chore(deps): bump lodash and @microsoft/api-extractor

[dependabot]

Bumps lodash to 4.18.1 and updates ancestor dependency @microsoft/api-extractor. These dependencies need to be updated together.

Updates lodash from 4.17.23 to 4.18.1

Release notes

Sourced from lodash's releases.

4.18.1

Bugs

Fixes a ReferenceError issue in lodash lodash-es lodash-amd and lodash.template when using the template and fromPairs functions from the modular builds. See lodash/lodash#6167

These defects were related to how lodash distributions are built from the main branch using https://github.com/lodash-archive/lodash-cli. When internal dependencies change inside lodash functions, equivalent updates need to be made to a mapping in the lodash-cli. (hey, it was ahead of its time once upon a time!). We know this, but we missed it in the last release. It's the kind of thing that passes in CI, but fails bc the build is not the same thing you tested.

There is no diff on main for this, but you can see the diffs for each of the npm packages on their respective branches:

• lodash: lodash/lodash@4.18.0-npm...4.18.1-npm
• lodash-es: lodash/lodash@4.18.0-es...4.18.1-es
• lodash-amd: lodash/lodash@4.18.0-amd...4.18.1-amd
• lodash.templatelodash/lodash@4.18.0-npm-packages...4.18.1-npm-packages

4.18.0

v4.18.0

Full Changelog: lodash/lodash@4.17.23...4.18.0

Security

_.unset / _.omit: Fixed prototype pollution via constructor/prototype path traversal (GHSA-f23m-r3pf-42rh, fe8d32e). Previously, array-wrapped path segments and primitive roots could bypass the existing guards, allowing deletion of properties from built-in prototypes. Now constructor and prototype are blocked unconditionally as non-terminal path keys, matching baseSet. Calls that previously returned true and deleted the property now return false and leave the target untouched.

_.template: Fixed code injection via imports keys (GHSA-r5fr-rjxr-66jc, CVE-2026-4800, 879aaa9). Fixes an incomplete patch for CVE-2021-23337. The variable option was validated against reForbiddenIdentifierChars but importsKeys was left unguarded, allowing code injection via the same Function() constructor sink. imports keys containing forbidden identifier characters now throw "Invalid imports option passed into _.template".

Docs

• Add security notice for _.template in threat model and API docs (#6099)
• Document lower > upper behavior in _.random (#6115)
• Fix quotes in _.compact jsdoc (#6090)

lodash.* modular packages

Diff

We have also regenerated and published a select number of the lodash.* modular packages.

These modular packages had fallen out of sync significantly from the minor/patch updates to lodash. Specifically, we have brought the following packages up to parity w/ the latest lodash release because they have had CVEs on them in the past:

• lodash.orderby
• lodash.tonumber
• lodash.trim
• lodash.trimend
• lodash.sortedindexby
• lodash.zipobjectdeep
• lodash.unset
• lodash.omit
• lodash.template

Commits

• cb0b9b9 release(patch): bump main to 4.18.1 (#6177)
• 75535f5 chore: prune stale advisory refs (#6170)
• 62e91bc docs: remove n_ Node.js < 6 REPL note from README (#6165)
• 59be2de release(minor): bump to 4.18.0 (#6161)
• af63457 fix: broken tests for _.template 879aaa9
• 1073a76 fix: linting issues
• 879aaa9 fix: validate imports keys in _.template
• fe8d32e fix: block prototype pollution in baseUnset via constructor/prototype traversal
• 18ba0a3 refactor(fromPairs): use baseAssignValue for consistent assignment (#6153)
• b819080 ci: add dist sync validation workflow (#6137)
• Additional commits viewable in compare view

Updates @microsoft/api-extractor from 7.57.6 to 7.59.0

Changelog

Sourced from @​microsoft/api-extractor's changelog.

7.59.0

Fri, 21 Aug 2026 15:16:34 GMT

Minor changes

• Report a new ae-unresolved-import-path message when an inline import() type with a relative path cannot be resolved, instead of silently emitting the unusable path into the .d.ts rollup.

7.58.13

Thu, 20 Aug 2026 00:16:38 GMT

Version update only

7.58.12

Tue, 21 Jul 2026 02:53:22 GMT

Patches

• Improve the performance of the internal excerpt token condensing algorithm from O(n^2) to O(n) by eliminating repeated array splicing and per-merge bookkeeping.

7.58.11

Fri, 17 Jul 2026 00:15:59 GMT

Version update only

7.58.10

Thu, 16 Jul 2026 00:16:13 GMT

Version update only

7.58.9

Sat, 13 Jun 2026 00:16:18 GMT

Version update only

7.58.8

Mon, 08 Jun 2026 15:15:49 GMT

Patches

• Add support for new d.ts extension format when using TS moduleResolution 'bundler' or 'nodenext'.

7.58.7

Mon, 20 Apr 2026 23:31:13 GMT

Version update only

7.58.6

Mon, 20 Apr 2026 15:15:24 GMT

Patches

... (truncated)

Commits

• d563d6a Bump versions [skip ci]
• c0344cb Update changelogs [skip ci]
• 8f57395 [api-extractor] Report unresolvable inline import paths in .d.ts rollups (#5925)
• b51d7f4 Bump versions [skip ci]
• 585985a Update changelogs [skip ci]
• a2507e8 Use native Node.js standard APIs (#5933)
• c65388a build!: require Node.js 20 for consumers (#5930)
• 8d872db chore: bump decoupled local dependencies (#5890)
• f1c7396 Bump versions [skip ci]
• 75089a6 Update changelogs [skip ci]
• Additional commits viewable in compare view

[johnmtll]

@dependabot recreate