fix: patch Vanta security vulnerabilities in npm dependencies

[Harigithub11]

Summary

• CVE-2026-4800, CVE-2026-2950: lodash-es override ^4.17.23 → ^4.18.0
• GHSA-h8r8-wccr-v5f2, CVE-2026-0540, GHSA-cj63-jhhr-wcxv, GHSA-cjmm-f4jc-qw8r: dompurify override ^3.3.2 added (forces transitive dep off vulnerable 3.2.7)

Test plan

• pnpm install resolves cleanly
• No functional changes — overrides only

Summary by CodeRabbit

• Chores
  • Updated project dependencies to newer versions.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: f12076c0-ee40-4e27-9c96-21a3b3f136e4

📥 Commits

Reviewing files that changed from the base of the PR and between c2db84c and b55585c.

⛔ Files ignored due to path filters (1)

• pnpm-lock.yaml is excluded by !**/pnpm-lock.yaml

📒 Files selected for processing (1)

• package.json

---

Walkthrough

The package.json file has been updated to modify pnpm dependency overrides. The lodash-es override version has been incremented from 4.17.23 to 4.18.0, and a new override for dompurify pinned to version 3.3.2 has been added.

Changes

Cohort / File(s)	Summary
Dependency Overrides package.json	Updated lodash-es override from ^4.17.23 to ^4.18.0 and added new dompurify override pinned to ^3.3.2.

Estimated code review effort

🎯 1 (Trivial) | ⏱️ ~3 minutes

Possibly related PRs

• med vulnerability fixed #272: Both PRs modify the lodash-es dependency override in package.json (this PR updates to ^4.18.0).
• Vanta medium vulnerability: Fixed CVE-2026-0540 #370: Both PRs pin dompurify to ^3.3.2 in the dependency overrides.
• fix: vanta medium vulnerability fixes #372: Both PRs manage dompurify dependency versioning, with relevance to CVE-related updates.

Suggested reviewers

• yashkrishan
• ASCE-D

Poem

🐰 Hops of joy through version land,
Lodash climbs, dompurify stands!
Dependencies dance, safe and sound,
In overrides, where upgrades are found! ✨

🚥 Pre-merge checks | ✅ 3

✅ Passed checks (3 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title accurately reflects the main change: patching security vulnerabilities in npm dependencies through version overrides.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/vanta-security-vulnerabilities-2

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[github-actions]

Cloud Run service deployed: https://pr-fix-vanta-security-vulnerabilities-2-cj6r7x3fpa-uc.a.run.app