chore(security): patch 4 Dependabot alerts

[PMerlet]

Summary

4 fixed, 0 ignored, 0 deferred, 0 resolutions added, 2 resolutions removed.

All four open Dependabot alerts were on lodash / lodash-es at 4.17.23; the fix is a single bump of the existing root-level resolutions to ^4.18.0 (which now resolves to 4.18.1 in yarn.lock). No alerts were deferred (all are 12+ days old, past the 7-day gate) and none qualified for any of the IGNORE reasons.

Fixed

#	Package	Ecosystem	From → To	Severity	What was bumped
65	lodash-es	npm	4.17.23 → 4.18.1	high	Existing root resolutions["lodash-es"] bumped from ^4.17.23 to ^4.18.0
66	lodash-es	npm	4.17.23 → 4.18.1	medium	Same bump as #65 (same pinned chain)
67	lodash	npm	4.17.23 → 4.18.1	high	Existing root resolutions["lodash"] bumped from ^4.17.23 to ^4.18.0
68	lodash	npm	4.17.23 → 4.18.1	medium	Same bump as #67 (same pinned chain)

Ignored

None.

Deferred

None (all alerts are older than the 7-day gate).

Resolutions added

None — both affected packages already had root-level resolutions entries; we only needed to raise the lower bound. The existing entries stayed unconditional at the root because lodash/lodash-es are pulled in via several unrelated chains (semantic-release, @commitlint, @semantic-release/*, semantic-release-slack-bot).

Resolutions removed

Two existing entries were found to be redundant during the resolutions audit (removed, re-ran yarn install, verified yarn why still reports a version that satisfies the original pin's intent):

File	Package + pinned range	Reason
package.json	js-yaml: ^4.1.1	Redundant. Natural request range is js-yaml@^4.1.0 from cosmiconfig. After removal and fresh install, yarn why js-yaml still reports 4.1.1 — the registry's latest 4.x satisfies the original intent without the pin.
package.json	ajv: ^8.18.0	Redundant. Natural request range is ajv@^8.11.0 from @commitlint/config-validator. After removal and fresh install, yarn why ajv still reports 8.18.0. The pin is no longer doing anything — upstream has already moved.

The semantic-release-slack-bot/**/micromatch: ^4.0.8 entry was tested for removal too, but removal regresses semantic-release-slack-bot#micromatch to 4.0.2, so it was restored — it is still load-bearing.

Risks

• lodash 4.17.23 → 4.18.1. Upstream 4.18.x backports the two advisories patched here (_.unset/_.omit path-bypass, _.template imports key-name code injection) and contains no API changes. All call sites in this repo route through semantic-release, @commitlint, and friends — we don't import lodash directly.
• lodash-es 4.17.23 → 4.18.1. Same story as lodash; ESM variant, same patch contents, no consumer-facing API changes.
• js-yaml / ajv resolution removals. Post-install yarn why confirms the resolved versions are unchanged (js-yaml@4.1.1, ajv@8.18.0), so this is a no-op at runtime — it just removes stale pins from package.json.

No peer-dep bumps, no breaking majors, no test updates expected.

Manual testing

Covered by CI.

Validation

✅ CI green