Upgrade kolibri-design-system to a release that pins lodash 4.18.1 #6381

❌ This issue is not open for contribution. Visit Contributing guidelines to learn about the contributing process and how to find suitable issues.

Overview

Studio's frontend bundle still ships lodash 4.17.23, the version patched by GHSA-f23m-r3pf-42rh and CVE-2026-4800, because kolibri-design-system 5.10.0 pins it exactly. Studio should move to a KDS release that pins lodash 4.18.1, so a single lodash copy resolves.

Complexity: Low
Target branch: unstable

Context

• Dependabot PR build(deps): Bump lodash from 4.17.23 to 4.18.1 #6380 targeted lodash 4.17.23 → 4.18.1; unstable already has that bump (c4a8556). The PR was closed unmerged.
• pnpm-lock.yaml on unstable still resolves lodash: 4.17.23 under [email protected].
• KDS develop pins "lodash": "4.18.1" since Bump lodash from 4.17.23 to 4.18.1 kolibri-design-system#1232; the v5.10.0 tag, the latest release, does not include it.
• KDS 5.10.0 imports only debounce, throttle, merge, cloneDeep, get, has and similar; none of template, unset, omit.
• Lockstep: KDS pins lodash to an exact version, so kolibri-design-system and Studio's own lodash must match to share one copy. Each later lodash bump in Studio needs a matching KDS release.

The Change

• Bump kolibri-design-system to the first release whose package.json pins lodash 4.18.1.
• Handle any KDS API changes between 5.10.0 and that release in Studio's components.

Acceptance Criteria

• pnpm-lock.yaml contains no [email protected] entry.
• pnpm build and pnpm test pass.
• pnpm audit --prod reports no lodash advisories.

AI usage

rtibblesbot (Claude Code) reviewed #6380, traced the leftover lodash 4.17.23 to KDS through the lockfile, the KDS 5.10.0 npm tarball and the KDS repo, and drafted this issue.

Filed from #6380's review.