[Aikido] Fix security issue in lodash via minor version upgrade from 4.17.21 to 4.18.1 in examples

[aikido-autofix]

Upgrade lodash to fix critical remote code execution vulnerability in _.template via options.imports injection and medium-severity prototype pollution bypasses in _.unset and _.omit functions.

✅ Code not affected by breaking changes.

✅ No breaking changes affect this codebase. The codebase does not use _.unset, _.omit, or _.template methods from lodash. While lodash is listed as a dependency in package files, searches across all JavaScript/TypeScript source files found no imports or usage of the affected methods.

All breaking changes by upgrading lodash from version 4.17.21 to 4.18.1 (CHANGELOG)

Version	Description
4.18.0	_.unset / _.omit now block constructor and prototype as non-terminal path keys unconditionally. Calls that previously returned true and deleted the property now return false and leave the target untouched.
4.18.0	_.template now throws "Invalid imports option passed into _.template" when imports keys contain forbidden identifier characters, which were previously allowed.

✅ 3 CVEs resolved by this upgrade, including 1 critical 🚨 CVE

This PR will resolve the following CVEs:

Issue	Severity	Description
CVE-2026-4800	🚨 CRITICAL	[lodash] A vulnerability in _.template allows arbitrary code execution through untrusted key names in options.imports or prototype pollution, as validation was incomplete after a prior CVE fix. An attacker can inject malicious code that executes during template compilation.
CVE-2025-13465	MEDIUM	[lodash] A prototype pollution vulnerability in _.unset and _.omit functions allows attackers to delete methods from global prototypes via crafted paths. While this prevents property overwriting, it can cause denial of service by removing critical functionality.
CVE-2026-2950	MEDIUM	[lodash] Prototype pollution vulnerability in _.unset and _.omit functions allows attackers to bypass previous fixes using array-wrapped path segments, enabling deletion of properties from built-in prototypes. While this doesn't allow overwriting prototype behavior, it can cause denial of service or unexpected application behavior.

🤖 Remediation details

Fix CVE-2026-4800, CVE-2025-13465, and CVE-2026-2950 in lodash and lodash.template (examples/with-serverless)

Short summary

This PR remediates three CVEs affecting two distinct packages — lodash and lodash.template — in the examples/with-serverless project. Both packages were transitive dependencies whose lockfile-resolved versions were below the patched thresholds. Selector-pattern overrides were added to examples/with-serverless/package.json and the lockfile (examples/with-serverless/package-lock.json) was refreshed via npm install --package-lock-only.

lodash

lodash was resolved to 4.17.21 in the lockfile, pulled in transitively by twelve packages (including gatsby, gatsby-cli, gatsby-plugin-offline, inquirer, and others), all declaring it as ^4.17.21. That range permits 4.18.1, but npm update lodash --package-lock-only left the lockfile unchanged — safe-chain suppressed the newer releases during resolution. Because no direct dependency declared lodash and a bare global override was undesirable, a selector override "lodash@<4.18.1": "4.18.1" was added to package.json to target only sub-patched instances, bringing all twelve dependents to 4.18.1.

lodash.template

lodash.template is a separate standalone npm package (not part of the lodash monolith) and was resolved to 4.5.0, pulled in by workbox-build@4.3.1 (itself a dependency of gatsby-plugin-offline@6.15.0) via the declared range ^4.4.0. That range already permits 4.18.0, but safe-chain again prevented npm update from advancing the resolution. A selector override "lodash.template@<4.18.0": "4.18.0" was added alongside the lodash override, and the lockfile was refreshed to resolve lodash.template to 4.18.0.

Version changes

Package	From	To	Why updated
lodash	4.17.21	4.18.1	Override — transitive CVE fix; safe-chain blocked npm update
lodash.template	4.5.0	4.18.0	Override — transitive CVE fix; safe-chain blocked npm update

[github-actions]

Package lock diff