[S360] Fix CVE-2026-4800: Update lodash to 4.18.x (#2545)

* Fix CVE-2026-4800: Update lodash to 4.18.x

Updates lodash from 4.17.23 to 4.18.1 across all projects to fix
CVE-2026-4800 (Code Injection via _.template imports key names).

Updated lockfiles:
- Nodejs/Tests/MockProjects/reactappwithjestteststypescript
- Nodejs/Tests/MockProjects/NodeAppWithAngularTests
- Nodejs/Tests/MockProjects/reactappwithjesttestsjavascript
- Root package-lock.json

S360 KPI: [SFI-ES5.2] 1ES Open Source Vulnerabilities

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* Use overrides instead of direct dependency for lodash fix

Move lodash ^4.18.1 from dependencies to overrides in all package.json
files. This forces the transitive dependency to resolve to the patched
version without adding lodash as a direct dependency.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

---------

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Author: lucygramley

Nodejs/Tests/MockProjects/NodeAppWithAngularTests/package-lock.json

@@ -42,6 +42,7 @@
   },
   "overrides": {
     "brace-expansion": "1.1.13",
-    "js-yaml": "3.14.2"
+    "js-yaml": "3.14.2",
+    "lodash": "^4.18.1"
   }
 }

Nodejs/Tests/MockProjects/NodeAppWithAngularTests/package.json

@@ -39,6 +39,7 @@
     "@babel/core": "7.26.10",
     "@babel/helpers": "7.26.10",
     "@babel/runtime": "7.26.10",
-    "brace-expansion": "1.1.13"
+    "brace-expansion": "1.1.13",
+    "lodash": "^4.18.1"
   }
 }

Nodejs/Tests/MockProjects/reactappwithjesttestsjavascript/package-lock.json

@@ -45,6 +45,7 @@
     "@babel/helpers": "7.26.10",
     "@babel/runtime": "7.26.10",
     "js-yaml": "4.1.1",
-    "brace-expansion": "1.1.13"
+    "brace-expansion": "1.1.13",
+    "lodash": "^4.18.1"
   }
 }

Nodejs/Tests/MockProjects/reactappwithjesttestsjavascript/package.json

@@ -16,5 +16,8 @@
     "eslint-plugin-vue": "^6.0.1",
     "react": "^16.12.0",
     "typescript": "3.6.4"
+  },
+  "overrides": {
+    "lodash": "^4.18.1"
   }
 }