tgz",
+			"integrity": "sha512-LgVTMpQtIopCi79SJeDiP0TfWi5CNEc/L/aRdTh3yIvmZXTnheWpKjSZhnvMl8iXbC1tFg9gdHHDMLoV7CnG+w==",
+			"dev": true,
+			"license": "MIT"
+		},
 		"node_modules/grunt-legacy-log-utils/node_modules/supports-color": {
 			"version": "7.2.0",
 			"resolved": "https://registry.npmjs.org/supports-color/-/supports-color-7.2.0.tgz",
@@ -17302,6 +17309,13 @@
 				"node": ">=8"
 			}
 		},
+		"node_modules/grunt-legacy-log/node_modules/lodash": {
+			"version": "4.17.23",
+			"resolved": "https://registry.npmjs.org/lodash/-/lodash-4.17.23.tgz",
+			"integrity": "sha512-LgVTMpQtIopCi79SJeDiP0TfWi5CNEc/L/aRdTh3yIvmZXTnheWpKjSZhnvMl8iXbC1tFg9gdHHDMLoV7CnG+w==",
+			"dev": true,
+			"license": "MIT"
+		},
 		"node_modules/grunt-legacy-util": {
 			"version": "2.0.1",
 			"resolved": "https://registry.npmjs.org/grunt-legacy-util/-/grunt-legacy-util-2.0.1.tgz",
@@ -17327,6 +17341,13 @@
 			"dev": true,
 			"license": "MIT"
 		},
+		"node_modules/grunt-legacy-util/node_modules/lodash": {
+			"version": "4.17.23",
+			"resolved": "https://registry.npmjs.org/lodash/-/lodash-4.17.23.tgz",
+			"integrity": "sha512-LgVTMpQtIopCi79SJeDiP0TfWi5CNEc/L/aRdTh3yIvmZXTnheWpKjSZhnvMl8iXbC1tFg9gdHHDMLoV7CnG+w==",
+			"dev": true,
+			"license": "MIT"
+		},
 		"node_modules/grunt-patch-wordpress": {
 			"version": "4.0.0",
 			"resolved": "https://registry.npmjs.org/grunt-patch-wordpress/-/grunt-patch-wordpress-4.0.0.tgz",
@@ -22575,6 +22596,13 @@
 				"date-now": "^0.1.4"
 			}
 		},
+		"node_modules/jshint/node_modules/lodash": {
+			"version": "4.17.23",
+			"resolved": "https://registry.npmjs.org/lodash/-/lodash-4.17.23.tgz",
+			"integrity": "sha512-LgVTMpQtIopCi79SJeDiP0TfWi5CNEc/L/aRdTh3yIvmZXTnheWpKjSZhnvMl8iXbC1tFg9gdHHDMLoV7CnG+w==",
+			"dev": true,
+			"license": "MIT"
+		},
 		"node_modules/jshint/node_modules/minimatch": {
 			"version": "3.0.8",
 			"resolved": "https://registry.npmjs.org/minimatch/-/minimatch-3.0.8.tgz",
@@ -23264,9 +23292,9 @@
 			}
 		},
 		"node_modules/lodash": {
-			"version": "4.17.23",
-			"resolved": "https://registry.npmjs.org/lodash/-/lodash-4.17.23.tgz",
-			"integrity": "sha512-LgVTMpQtIopCi79SJeDiP0TfWi5CNEc/L/aRdTh3yIvmZXTnheWpKjSZhnvMl8iXbC1tFg9gdHHDMLoV7CnG+w==",
+			"version": "4.18.1",
+			"resolved": "https://registry.npmjs.org/lodash/-/lodash-4.18.1.tgz",
+			"integrity": "sha512-dMInicTPVE8d1e5otfwmmjlxkZoUpiVLwyeTdUsi/Caj/gfzzblBcCE5sRHV/AsjuCmxWrte2TNGSYuCeCq+0Q==",
 			"license": "MIT"
 		},
 		"node_modules/lodash-es": {
diff --git a/package.json b/package.json
index 724335a2c4ee8..73f02969a0509 100644
--- a/package.json
+++ b/package.json
@@ -99,7 +99,7 @@
 		"jquery-form": "4.3.0",
 		"jquery-hoverintent": "1.10.2",
 		"jsonlint": "1.6.3",
-		"lodash": "4.17.23",
+		"lodash": "4.18.1",
 		"masonry-layout": "4.2.2",
 		"moment": "2.30.1",
 		"objectFitPolyfill": "2.3.5",

From fd858c4dd0c193dea9bafdcfea45914f107c0d36 Mon Sep 17 00:00:00 2001
From: Jonathan Desrosiers <359867+desrosj@users.noreply.github.com>
Date: Mon, 18 May 2026 11:53:06 -0400
Subject: [PATCH 2/2] Bump the version of `lodash` in the script loader.

---
 src/wp-includes/script-loader.php | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/wp-includes/script-loader.php b/src/wp-includes/script-loader.php
index f4fad38f3eefe..134d86c26a08a 100644
--- a/src/wp-includes/script-loader.php
+++ b/src/wp-includes/script-loader.php
@@ -111,7 +111,7 @@ function wp_default_packages_vendor( $scripts ) {
 		'react-jsx-runtime'           => '18.3.1',
 		'regenerator-runtime'         => '0.14.1',
 		'moment'                      => '2.30.1',
-		'lodash'                      => '4.17.23',
+		'lodash'                      => '4.18.1',
 		'wp-polyfill-fetch'           => '3.6.20',
 		'wp-polyfill-formdata'        => '4.0.10',
 		'wp-polyfill-node-contains'   => '4.8.0',