[Security]: lodash-es 4.17.x in pnpm-lock.yaml is affected by prototype pollution advisories (fixed in 4.18.1)

Summary: pnpm-lock.yaml resolves two lodash-es releases (4.17.21 and 4.17.23), both in the range covered by the prototype pollution advisories affecting the 4.17.x line. Every importer resolving through the lockfile gets the vulnerable releases.

Area: Dependencies (Web UI)

Reproduction or evidence: `pnpm-lock.yaml` contains `lodash-es@4.17.21` and `lodash-es@4.17.23` (pulled in via chevrotain and the mermaid/dagre-d3-es subtree); `pnpm audit` flags lodash-es < 4.18.1 for prototype pollution. The override pins 4.18.1 and the regenerated lock converges both releases onto the patched single version.

Environment: BitFun version/commit 32f2427697ee16f253ee6119860a03255c0b3e47 (origin/main), pnpm 10.15.0.

Comienza con pnpm-lock.yaml e inspecciona las entradas de lodash-es resueltas a través de chevrotain y del subárbol mermaid/dagre-d3-es. Ejecuta pnpm audit para confirmar el aviso y, después, vuelve a generar el archivo de bloqueo con la versión 4.18.1 fijada. La tarea está terminada cuando ambas versiones vulnerables hayan desaparecido, se resuelva una versión parcheada y la auditoría ya no marque lodash-es.

Escrito por el modelo de indexación a partir del texto del issue.