[Aikido] Fix 4 security issues in lodash, webpack

[aikido-autofix]

Upgrade lodash and webpack to fix critical RCE vulnerability in template compilation via options.imports injection, plus medium-severity prototype pollution in unset/omit functions and webpack magic comments.

✅ Code not affected by breaking changes.

✅ No breaking changes from either the lodash (4.17.21 => 4.18.1) or webpack (5.98.0 => 5.107.2) upgrades affect this codebase.

Lodash findings:

• No usage of _.unset() or _.omit() found in the codebase

• No usage of _.template() found in the codebase

• While lodash is present as a dependency (version 4.18.1 in package-lock.json), the actual source code does not directly import or use any of the affected lodash methods

Webpack findings:

• No usage of HttpUriPlugin or allowedUris configuration

• No usage of import.meta properties

• No usage of import defer or import.source syntax

• No CSS modules with css/module or css/auto types

• No ES modules exporting a binding named "module.exports" that would be affected by the CommonJS require changes

• While the codebase has export default statements for React components (e.g., in examples/with-serverless/src/pages/page-2.js), these are all named constants (like SecondPage, Layout, ClientOnlyRoutes) rather than anonymous functions or classes, so the .name property change does not affect them

• The one anonymous default export found (gatsby-plugin-s3-e2e-tests/src/cleanupLambda.ts) is unlikely to be impacted as it's a test utility and the .name property is not relied upon

All breaking changes are either not used in this codebase or do not apply to the patterns present in the code.

All breaking changes by upgrading lodash from version 4.17.21 to 4.18.1 (CHANGELOG)

Version	Description
4.18.0	_.unset / _.omit now block constructor and prototype as non-terminal path keys unconditionally. Calls that previously returned true and deleted the property now return false and leave the target untouched.
4.18.0	_.template now throws "Invalid imports option passed into _.template" when imports keys contain forbidden identifier characters, which were previously allowed.

All breaking changes by upgrading webpack from version 5.98.0 to 5.107.2 (CHANGELOG)

Version	Description
5.104.0	Re-validate HttpUriPlugin redirects against allowedUris, restrict to http(s) and add a conservative redirect limit to prevent SSRF and untrusted content inclusion. Redirects failing policy are rejected before caching/lockfile writes.
5.105.0	Unknown import.meta properties are now determined at runtime instead of being statically analyzed at compile time.
5.105.0	Fixed import.meta.env.xxx behavior: when accessing a non-existent property, it now returns empty object instead of full object at runtime.
5.106.0	Set .name to "default" for anonymous default export functions and classes per ES spec
5.107.0	Add module.generator.javascript.anonymousDefaultExportName option to control whether webpack sets .name to "default" for anonymous default export functions and classes per ES spec. Defaults to true for applications and false for libraries (when output.library is set) to avoid unnecessary bundle size overhead.
5.107.0	Add a pure parser option for css/module and css/auto types matching postcss-modules-local-by-default's pure mode: every selector must contain at least one local class or id, otherwise webpack emits a build error.
5.107.0	Make import defer * as ns more spec-compliant: ns.x = value no longer triggers module evaluation (per the TC39 import-defer [[Set]] algorithm), and the deferred namespace is now a distinct object from the eager namespace, with the same Deferred Module Namespace Exotic Object shared across defer-import call sites for the same module.
5.107.0	Reject new import.defer(...) and new import.source(...) as a parse-time SyntaxError, matching the spec — ImportCall is a CallExpression and is not a valid operand of new.
5.107.0	Align require() of an ES module with Node.js's require(esm) "module.exports" named-export convention. When CommonJS require() resolves to an ES module that exports a binding with the literal string name "module.exports", require() now returns the value of that export instead of the module's namespace object.

✅ 4 CVEs resolved by this upgrade, including 1 critical 🚨 CVE

This PR will resolve the following CVEs:

Issue	Severity	Description
CVE-2026-4800	🚨 CRITICAL	[lodash] A vulnerability in _.template allows arbitrary code execution through untrusted key names in options.imports or prototype pollution, as validation was incomplete after a prior CVE fix. An attacker can inject malicious code that executes during template compilation.
CVE-2025-13465	MEDIUM	[lodash] A prototype pollution vulnerability in _.unset and _.omit functions allows attackers to delete methods from global prototypes via crafted paths. While this prevents property overwriting, it can cause denial of service by removing critical functionality.
CVE-2026-2950	MEDIUM	[lodash] Prototype pollution vulnerability in _.unset and _.omit functions allows attackers to bypass previous fixes using array-wrapped path segments, enabling deletion of properties from built-in prototypes. While this doesn't allow overwriting prototype behavior, it can cause denial of service or unexpected application behavior.
AIKIDO-2026-318059	LOW	[webpack] Prototype pollution vulnerability in worker entry options magic comments allows attackers to pollute Object.prototype during build, potentially leading to corrupted plugin logic and unpredictable behavior.

🤖 Remediation details

Fix transitive security vulnerabilities in lodash, lodash.template, and webpack

This PR remediates security vulnerabilities in three transitive dependencies — lodash, lodash.template, and webpack — none of which appear as direct dependencies in examples/with-serverless/package.json. The fixes are applied via overrides entries added to examples/with-serverless/package.json (for lodash and webpack) and a lockfile-only refresh (for lodash.template), with all resolved versions updated in examples/with-serverless/package-lock.json.

lodash

lodash was resolved at 4.17.21 as a transitive dependency pulled in by multiple parents including gatsby, gatsby-cli, gatsby-plugin-offline, and others. The immediate parent gatsby@5.15.0 declares "lodash": "^4.17.21", a range that semver-allows 4.18.1, but npm update only advanced the lockfile to 4.17.23 (safe-chain suppressed newer versions during resolution). Because no parent bump could force the lockfile past that ceiling, a selector-pattern override "lodash@<4.18.1": "4.18.1" was added to examples/with-serverless/package.json to pin all vulnerable instances to the patched floor without globally forcing a version on unrelated consumers.

lodash.template

lodash.template is a standalone modular npm package (distinct from the monolithic lodash) and was resolved at 4.5.0 as a transitive dependency of workbox-build@4.3.1. workbox-build declares "lodash.template": "^4.4.0", a range that already permits 4.18.0+, so no override or parent bump was required — running npm update lodash.template --package-lock-only was sufficient to refresh the lockfile entry to 4.18.1.

webpack

webpack was resolved at 5.98.0, pulled in primarily by gatsby@5.15.0, which pins it with the tilde range "~5.98.0" (allowing only 5.98.x). No published version of gatsby resolves webpack to ≥5.107.2, making a parent bump impossible. A selector-pattern override "webpack@<5.107.2": "5.107.2" was added to examples/with-serverless/package.json to advance the resolved version to the patched release without affecting consumers that legitimately depend on other webpack major versions.

Version changes

Package	From	To	Why updated
lodash	4.17.21	4.18.1	Override ("lodash@<4.18.1": "4.18.1"); npm update stalled at 4.17.23 due to safe-chain suppression
lodash.template	4.5.0	4.18.1	Lockfile refresh only; parent workbox-build@4.3.1 range ^4.4.0 already permits patched version
webpack	5.98.0	5.107.2	Override ("webpack@<5.107.2": "5.107.2"); parent gatsby@5.15.0 tilde-pins ~5.98.0, blocking any parent-bump path

[github-actions]

Package lock diff

[aikido-autofix]

Closed by Aikido: a new AutoFix has been created → #97