Possible fix(deps): 3 vulnerable dependencies in pnpm-lock.yaml

[begininvoke]

I think there may be a problem in pnpm-lock.yaml around line 1.

HIGH severity: Lodash v4.17.23 contains an Arbitrary Code Execution vulnerability in _.template() due to insufficient validation of options.imports key names. Malicious input flows unvalidated into a dangerous Function() constructor sink, allowing attackers to inject default-parameter expressions that execute during template compilation. Combined with potential Object.prototype pollution, this poses a critical Remote Code Execution (RCE) risk, potentially leading to full environment compromise, data exfiltration, or lateral movement.

Something like this might fix it:

--- a/package.json
+++ b/package.json
@@ -1,5 +1,5 @@
 {
   "dependencies": {
-    "lodash": "4.17.23",
+    "lodash": "^4.18.0"
   }
 }
 
+# Apply fix: run `pnpm install`
+
## Workaround (apply only if immediate upgrade is blocked)
- const result = _.template(templateStr, { imports: userInput });
+ const safeImports = Object.fromEntries(
+   Object.entries(userInput || {}).filter(([k]) => /^[a-zA-Z_$][a-zA-Z0-9_$]*$/.test(k))
+ );
+ const result = _.template(templateStr, { imports: safeImports });

For reference: rule CVE-2026-4800. Rated high.

I have not run the test suite here, so treat the suggestion as a starting point rather than something ready to merge.

---

Found with automated scanning (RedGem) and reviewed before opening. If it is not useful, closing it is completely fine.