[Aikido] Fix 10 security issues in lodash, @babel/traverse, ajv and 2 more

[aikido-autofix]

Upgrade dependencies to fix critical RCE vulnerability in template compilation and prototype pollution attacks affecting code execution.

⚠️ Incomplete breaking changes analysis (4/5 analyzed)

⚠️ Breaking changes analysis not available for: @babel/traverse

✅ No breaking changes affect this codebase. Lodash is not a dependency of this project and none of the affected methods (_.unset, _.omit, _.template) are used in the source code.

All breaking changes by upgrading lodash from version 4.17.15 to 4.18.1 (CHANGELOG)

Version	Description
4.18.0	_.unset / _.omit now block constructor and prototype as non-terminal path keys unconditionally. Calls that previously returned true and deleted the property now return false and leave the target untouched.
4.18.0	_.template now throws "Invalid imports option passed into _.template" when imports keys contain forbidden identifier characters, which were previously allowed.

✅ 10 CVEs resolved by this upgrade, including 1 critical 🚨 CVE

This PR will resolve the following CVEs:

Issue	Severity	Description
CVE-2026-4800	🚨 CRITICAL	[lodash] A vulnerability in _.template allows arbitrary code execution through untrusted key names in options.imports or prototype pollution, as validation was incomplete after a prior CVE fix. An attacker can inject malicious code that executes during template compilation.
NSWG-ECO-516	HIGH	[lodash] Prototype pollution attack (lodash)
CVE-2025-13465	MEDIUM	[lodash] A prototype pollution vulnerability in _.unset and _.omit functions allows attackers to delete methods from global prototypes via crafted paths. While this prevents property overwriting, it can cause denial of service by removing critical functionality.
CVE-2026-2950	MEDIUM	[lodash] Prototype pollution vulnerability in _.unset and _.omit functions allows attackers to bypass previous fixes using array-wrapped path segments, enabling deletion of properties from built-in prototypes. While this doesn't allow overwriting prototype behavior, it can cause denial of service or unexpected application behavior.
AIKIDO-2025-10745	MEDIUM	[@babel/traverse] A vulnerability allows remote code execution during compilation when processing malicious input with certain plugins that use internal evaluation methods. This affects plugins like @babel/plugin-transform-runtime and @babel/preset-env with useBuiltIns option.
CVE-2020-15366	MEDIUM	[ajv] A prototype pollution vulnerability in the validate() function allows arbitrary code execution through a maliciously crafted JSON schema. This enables remote code execution when processing untrusted schemas, exceeding the expected denial of service impact.
CVE-2025-69873	LOW	[ajv] A ReDoS vulnerability allows attackers to inject malicious regex patterns via the $data option, causing catastrophic backtracking and CPU exhaustion. A 31-character payload can block execution for ~44 seconds, enabling complete denial of service with minimal effort.
AIKIDO-2026-273849	LOW	[ajv] A prototype pollution vulnerability allows attackers to bypass format validation when the $data option is enabled by using inherited property names like constructor or toString as format values, causing unexpected validation behavior or errors.
CVE-2021-3807	LOW	[ansi-regex] is vulnerable to Inefficient Regular Expression Complexity
CVE-2022-25883	LOW	[semver] Versions of the package semver before 7.5.2 are vulnerable to Regular Expression Denial of Service (ReDoS) via the function new Range, when untrusted user data is provided as a range.

🤖 Remediation details

Fix security vulnerabilities in lodash, @babel/traverse, ajv, ansi-regex, and semver

Short summary

This PR remediates security vulnerabilities in five packages: lodash, @babel/traverse, ajv, ansi-regex, and semver. All five are transitive dependencies except semver, which is also a direct dependency declared in the root package.json. The root package.json received one version spec update (semver); all other fixes land exclusively in package-lock.json via lockfile-only npm update commands.

lodash

lodash is a transitive dependency pulled in by several packages including @babel/traverse, eslint, inquirer, request-promise-core, and table. Because all of those parents declare lodash with a ^4.17.x range that already permits >=4.18.1, no manifest edit was required — running npm update lodash --package-lock-only was sufficient to advance the single hoisted instance from 4.17.15 to 4.18.1, satisfying the patched version floor for all four lodash advisories.

@babel/traverse

@babel/traverse is a transitive dependency consumed by Jest's Babel pipeline (via @babel/core, @babel/helpers, istanbul-lib-instrument, and jest-jasmine2). The parent @babel/core@7.7.2 declares @babel/traverse as ^7.7.2, a range that already permits >=7.23.2, so npm update @babel/traverse --package-lock-only resolved the instance to 7.29.7 without any manifest change, clearing the prototype-pollution advisory.

ajv

ajv is a transitive dependency required by eslint, har-validator, and table. The parent eslint@6.6.0 declares ajv as ^6.10.0, which permits >=6.15.0, so npm update ajv --package-lock-only advanced the single hoisted instance from 6.10.2 to 6.15.0, satisfying the patched version floor for all three ajv advisories without touching any manifest.

ansi-regex

ansi-regex appears in multiple nested copies at different major versions, each owned by a different strip-ansi parent. All parent strip-ansi versions in the tree declare ansi-regex with caret ranges (^4.0.0, ^4.1.0, ^5.0.0) that already permit the respective patched floors (4.1.1, 5.0.1), so npm update ansi-regex --package-lock-only advanced every reachable instance. A separate fsevents update removed the fsevents/node_modules/ansi-regex@2.1.1 nested copy entirely (that fsevents version is no longer installed). The string-length nested copy moved to 3.0.1 (patched floor for the 3.x line).

semver

semver is both a direct dependency of the root package (^6.3.0 → ^6.3.1 in package.json) and a transitive dependency pulled in by several packages at the 5.x line (@babel/core, cross-spawn, make-dir, node-notifier, normalize-package-data). The root spec was tightened to ^6.3.1 and npm install --package-lock-only resolved the root instance to 6.3.1. All 5.x transitive instances were advanced to 5.7.2 via npm update semver --package-lock-only, as every parent's declared range (^5.4.1, ^5.5.0, ^5.6.0) already permitted 5.7.2. The fsevents/node_modules/semver@5.7.0 copy was removed by the fsevents update.

Version changes

Package	From	To	Why updated
semver (root package.json spec)	^6.3.0	^6.3.1	Direct CVE fix — spec floor raised to patched version
semver (node_modules/semver)	6.3.0	6.3.1	Direct CVE fix — resolved after spec bump
semver (@babel/core/node_modules/semver)	5.7.1	5.7.2	Transitive CVE fix — semver resolution under @babel/core
semver (cross-spawn/node_modules/semver)	5.7.1	5.7.2	Transitive CVE fix — semver resolution under cross-spawn
semver (make-dir/node_modules/semver)	5.7.1	5.7.2	Transitive CVE fix — semver resolution under make-dir
semver (node-notifier/node_modules/semver)	5.7.1	5.7.2	Transitive CVE fix — semver resolution under node-notifier
semver (normalize-package-data/node_modules/semver)	5.7.1	5.7.2	Transitive CVE fix — semver resolution under normalize-package-data
semver (fsevents/node_modules/semver)	5.7.0	(removed)	Removed — fsevents version no longer installed after parent update
lodash	4.17.15	4.18.1	Transitive CVE fix — lockfile-only update
@babel/traverse	7.7.2	7.29.7	Transitive CVE fix — lockfile-only update under @babel/core
ajv	6.10.2	6.15.0	Transitive CVE fix — lockfile-only update under eslint / table / har-validator
ansi-regex (node_modules/ansi-regex)	5.0.0	5.0.1	Transitive CVE fix — semver resolution under strip-ansi@6.0.0
ansi-regex (pretty-format/node_modules/ansi-regex)	4.1.0	4.1.1	Transitive CVE fix — semver resolution under pretty-format → strip-ansi
ansi-regex (strip-ansi/node_modules/ansi-regex)	4.1.0	4.1.1	Transitive CVE fix — semver resolution under strip-ansi@5.2.0
ansi-regex (string-length/node_modules/ansi-regex)	3.0.0	3.0.1	Transitive CVE fix — semver resolution under string-length → strip-ansi
ansi-regex (fsevents/node_modules/ansi-regex)	2.1.1	(removed)	Removed — fsevents version no longer installed after parent update
fsevents	1.2.9	(updated, nested copies removed)	Parent update — removed vulnerable nested semver and ansi-regex copies