chore(deps): bump lodash to 4.18.1

[styfle]

Supersedes #214, taking only the lodash half of the grouped update.

Why #214's CI fails

#214 bumps two lockfile-only deps: webpack 5.76.0 → 5.104.1 and lodash 4.17.21 → 4.18.1 (both resolve within existing package.json ranges; webpack is a devDependency, lodash is transitive).

The test suite compares the entire webpack-generated bundle byte-for-byte against checked-in fixtures (test/unit/*/output.js, plus expected chunk filenames in test/project-chunking). webpack 5.104 changes codegen — method-shorthand module rendering in __webpack_modules__, different module ids, changed IIFE wrapping — so 71 of 85 tests fail on every OS, e.g.:

-/***/ 147:
-/***/ ((module) => {
+/***/ 896
+(module) {

The loader itself still relocates assets correctly under webpack 5.104; the mismatches are formatting/ids. But accepting the bump would mean regenerating ~71 fixtures twice (output.js + output-coverage.js) plus the project-chunking expectations — a huge, hard-to-review diff.

This PR (path of least change)

• ✅ lodash 4.17.21 → 4.18.1 — same 3-line lockfile entry as in chore: bump the npm_and_yarn group across 1 directory with 2 updates #214. Resolves the security advisories that triggered the group (GHSA-f23m-r3pf-42rh _.unset/_.omit prototype pollution, GHSA-r5fr-rjxr-66jc / CVE-2026-4800 _.template code injection). lodash is dev-tooling-only here and appears in no fixture output.
• ❌ webpack stays at 5.76.0 — bumping it requires regenerating every fixture, which deserves its own deliberate PR. Exposure is limited: webpack is a devDependency (build/test-time only).

Verification

yarn test and yarn test-coverage both pass 85/85 locally on Node 22 with webpack 5.76.0 + lodash 4.18.1 (reproduced #214's 71 failures locally first, then confirmed green after dropping the webpack bump).

🤖 Generated with Claude Code

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	npm/​lodash@​4.17.21 ⏵ 4.18.1	+1	+19	+1

View full report

[github-actions]

🎉 This PR is included in version 1.10.2 🎉

The release is available on:

• npm package (@latest dist-tag)
• GitHub release

Your semantic-release bot 📦🚀