Bump lodash and babel-plugin-emotion in /client

[dependabot]

Bumps lodash and babel-plugin-emotion. These dependencies needed to be updated together.
Updates lodash from 4.17.10 to 4.18.1

Release notes

Sourced from lodash's releases.

4.18.1

Bugs

Fixes a ReferenceError issue in lodash lodash-es lodash-amd and lodash.template when using the template and fromPairs functions from the modular builds. See lodash/lodash#6167

These defects were related to how lodash distributions are built from the main branch using https://github.com/lodash-archive/lodash-cli. When internal dependencies change inside lodash functions, equivalent updates need to be made to a mapping in the lodash-cli. (hey, it was ahead of its time once upon a time!). We know this, but we missed it in the last release. It's the kind of thing that passes in CI, but fails bc the build is not the same thing you tested.

There is no diff on main for this, but you can see the diffs for each of the npm packages on their respective branches:

• lodash: lodash/lodash@4.18.0-npm...4.18.1-npm
• lodash-es: lodash/lodash@4.18.0-es...4.18.1-es
• lodash-amd: lodash/lodash@4.18.0-amd...4.18.1-amd
• lodash.templatelodash/lodash@4.18.0-npm-packages...4.18.1-npm-packages

4.18.0

v4.18.0

Full Changelog: lodash/lodash@4.17.23...4.18.0

Security

_.unset / _.omit: Fixed prototype pollution via constructor/prototype path traversal (GHSA-f23m-r3pf-42rh, fe8d32e). Previously, array-wrapped path segments and primitive roots could bypass the existing guards, allowing deletion of properties from built-in prototypes. Now constructor and prototype are blocked unconditionally as non-terminal path keys, matching baseSet. Calls that previously returned true and deleted the property now return false and leave the target untouched.

_.template: Fixed code injection via imports keys (GHSA-r5fr-rjxr-66jc, CVE-2026-4800, 879aaa9). Fixes an incomplete patch for CVE-2021-23337. The variable option was validated against reForbiddenIdentifierChars but importsKeys was left unguarded, allowing code injection via the same Function() constructor sink. imports keys containing forbidden identifier characters now throw "Invalid imports option passed into _.template".

Docs

• Add security notice for _.template in threat model and API docs (#6099)
• Document lower > upper behavior in _.random (#6115)
• Fix quotes in _.compact jsdoc (#6090)

lodash.* modular packages

Diff

We have also regenerated and published a select number of the lodash.* modular packages.

These modular packages had fallen out of sync significantly from the minor/patch updates to lodash. Specifically, we have brought the following packages up to parity w/ the latest lodash release because they have had CVEs on them in the past:

• lodash.orderby
• lodash.tonumber
• lodash.trim
• lodash.trimend
• lodash.sortedindexby
• lodash.zipobjectdeep
• lodash.unset
• lodash.omit
• lodash.template

Commits

• cb0b9b9 release(patch): bump main to 4.18.1 (#6177)
• 75535f5 chore: prune stale advisory refs (#6170)
• 62e91bc docs: remove n_ Node.js < 6 REPL note from README (#6165)
• 59be2de release(minor): bump to 4.18.0 (#6161)
• af63457 fix: broken tests for _.template 879aaa9
• 1073a76 fix: linting issues
• 879aaa9 fix: validate imports keys in _.template
• fe8d32e fix: block prototype pollution in baseUnset via constructor/prototype traversal
• 18ba0a3 refactor(fromPairs): use baseAssignValue for consistent assignment (#6153)
• b819080 ci: add dist sync validation workflow (#6137)
• Additional commits viewable in compare view

Updates babel-plugin-emotion from 9.2.6 to 9.2.11

Changelog

Sourced from babel-plugin-emotion's changelog.

New Changes

All new changes are now documented in CHANGELOG.md files in each package's directory.

v10.0.0 (2018-10-27)

Emotion 10 is a big change that we're really excited about with improvements to the css prop, a Global component for dynamic global styles, zero config SSR, lots of small fixes and improvements and more with an incremental adoption strategy. For a higher-level overview, read the Medium article on Emotion 10. For a migration guide, visit the migrating to Emotion 10 page on emotion.sh

🚀 Enhancement

• The css prop works without babel-plugin-emotion
  • The css prop receives the theme
  • Labels are added to the css prop without babel-plugin-emotion in some cases
• Add the Global and ClassNames components
• styled uses forwardRef
• Add the as prop to styled
• Providing options can be done via the CacheProvider
• The autoLabel and sourceMap options are enabled in development with the Babel Macros
• The autoLabel and sourceMap options are on by default in development in babel-plugin-emotion
• Add warning for kebab-case css properties in objects
• Add keyframes to snapshots with jest-emotion
• Add codemod rules for Emotion 10
• Fix SSR with _ in labels
• Add warnings for unsafe pseudo classes

💥 Breaking Change

• create-emotion no longer accepts a global context object
• Support for preact-emotion has been dropped(note that the emotion package still works with preact)
• Emotion only supports react@>=16.3
• The channel and createBroadcast exports from emotion-theming have been removed
• The extractStatic option to babel-plugin-emotion has been removed
• jest-emotion no longer accepts an emotion instance
• create-emotion-server accepts a cache instead of an emotion instance
• The css prop doesn't work via the babel plugin. jsx can be manually imported from @emotion/core(which can be automated with eslint-plugin-emotion) or babel-plugin-jsx-pragmatic can be used.
• Functions in interpolations are stringified in css and cx calls(probably won't affect you very much, there's a warning about it in v9)
• create-emotion doesn't return a caches property and instead returns a cache property which is the same return value as @emotion/cache
• The importedNames option to babel-plugin-emotion is gone
• The hoist option is gone, hoisting always happens

v9.2.7 (2018-07-29)

🚀 Enhancement

• native, primitives-core, primitives
  • #759 Emotion Native. (@​nitin42)
• jest-emotion
  • #777 add serializer file. (@​kentcdodds)

Committers: 4

... (truncated)

Commits

• 206e5f6 v9.2.11
• 9b69d08 Temp commit for publishing
• 9572090 Move babel-core to devDeps in babel-plugin-emotion
• 0fdafbe Upgrade prettier
• 20345c7 Update package.json (#877)
• cf3f8a8 Update README.md
• 88988ea Update README.md
• 97e7e63 Update README.md
• 86bffc9 Update README.md
• 86a0331 Revert "Temp commit change to lerna.json"
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.