chore(client): bump lodash to 4.18.1 in design-system packages

[subrata71]

Description

The Yarn resolution for lodash: 4.18.1 was already set in app/client/package.json, which forces the lockfile version. However, Dependabot still flagged 6 alerts because the design-system sub-packages (theming, widgets) and the root package.json declared lodash: ">=4.17.21" as a direct dependency — a range that includes vulnerable versions.

This PR updates the declared version from >=4.17.21 to ^4.18.1 in:

• app/client/package.json (lodash + lodash-es)
• app/client/packages/design-system/theming/package.json
• app/client/packages/design-system/widgets/package.json

The lockfile is regenerated to reflect the new declarations.

Dependabot Alerts Resolved

• Prime cut feature code for keyboard shortcut tests #568 (high) — app/client/packages/design-system/theming/package.json
• Updated locator #567 (medium) — app/client/packages/design-system/theming/package.json
• Rename example applications organization #474 (medium) — app/client/packages/design-system/theming/package.json
• locator updated #570 (high) — app/client/packages/design-system/widgets/package.json
• Fix issue where tabs are lost when the user enters an invalid tabs value #569 (medium) — app/client/packages/design-system/widgets/package.json
• Add more options to action settings #473 (medium) — app/client/packages/design-system/widgets/package.json

Fixes https://linear.app/appsmith/issue/APP-15271

Slack thread: https://theappsmith.slack.com/archives/C09NG5BJ18S/p1780304878402439

Testing

• yarn install completes cleanly
• lodash resolves to 4.18.1 in the lockfile (forced by existing resolution)
• No runtime changes — only version declaration alignment

/ok-to-test tags="@tag.All"

Communication
Should the DevRel and Backend teams be notified?

• No

Summary by CodeRabbit

• Chores
  • Updated utility library dependencies across application packages to improve compatibility and stability.

Tip

🟢 🟢 🟢 All cypress tests have passed! 🎉 🎉 🎉
Workflow run: https://github.com/appsmithorg/appsmith/actions/runs/26931519993
Commit: 4270ef4
Cypress dashboard.
Tags: @tag.All
Spec:

---

Thu, 04 Jun 2026 10:32:04 UTC

[coderabbitai]

Walkthrough

The PR updates lodash and lodash-es dependencies to ^4.18.1 across the client application and design system packages, replacing prior minimum-only or pinned version constraints.

Changes

Lodash dependency upgrade

Layer / File(s)	Summary
Lodash version constraints across client packages app/client/package.json, app/client/packages/design-system/theming/package.json, app/client/packages/design-system/widgets/package.json	Both lodash and lodash-es in the main client package, and lodash in both design system packages, are updated from older minimum constraints (>=4.17.21) and pinned versions (4.17.21) to the compatible range ^4.18.1.

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~5 minutes

Poem

📦 Lodash gets an upgrade today,
From 4.17's yesterday,
To 4.18, caret and free,
Three packages now agree! ✨

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly summarizes the main change: updating lodash versions in design-system packages, which is the primary objective of the PR.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description check	✅ Passed	PR description is comprehensive and follows the template structure with clear context, motivation, issue references, and testing details.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch chore/fix-lodash-version-pins

Warning

Review ran into problems

🔥 Problems

Git: Failed to clone repository. Please run the @coderabbitai full review command to re-trigger a full review. If the issue persists, set path_filters to include or exclude specific files.

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}