Repository: vercel/next.js
Pull request: Update vendored lodash to 4.17.23 to fix CVE-2025-13465

## Update vendored lodash to 4.17.23 to fix CVE-2025-13465

Updates the vendored lodash from 4.17.21 to 4.17.23 to resolve [CVE-2025-13465](https://github.com/advisories/GHSA-xxjr-mmjv-4gpg) (prototype pollution in `_.unset` and `_.omit`).

Fixes #91156

### What changed
- Bumped `lodash` devDependency from `4.17.20` to `4.17.23` in root `package.json`
- Added `"lodash": "4.17.23"` to `pnpm.overrides` to pin all transitive resolutions to the patched version
- Rebuilt `packages/next/src/compiled/jsonwebtoken/index.js` and `packages/next/src/compiled/babel-packages/packages-bundle.js` via `taskr ncc_jsonwebtoken` and `taskr ncc_babel_bundle_packages`

### Why
lodash is not a direct dependency of `packages/next` but enters the compiled bundles as a transitive dependency of `jsonwebtoken` (`^4.17.21`) and `babel-plugin-transform-define` (`^4.17.11`). Since lodash is not externalized in the ncc build, the full library gets inlined into the compiled output. The `pnpm.overrides` entry follows the same pattern already used for `webpack`, `browserslist`, `@babel/core`, and others in this repo.

Changed files:
filename: package.json
patch: @@ -242,7 +242,7 @@
     "ky-universal": "0.6.0",
     "lerna": "9.0.3",
     "lint-staged": "15.2.2",
-    "lodash": "4.17.20",
+    "lodash": "4.17.23",
     "lost": "8.3.1",
     "minimatch": "3.0.4",
     "moment": "^2.24.0",

filename: pnpm-lock.yaml
patch: @@ -421,8 +421,8 @@ importers:
         specifier: 15.2.2
         version: 15.2.2
       lodash:
-        specifier: 4.17.20
-        version: 4.17.20
+        specifier: 4.17.23
+        version: 4.17.23
       lost:
         specifier: 8.3.1
         version: 8.3.1
@@ -13204,11 +13204,8 @@ packages:
   lodash@3.10.1:
     resolution: {integrity: sha512-9mDDwqVIma6OZX79ZlDACZl8sBm0TEnkf99zV3iMA4GzkIT/9hiqP5mY0HoT1iNLCrKc/R1HByV+yJfRWVJryQ==}
 
-  lodash@4.17.20:
-    resolution: {integrity: sha512-PlhdFcillOINfeV7Ni6oF1TAEayyZBoZ8bcshTHqOYJYlrqzRK5hagpagky5o4HfCzzd1TRkXPMFq6cKk9rGmA==}
-
-  lodash@4.17.21:
-    resolution: {integrity: sha512-v2kDEe57lecTulaDIuNTPy3Ry4gLGJ6Z1O3vE1krgXZNrsQ+LFTGHVxVjcXPs17LhbZVGedAJv8XZ1tvj5FvSg==}
+  lodash@4.17.23:
+    resolution: {integrity: sha512-LgVTMpQtIopCi79SJeDiP0TfWi5CNEc/L/aRdTh3yIvmZXTnheWpKjSZhnvMl8iXbC1tFg9gdHHDMLoV7CnG+w==}
 
   log-driver@1.2.7:
     resolution: {integrity: sha512-U7KCmLdqsGHBLeWqYlFA0V0Sl6P08EE1ZrmA9cxjUE0WVqT9qnyVDPz1kzpFEP0jdJuFnasWIfSd7fsaNXkpbg==}
@@ -22523,7 +22520,7 @@ snapshots:
       debug: 3.2.7
       http-proxy-agent: 2.1.0
       https-proxy-agent: 2.2.4
-      lodash: 4.17.20
+      lodash: 4.17.23
       node-fetch: 2.6.7(encoding@0.1.13)
       url-template: 2.0.8
     transitivePeerDependencies:
@@ -24178,7 +24175,7 @@ snapshots:
       chalk: 3.0.0
       css.escape: 1.5.1
       dom-accessibility-api: 0.5.16
-      lodash: 4.17.20
+      lodash: 4.17.23
       redent: 3.0.0
     optionalDependencies:
       '@jest/globals': 29.7.0
@@ -24192,7 +24189,7 @@ snapshots:
       chalk: 3.0.0
       css.escape: 1.5.1
       dom-accessibility-api: 0.6.3
-      lodash: 4.17.21
+      lodash: 4.17.23
       redent: 3.0.0
 
   '@testing-library/react@15.0.7(@types/react@19.2.10)(react-dom@19.3.0-canary-3f0b9e61-20260317(react@19.3.0-canary-3f0b9e61-20260317))(react@19.3.0-canary-3f0b9e61-20260317)':
@@ -25742,7 +25739,7 @@ snapshots:
 
   babel-plugin-transform-define@2.0.0:
     dependencies:
-      lodash: 4.17.21
+      lodash: 4.17.23
       traverse: 0.6.6
 
   babel-plugin-transform-react-remove-prop-types@0.4.24: {}
@@ -30459,7 +30456,7 @@ snapshots:
     dependencies:
       '@types/html-minifier-terser': 6.1.0
       html-minifier-terser: 6.1.0
-      lodash: 4.17.21
+      lodash: 4.17.23
       pretty-error: 4.0.0
       tapable: 2.2.1
     optionalDependencies:
@@ -30788,7 +30785,7 @@ snapshots:
       cli-width: 2.2.0
       external-editor: 2.2.0
       figures: 2.0.0
-      lodash: 4.17.20
+      lodash: 4.17.23
       mute-stream: 0.0.7
       run-async: 2.4.1
       rxjs: 5.5.12
@@ -30804,7 +30801,7 @@ snapshots:
       cli-width: 3.0.0
       external-editor: 3.1.0
       figures: 3.1.0
-      lodash: 4.17.20
+      lodash: 4.17.23
       mute-stream: 0.0.8
       run-async: 2.4.1
       rxjs: 6.6.2
@@ -30820,7 +30817,7 @@ snapshots:
       cli-width: 3.0.0
       external-editor: 3.1.0
       figures: 3.1.0
-      lodash: 4.17.21
+      lodash: 4.17.23
       mute-stream: 0.0.8
       ora: 5.4.1
       run-async: 2.4.1
@@ -30839,7 +30836,7 @@ snapshots:
       cli-cursor: 3.1.0
       cli-width: 4.1.0
       external-editor: 3.1.0
-      lodash: 4.17.21
+      lodash: 4.17.23
       mute-stream: 1.0.0
       ora: 5.4.1
       run-async: 3.0.0
@@ -32057,7 +32054,7 @@ snapshots:
   jsonwebtoken@9.0.0:
     dependencies:
       jws: 3.2.2
-      lodash: 4.17.21
+      lodash: 4.17.23
       ms: 2.1.3
       semver: 7.6.3
 
@@ -32077,7 +32074,7 @@ snapshots:
 
   junit-report-builder@5.1.1:
     dependencies:
-      lodash: 4.17.21
+      lodash: 4.17.23
       make-dir: 3.1.0
       xmlbuilder: 15.1.1
 
@@ -32558,9 +32555,7 @@ snapshots:
 
   lodash@3.10.1: {}
 
-  lodash@4.17.20: {}
-
-  lodash@4.17.21: {}
+  lodash@4.17.23: {}
 
   log-driver@1.2.7: {}
 
@@ -35891,7 +35886,7 @@ snapshots:
 
   pretty-error@4.0.0:
     dependencies:
-      lodash: 4.17.20
+      lodash: 4.17.23
       renderkid: 3.0.0
 
   pretty-format@27.5.1:
@@ -36817,7 +36812,7 @@ snapshots:
       css-select: 4.3.0
       dom-converter: 0.2.0
       htmlparser2: 6.1.0
-      lodash: 4.17.21
+      lodash: 4.17.23
       strip-ansi: 6.0.1
 
   repeat-string@1.6.1: {}
@@ -36828,7 +36823,7 @@ snapshots:
 
   request-promise-core@1.1.2(request@2.88.2):
     dependencies:
-      lodash: 4.17.21
+      lodash: 4.17.23
       request: 2.88.2
 
   request@2.88.2:
@@ -39464,7 +39459,7 @@ snapshots:
     dependencies:
       axios: 1.7.9(debug@4.1.1)
       joi: 17.13.3
-      lodash: 4.17.21
+      lodash: 4.17.23
       minimist: 1.2.8
       rxjs: 7.8.1
     transitivePeerDependencies:
@@ -39556,7 +39551,7 @@ snapshots:
       chalk: 4.1.2
       commander: 7.2.0
       gzip-size: 6.0.0
-      lodash: 4.17.21
+      lodash: 4.17.23
       opener: 1.5.2
       sirv: 1.0.10
       ws: 7.5.3
@@ -39571,7 +39566,7 @@ snapshots:
       chalk: 4.1.2
       commander: 7.2.0
       gzip-size: 6.0.0
-      lodash: 4.17.20
+      lodash: 4.17.23
       opener: 1.5.2
       sirv: 1.0.10
       ws: 7.5.3