fix(deps): address CVE-2026-4800 in lodash

[taymoor89]

Summary

Fixes CVE-2026-4800 and CVE-2026-2950: lodash vulnerable to Code Injection via `_.template` (Dependabot alerts #202, #203, #204, #205).

Changes Made

• Pinned lodash to 4.18.0 in apps/greenhouse/package.json (direct dependency)
• Added 2 scoped pnpm overrides in root package.json for the transitive parents that haven't updated yet:
  • @graphql-codegen/plugin-helpers>lodash >=4.18.0 (via @graphql-codegen/cli in heureka)
  • @microsoft/api-extractor>lodash >=4.18.0 (via vite-plugin-dts across 8 packages)

Related Issues

• https://github.com/cloudoperators/juno/security/dependabot/202
• https://github.com/cloudoperators/juno/security/dependabot/203
• https://github.com/cloudoperators/juno/security/dependabot/204
• https://github.com/cloudoperators/juno/security/dependabot/205

Testing Instructions

1. `pnpm install`
2. `pnpm run build`
3. `pnpm run test`
4. Verify in ArgoCD preview

Checklist

• I have performed a self-review of my code.
• I have commented my code, particularly in hard-to-understand areas.
• I have added tests that prove my fix is effective or that my feature works.
• New and existing unit tests pass locally with my changes.
• I have made corresponding changes to the documentation (if applicable).
• My changes generate no new warnings or errors.
• I have created a changeset for my changes.

PR Manifesto

Review the PR Manifesto for best practises.

[changeset-bot]

🦋 Changeset detected

Latest commit: 44f5600

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 1 package

Name	Type
@cloudoperators/juno-app-greenhouse	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR