From 7b7fb19c705f3dc6dc8744d3cf30c2b00d75e707 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Wed, 8 Apr 2026 20:20:52 +0000
Subject: [PATCH] chore(deps): bump lodash from 4.17.23 to 4.18.1

Bumps [lodash](https://github.com/lodash/lodash) from 4.17.23 to 4.18.1.
- [Release notes](https://github.com/lodash/lodash/releases)
- [Commits](https://github.com/lodash/lodash/compare/4.17.23...4.18.1)

---
updated-dependencies:
- dependency-name: lodash
  dependency-version: 4.18.1
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
---
 packages/fxa-auth-server/package.json    |  2 +-
 packages/fxa-content-server/package.json |  2 +-
 packages/fxa-profile-server/package.json |  2 +-
 yarn.lock                                | 14 +++++++-------
 4 files changed, 10 insertions(+), 10 deletions(-)

diff --git a/packages/fxa-auth-server/package.json b/packages/fxa-auth-server/package.json
index 3457948e09a..1a4e224b220 100644
--- a/packages/fxa-auth-server/package.json
+++ b/packages/fxa-auth-server/package.json
@@ -96,7 +96,7 @@
     "jsonwebtoken": "^9.0.3",
     "jwks-rsa": "^3.1.0",
     "keyv": "5.2.1",
-    "lodash": "^4.17.23",
+    "lodash": "^4.18.1",
     "luxon": "^3.5.0",
     "mjml": "^4.18.0",
     "moment-timezone": "^0.5.35",
diff --git a/packages/fxa-content-server/package.json b/packages/fxa-content-server/package.json
index a45d2ff774d..039d65bdc92 100644
--- a/packages/fxa-content-server/package.json
+++ b/packages/fxa-content-server/package.json
@@ -93,7 +93,7 @@
     "jsxgettext-recursive-next": "1.1.0",
     "legal-docs": "https://github.com/mozilla/legal-docs.git#68a02d3a95f22fb10db68893bb54e49bc0604f69",
     "load-grunt-tasks": "^5.1.0",
-    "lodash": "^4.17.23",
+    "lodash": "^4.18.1",
     "mkdirp": "3.0.1",
     "mocha": "^10.4.0",
     "morgan": "^1.10.0",
diff --git a/packages/fxa-profile-server/package.json b/packages/fxa-profile-server/package.json
index 2e0531c6555..0ddeb538539 100644
--- a/packages/fxa-profile-server/package.json
+++ b/packages/fxa-profile-server/package.json
@@ -34,7 +34,7 @@
     "convict-format-with-validator": "^6.2.0",
     "fxa-shared": "workspace:*",
     "joi": "^17.13.3",
-    "lodash": "^4.17.23",
+    "lodash": "^4.18.1",
     "mozlog": "^3.0.2",
     "mysql": "^2.18.1",
     "poolee": "^1.0.1",
diff --git a/yarn.lock b/yarn.lock
index 97803495178..78f7cedb066 100644
--- a/yarn.lock
+++ b/yarn.lock
@@ -31898,7 +31898,7 @@ __metadata:
     keypair: "npm:1.0.4"
     keyv: "npm:5.2.1"
     load-grunt-tasks: "npm:^5.1.0"
-    lodash: "npm:^4.17.23"
+    lodash: "npm:^4.18.1"
     luxon: "npm:^3.5.0"
     mailparser: "npm:0.6.1"
     mjml: "npm:^4.18.0"
@@ -32036,7 +32036,7 @@ __metadata:
     jsxgettext-recursive-next: "npm:1.1.0"
     legal-docs: "https://github.com/mozilla/legal-docs.git#68a02d3a95f22fb10db68893bb54e49bc0604f69"
     load-grunt-tasks: "npm:^5.1.0"
-    lodash: "npm:^4.17.23"
+    lodash: "npm:^4.18.1"
     mini-css-extract-plugin: "npm:^2.9.2"
     mkdirp: "npm:3.0.1"
     mocha: "npm:^10.4.0"
@@ -32343,7 +32343,7 @@ __metadata:
     fxa-shared: "workspace:*"
     insist: "npm:1.0.1"
     joi: "npm:^17.13.3"
-    lodash: "npm:^4.17.23"
+    lodash: "npm:^4.18.1"
     mocha: "npm:^10.4.0"
     mocha-text-cov: "npm:0.1.1"
     mozlog: "npm:^3.0.2"
@@ -39637,10 +39637,10 @@ __metadata:
   languageName: node
   linkType: hard
 
-"lodash@npm:^4.17.23":
-  version: 4.17.23
-  resolution: "lodash@npm:4.17.23"
-  checksum: 10c0/1264a90469f5bb95d4739c43eb6277d15b6d9e186df4ac68c3620443160fc669e2f14c11e7d8b2ccf078b81d06147c01a8ccced9aab9f9f63d50dcf8cace6bf6
+"lodash@npm:^4.18.1":
+  version: 4.18.1
+  resolution: "lodash@npm:4.18.1"
+  checksum: 10c0/757228fc68805c59789e82185135cf85f05d0b2d3d54631d680ca79ec21944ec8314d4533639a14b8bcfbd97a517e78960933041a5af17ecb693ec6eecb99a27
   languageName: node
   linkType: hard