[api-extractor] Consider using caret (^) instead of tilde (~) for lodash dependency

Start by locating the api-extractor package.json and reviewing its lodash and other tilde-pinned dependency entries. Regenerate the relevant lockfiles or dependency resolution, then verify that the intended minor versions resolve without breaking api-extractor; done means the agreed dependency ranges are updated and security fixes can be received without an api-extractor release.

Summary

The lodash dependency is pinned using a tilde range (~4.17.23), which only permits patch updates within the 4.17.x line. Lodash 4.18.0 was recently released to address CVE-2026-4800, a code injection vulnerability in the _.template function. Because of the tilde constraint, consumers of api-extractor cannot receive this security fix without an explicit update to the package.json in this repository.

More broadly, several other dependencies in api-extractor also use tilde ranges (e.g., @microsoft/tsdoc, resolve, semver, source-map). Switching these to caret ranges would allow consumers to benefit from minor version updates - including security patches - without requiring a new api-extractor release.

Repro steps

Expected result: Consumers can receive lodash security patches (e.g., 4.18.0) when regenerating their lockfiles.

Actual result: The ~4.17.23 constraint prevents resolution to 4.18.0, leaving consumers exposed to CVE-2026-4800 until api-extractor explicitly updates its dependency.

Details

Suggested change:

• "lodash": "~4.17.23"

• "lodash": "^4.17.23"

Broader suggestion: Consider updating all tilde-pinned dependencies to use caret ranges, allowing minor version updates that could include security patches.

Using a caret range would allow minor version updates (4.17.x → 4.18.x), enabling consumers to automatically receive security patches that are published in minor releases.

References:

• lodash 4.18.0 release
• CVE-2026-4800

Standard questions