[Security]: lodash-es 4.17.x in pnpm-lock.yaml is affected by prototype pollution advisories (fixed in 4.18.1)

Summary: pnpm-lock.yaml resolves two lodash-es releases (4.17.21 and 4.17.23), both in the range covered by the prototype pollution advisories affecting the 4.17.x line. Every importer resolving through the lockfile gets the vulnerable releases.

Area: Dependencies (Web UI)

Reproduction or evidence: `pnpm-lock.yaml` contains `lodash-es@4.17.21` and `lodash-es@4.17.23` (pulled in via chevrotain and the mermaid/dagre-d3-es subtree); `pnpm audit` flags lodash-es < 4.18.1 for prototype pollution. The override pins 4.18.1 and the regenerated lock converges both releases onto the patched single version.

Environment: BitFun version/commit 32f2427697ee16f253ee6119860a03255c0b3e47 (origin/main), pnpm 10.15.0.

Start with pnpm-lock.yaml and inspect the lodash-es entries resolved through chevrotain and the mermaid/dagre-d3-es subtree. Run pnpm audit to confirm the advisory, then regenerate the lockfile with the pinned 4.18.1 release. Done means both vulnerable releases are gone, one patched version is resolved, and the audit no longer flags lodash-es.

Written by the indexing model from the issue text.