Fix: Vite and lodash related security vulnerability

[b1ink0]

Description

This PR fixes Vite and lodash related security vulnerability.

Checklist

• I have thoroughly tested this code to the best of my abilities.
• I have reviewed the code myself before requesting a review.
• This code is covered by unit tests to verify that it works as intended.
• The QA of this PR is done by a member of the QA team (to be checked by QA).

Fixes:

• https://github.com/rtCamp/frappe-ui-react/security/dependabot/34
• https://github.com/rtCamp/frappe-ui-react/security/dependabot/35
• https://github.com/rtCamp/frappe-ui-react/security/dependabot/36
• https://github.com/rtCamp/frappe-ui-react/security/dependabot/37
• https://github.com/rtCamp/frappe-ui-react/security/dependabot/38
• https://github.com/rtCamp/frappe-ui-react/security/dependabot/39

[Copilot]

Pull request overview

This PR updates dependency resolution to address reported security advisories related to Vite and lodash in the frappe-ui-react monorepo.

Changes:

• Add pnpm overrides to force patched versions of lodash and vite.
• Update the lockfile to resolve to vite@7.3.2 and lodash@4.18.1 (and propagate the new Vite resolution across dependent tooling like Storybook/Vitest).

Reviewed changes

Copilot reviewed 1 out of 2 changed files in this pull request and generated no comments.

File	Description
package.json	Adds pnpm overrides entries for lodash and Vite to mitigate reported vulnerabilities.
pnpm-lock.yaml	Applies the overrides in the resolved dependency graph, updating Vite/lodash versions and their downstream resolutions.

Files not reviewed (1)

• pnpm-lock.yaml: Language not supported

[ayushnirwal]

Where is lodash used even?

[b1ink0]

Where is lodash used even?

@ayushnirwal Its a transitive dependancy:

Transitive dependency lodash 4.17.23 is introduced via
babel-plugin-styled-components 2.1.4 lodash 4.17.23

[ayushnirwal]

I don't remember seeing styled components any where in the project. Can you check

[b1ink0]

I don't remember seeing styled components any where in the project. Can you check

Removed the usage of styled-components completely and also removed unnecessary dependencies.

[ayushnirwal]

LGTM. Merge the changes to develop after this is merged.

[b1ink0]

Updated PR to fix new security vulnerability introduced due to dompurify: https://github.com/rtCamp/frappe-ui-react/security/dependabot/39