## Summary
- Bumps `lodash` from `^4.17.21` to `^4.18.1` in `frontend`,
`libs/react-client`, and `libs/copilot` (plus lockfiles).
- Fixes
[GHSA-f23m-r3pf-42rh](https://github.com/lodash/lodash/security/advisories/GHSA-f23m-r3pf-42rh)
/ CVE-2026-2950 (prototype pollution via `_.unset` / `_.omit`).
- Why not 4.17.23: that version is still vulnerable to the array-path
bypass. The patched line is `>=4.18.0`; latest is `4.18.1`.
## Blast radius
- Packages: main UI (`frontend`), published `@chainlit/react-client`,
and copilot (declares/aliases lodash; no direct source imports).
- Only security-sensitive call site: `omit(props, ['node'])` in
`Markdown.tsx` (static key).
- Other usage is unchanged APIs: `isEqual`, `debounce`, `cloneDeep`,
`mapValues`, `every`, `size`, `capitalize`, `uniqBy`, `groupBy`.
- No `unset` / `template` usage. 4.18.x only hardens pollution paths and
`_.template` imports — safe for our call sites.
## Test plan
- [x] Frontend unit tests (32/32)
- [x] react-client type-check
Co-authored-by: Cursor Grok 4.5 <noreply@cursor.com>
Co-authored-by: Cursor <cursoragent@cursor.com>
EyalAmitay
f5f3fa8664