fix(dev-1709): bump lodash to 4.18.0

[spur-vuln-author]

Context

Batched group (ticket_group_key tg:lodash:pnpm-lock.yaml, 3 advisories) against lodash, all in pnpm-lock.yaml:

• GHSA-f23m-r3pf-42rh — lodash < 4.18.0 (medium)
• GHSA-r5fr-rjxr-66jc — lodash < 4.18.0 (high)
• GHSA-xxjr-mmjv-4gpg — lodash < 4.17.23 (medium)

Transitive dependency (not declared in any package.json), resolved via pnpm-lock.yaml. No Dependabot PR exists for any of these, so this PR was constructed directly from the highest first_patched_version across the group (4.18.0).

Test evidence

No Dependabot PR existed; constructed from first_patched_version 4.18.0 (highest across the batch). Added a pnpm.overrides entry and regenerated the lockfile with pnpm install --lockfile-only. Confirmed via lockfile inspection that lodash now resolves to 4.18.1 (previously 4.17.21), satisfying >= 4.18.0 for all three advisories. Companion-file scan (Dockerfiles, .nvmrc, go.mod, CI workflow YAML, etc. hardcoding 4.17.21) found no hits.

Risk

Low. Lockfile-only transitive dependency bump within the same major version line, resolves all 3 batched advisories at once. Group max severity high; Tier 1 / 90-day SLA.

---

[spur-vuln-reviewer]

Escalating: Gate 3 (diff equivalence) mechanically FAILed. gate3-check.sh: GATE3 FAIL target=lodash manifest=pnpm-lock.yaml pr_version=? required=4.18.0 alerts=25,52,53 extra_files=1 state=open. Detail: the helper has no extraction rule for ecosystem=npm manifest basename=pnpm-lock.yaml, so it could not extract the new lodash version from the diff, and flagged package.json as a file outside {manifest, lockfile} (which is actually the expected direct-dependency file for an npm/pnpm version bump). This looks like a tooling gap in gate3-check.sh (no pnpm-lock.yaml parser) rather than a real diff deviation, but per the review contract a mechanical Gate 3 FAIL is never re-derived or second-guessed by the reviewer. Required version per max open Dependabot alert(s) 25,52,53: 4.18.0. Not merged. A human must review this. This reviewer will not act on this PR again. [[spur-vuln-reviewer: escalated diff-mismatch-constructed]]

[spur-vuln-author]

spur-vuln-remediate: this branch (lodash bump) has a real merge conflict against current main, confirmed via gh pr update-branch --rebase (Cannot update PR branch due to conflicts) - pnpm-lock.yaml has drifted since this branch was cut, likely from the tinypool/vite/turbo/vitest merges that landed afterward. This sandbox's permission system does not allow the author identity to force-push, merge, or delete/recreate its own branch, so the conflict cannot be resolved from this pass. Needs a human (or a future pass with broader git permissions) to rebase or recreate this branch.

[spur-vuln-author]

spur-vuln-escalation: failed on 2 consecutive passes. Still DIRTY (real merge conflict against current main) after a fresh gh pr update-branch --rebase attempt this pass. A human-authored consolidated PR #73 already bumps lodash to 4.18.1 (above this group's 4.18.0 target). Needs a human - tracked in DEV-1709.