Upgrade lodash and lodash-es to version 4.x due to 3rd-party vulnerabilities CVE-2026-4800 and CVE-2026-2950

Impact

• lodash
  • lodash is a transitive dependency used internally by Angular tooling (webpack, ng-zorro-antd etc.) and not directly in application code. * The vulnerabilities relate to prototype pollution and unsafe template evaluation.
  • The JS7 codebase does not use _.template() or unsafe dynamic patterns. Risk is theoretical in this context.
• lodash-es
  • Impact is the same as lodash. Used indirectly via UI libraries. No direct usage. No exploit path in the JS7 implementation

Maintainer Note

Resolution of the issue for release 2.5.3 is dismissed as no updated version of lodash is available that fixes the issue.