Bump lodash 4.18.0 to address CVEs

Author: cmalonzo

apps/api-extractor/package.json

@@ -70,7 +70,7 @@
     "@rushstack/terminal": "workspace:*",
     "@rushstack/ts-command-line": "workspace:*",
     "diff": "~8.0.2",
-    "lodash": "~4.17.23",
+    "lodash": "~4.18.0",
     "minimatch": "10.2.3",
     "resolve": "~1.22.1",
     "semver": "~7.5.4",

build-tests/api-extractor-test-05/dist/tsdoc-metadata.json

@@ -5,7 +5,7 @@
   "toolPackages": [
     {
       "packageName": "@microsoft/api-extractor",
-      "packageVersion": "7.57.7"
+      "packageVersion": "7.58.0"
     }
   ]
 }

build-tests/localization-plugin-test-02/package.json

@@ -19,7 +19,7 @@
     "@types/webpack-env": "1.18.8",
     "eslint": "~9.37.0",
     "html-webpack-plugin": "~4.5.2",
-    "lodash": "~4.17.23",
+    "lodash": "~4.18.0",
     "local-node-rig": "workspace:*",
     "webpack": "~4.47.0",
     "webpack-bundle-analyzer": "~4.5.0",

common/changes/@microsoft/api-extractor/lodash-4.18.0_2026-04-02-17-03.json

@@ -0,0 +1,10 @@
+{
+  "changes": [
+    {
+      "packageName": "@microsoft/api-extractor",
+      "comment": "Bump lodash 4.18.0 to address CVEs",
+      "type": "patch"
+    }
+  ],
+  "packageName": "@microsoft/api-extractor"
+}

common/changes/@rushstack/heft-jest-plugin/lodash-4.18.0_2026-04-02-17-03.json

@@ -0,0 +1,10 @@
+{
+  "changes": [
+    {
+      "packageName": "@rushstack/heft-jest-plugin",
+      "comment": "Bump lodash 4.18.0 to address CVEs",
+      "type": "patch"
+    }
+  ],
+  "packageName": "@rushstack/heft-jest-plugin"
+}

common/changes/@rushstack/npm-check-fork/lodash-4.18.0_2026-04-02-17-03.json

@@ -0,0 +1,10 @@
+{
+  "changes": [
+    {
+      "packageName": "@rushstack/npm-check-fork",
+      "comment": "Bump lodash 4.18.0 to address CVEs",
+      "type": "patch"
+    }
+  ],
+  "packageName": "@rushstack/npm-check-fork"
+}

common/config/subspaces/build-tests-subspace/pnpm-lock.yaml

@@ -1,6 +1,6 @@
 // DO NOT MODIFY THIS FILE MANUALLY BUT DO COMMIT IT. It is generated and used by Rush.
 {
-  "pnpmShrinkwrapHash": "b521001fa31a13e992f9979b1292951aa6452daa",
+  "pnpmShrinkwrapHash": "d4abb24eaa137378d1ee1c6f708226c9e1e71fcb",
   "preferredVersionsHash": "550b4cee0bef4e97db6c6aad726df5149d20e7d9",
-  "packageJsonInjectedDependenciesHash": "a9488da9faaa4bc0166edfe82f2177d7a68e4cb1"
+  "packageJsonInjectedDependenciesHash": "05e38c78d045b0001f626c8e7e9cb1cec46f9f28"
 }