diff --git a/libraries/access-token-encryptor/package.json b/libraries/access-token-encryptor/package.json
index 745b9a3aa4..96492a4dfa 100644
--- a/libraries/access-token-encryptor/package.json
+++ b/libraries/access-token-encryptor/package.json
@@ -14,7 +14,7 @@
   "author": "",
   "license": "AGPL-3.0-only",
   "dependencies": {
-    "lodash": "^4.17.21"
+    "lodash": "^4.18.1"
   },
   "devDependencies": {
     "chai": "^4.3.6",
diff --git a/libraries/eslint-plugin/package.json b/libraries/eslint-plugin/package.json
index 4ac4d18c0f..4d1ac91ff9 100644
--- a/libraries/eslint-plugin/package.json
+++ b/libraries/eslint-plugin/package.json
@@ -6,7 +6,7 @@
   "main": "index.js",
   "dependencies": {
     "eslint": "^8.51.0",
-    "lodash": "^4.17.21"
+    "lodash": "^4.18.1"
   },
   "devDependencies": {
     "@typescript-eslint/parser": "^8.50.0"
diff --git a/libraries/fetch-utils/package.json b/libraries/fetch-utils/package.json
index 3e88672b1f..7f339bdf06 100644
--- a/libraries/fetch-utils/package.json
+++ b/libraries/fetch-utils/package.json
@@ -27,7 +27,7 @@
   },
   "dependencies": {
     "@overleaf/o-error": "workspace:*",
-    "lodash": "^4.17.21",
+    "lodash": "^4.18.1",
     "node-fetch": "^2.7.0"
   }
 }
diff --git a/libraries/overleaf-editor-core/package.json b/libraries/overleaf-editor-core/package.json
index f320a6e3ec..dc82f0536c 100644
--- a/libraries/overleaf-editor-core/package.json
+++ b/libraries/overleaf-editor-core/package.json
@@ -27,7 +27,7 @@
   "dependencies": {
     "@overleaf/o-error": "workspace:*",
     "check-types": "^5.1.0",
-    "lodash": "^4.17.19",
+    "lodash": "^4.18.1",
     "p-map": "^4.0.0",
     "path-browserify": "^1.0.1"
   }
diff --git a/package.json b/package.json
index 585a6b9d51..f4bc6f2b78 100644
--- a/package.json
+++ b/package.json
@@ -92,7 +92,7 @@
     "@contentful/rich-text-types": "16.0.2",
     "i18next": "23.10.0",
     "sanitize-html": "2.12.1",
-    "lodash": "4.17.23",
+    "lodash": "4.18.1",
     "express-session": "1.17.2",
     "ioredis": "4.27.11",
     "webpack": "5.98.0",
diff --git a/services/clsi/package.json b/services/clsi/package.json
index 1df8ab67dd..b80e977d33 100644
--- a/services/clsi/package.json
+++ b/services/clsi/package.json
@@ -29,7 +29,7 @@
     "bunyan": "^1.8.15",
     "dockerode": "^4.0.9",
     "express": "4.22.1",
-    "lodash": "^4.17.21",
+    "lodash": "^4.18.1",
     "multer": "2.1.1",
     "overleaf-editor-core": "workspace:*",
     "p-limit": "^3.1.0",
diff --git a/services/docstore/package.json b/services/docstore/package.json
index 3ae59b289c..6fc4553765 100644
--- a/services/docstore/package.json
+++ b/services/docstore/package.json
@@ -30,7 +30,7 @@
     "bunyan": "^1.8.15",
     "celebrate": "^15.0.3",
     "express": "4.22.1",
-    "lodash": "^4.17.21",
+    "lodash": "^4.18.1",
     "mongodb-legacy": "6.1.3",
     "p-map": "^4.0.0"
   },
diff --git a/services/document-updater/package.json b/services/document-updater/package.json
index 64d789f740..a0ec8cceff 100644
--- a/services/document-updater/package.json
+++ b/services/document-updater/package.json
@@ -32,7 +32,7 @@
     "bunyan": "^1.8.15",
     "diff-match-patch": "overleaf/diff-match-patch#89805f9c671a77a263fc53461acd62aa7498f688",
     "express": "4.22.1",
-    "lodash": "^4.17.21",
+    "lodash": "^4.18.1",
     "minimist": "^1.2.8",
     "mongodb-legacy": "6.1.3",
     "overleaf-editor-core": "workspace:*"
diff --git a/services/history-v1/package.json b/services/history-v1/package.json
index c676ad92c2..56a3910ff4 100644
--- a/services/history-v1/package.json
+++ b/services/history-v1/package.json
@@ -34,7 +34,7 @@
     "http-status": "^1.4.2",
     "jsonwebtoken": "^9.0.3",
     "knex": "^2.4.0",
-    "lodash": "^4.17.19",
+    "lodash": "^4.18.1",
     "mongodb": "6.12.0",
     "overleaf-editor-core": "workspace:*",
     "p-limit": "^6.2.0",
diff --git a/services/project-history/package.json b/services/project-history/package.json
index cfd2332b52..1aa2cb8b1e 100644
--- a/services/project-history/package.json
+++ b/services/project-history/package.json
@@ -32,7 +32,7 @@
     "celebrate": "^15.0.3",
     "diff-match-patch": "overleaf/diff-match-patch#89805f9c671a77a263fc53461acd62aa7498f688",
     "express": "4.22.1",
-    "lodash": "^4.17.20",
+    "lodash": "^4.18.1",
     "minimist": "^1.2.8",
     "mongodb-legacy": "6.1.3",
     "overleaf-editor-core": "workspace:*",
diff --git a/services/real-time/package.json b/services/real-time/package.json
index 7ffa6b67fc..f9b448b869 100644
--- a/services/real-time/package.json
+++ b/services/real-time/package.json
@@ -32,7 +32,7 @@
     "cookie-parser": "^1.4.6",
     "express": "4.22.1",
     "express-session": "^1.17.1",
-    "lodash": "^4.17.21",
+    "lodash": "^4.18.1",
     "proxy-addr": "^2.0.7",
     "socket.io": "github:overleaf/socket.io#0.9.19-overleaf-12",
     "socket.io-client": "github:overleaf/socket.io-client#0.9.17-overleaf-5",
diff --git a/services/web/package.json b/services/web/package.json
index 92901522b0..0590ae9b88 100644
--- a/services/web/package.json
+++ b/services/web/package.json
@@ -145,7 +145,7 @@
     "jose": "^4.3.8",
     "json2csv": "^4.3.3",
     "jsonwebtoken": "^9.0.3",
-    "lodash": "^4.17.19",
+    "lodash": "^4.18.1",
     "lru-cache": "^7.10.1",
     "marked": "^4.1.0",
     "method-override": "^2.3.3",
diff --git a/yarn.lock b/yarn.lock
index cc3e52b0f4..8da8f0ddaf 100644
--- a/yarn.lock
+++ b/yarn.lock
@@ -6272,7 +6272,7 @@ __metadata:
   dependencies:
     chai: "npm:^4.3.6"
     chai-as-promised: "npm:^7.1.1"
-    lodash: "npm:^4.17.21"
+    lodash: "npm:^4.18.1"
     mocha: "npm:^11.1.0"
     mocha-junit-reporter: "npm:^2.2.1"
     mocha-multi-reporters: "npm:^1.5.1"
@@ -6310,7 +6310,7 @@ __metadata:
     east: "npm:^2.0.3"
     express: "npm:4.22.1"
     json2csv: "npm:^4.5.4"
-    lodash: "npm:^4.17.21"
+    lodash: "npm:^4.18.1"
     minimist: "npm:^1.2.7"
     mixpanel: "npm:^0.13.0"
     mocha: "npm:^11.1.0"
@@ -6433,7 +6433,7 @@ __metadata:
     dockerode: "npm:^4.0.9"
     express: "npm:4.22.1"
     form-data: "npm:^4.0.5"
-    lodash: "npm:^4.17.21"
+    lodash: "npm:^4.18.1"
     mocha: "npm:^11.1.0"
     mocha-junit-reporter: "npm:^2.2.1"
     mocha-multi-reporters: "npm:^1.5.1"
@@ -6524,7 +6524,7 @@ __metadata:
     chai: "npm:^4.3.6"
     chai-as-promised: "npm:^7.1.1"
     express: "npm:4.22.1"
-    lodash: "npm:^4.17.21"
+    lodash: "npm:^4.18.1"
     mocha: "npm:^11.1.0"
     mocha-junit-reporter: "npm:^2.2.1"
     mocha-multi-reporters: "npm:^1.5.1"
@@ -6563,7 +6563,7 @@ __metadata:
     cluster-key-slot: "npm:^1.0.5"
     diff-match-patch: "overleaf/diff-match-patch#89805f9c671a77a263fc53461acd62aa7498f688"
     express: "npm:4.22.1"
-    lodash: "npm:^4.17.21"
+    lodash: "npm:^4.18.1"
     minimist: "npm:^1.2.8"
     mocha: "npm:^11.1.0"
     mocha-junit-reporter: "npm:^2.2.1"
@@ -6585,7 +6585,7 @@ __metadata:
   dependencies:
     "@typescript-eslint/parser": "npm:^8.50.0"
     eslint: "npm:^8.51.0"
-    lodash: "npm:^4.17.21"
+    lodash: "npm:^4.18.1"
   languageName: unknown
   linkType: soft
 
@@ -6599,7 +6599,7 @@ __metadata:
     chai: "npm:^4.3.6"
     chai-as-promised: "npm:^7.1.1"
     express: "npm:4.22.1"
-    lodash: "npm:^4.17.21"
+    lodash: "npm:^4.18.1"
     mocha: "npm:^11.1.0"
     mocha-junit-reporter: "npm:^2.2.1"
     mocha-multi-reporters: "npm:^1.5.1"
@@ -6669,7 +6669,7 @@ __metadata:
     chai: "npm:^4.3.6"
     chai-as-promised: "npm:^7.1.1"
     express: "npm:4.22.1"
-    lodash: "npm:^4.17.21"
+    lodash: "npm:^4.18.1"
     mocha: "npm:^11.1.0"
     mocha-junit-reporter: "npm:^2.2.1"
     mocha-multi-reporters: "npm:^1.5.1"
@@ -6897,7 +6897,7 @@ __metadata:
     diff-match-patch: "overleaf/diff-match-patch#89805f9c671a77a263fc53461acd62aa7498f688"
     esmock: "npm:^2.7.3"
     express: "npm:4.22.1"
-    lodash: "npm:^4.17.20"
+    lodash: "npm:^4.18.1"
     minimist: "npm:^1.2.8"
     mocha: "npm:^11.1.0"
     mocha-junit-reporter: "npm:^2.2.1"
@@ -6963,7 +6963,7 @@ __metadata:
     cookie-signature: "npm:^1.1.0"
     express: "npm:4.22.1"
     express-session: "npm:^1.17.1"
-    lodash: "npm:^4.17.21"
+    lodash: "npm:^4.18.1"
     mocha: "npm:^11.1.0"
     mocha-junit-reporter: "npm:^2.2.1"
     mocha-multi-reporters: "npm:^1.5.1"
@@ -7090,7 +7090,7 @@ __metadata:
     chai-as-promised: "npm:^7.1.1"
     express: "npm:4.22.1"
     install: "npm:^0.13.0"
-    lodash: "npm:^4.17.21"
+    lodash: "npm:^4.18.1"
     marked: "npm:^4.1.0"
     method-override: "npm:^3.0.0"
     mocha: "npm:^11.1.0"
@@ -7126,7 +7126,7 @@ __metadata:
     express: "npm:4.22.1"
     express-basic-auth: "npm:^1.2.0"
     ioredis: "npm:^4.16.0"
-    lodash: "npm:^4.17.21"
+    lodash: "npm:^4.18.1"
     lru-cache: "npm:^4.1.5"
     minimatch: "npm:^10.2.2"
     minimist: "npm:^1.2.8"
@@ -7164,7 +7164,7 @@ __metadata:
     chai-as-promised: "npm:^7.1.1"
     esmock: "npm:^2.7.3"
     express: "npm:4.22.1"
-    lodash: "npm:^4.17.21"
+    lodash: "npm:^4.18.1"
     lru-cache: "npm:^5.1.1"
     mocha: "npm:^11.1.0"
     mocha-junit-reporter: "npm:^2.2.1"
@@ -7198,7 +7198,7 @@ __metadata:
     express: "npm:4.22.1"
     express-basic-auth: "npm:^1.2.0"
     ioredis: "npm:^4.16.0"
-    lodash: "npm:^4.17.15"
+    lodash: "npm:^4.18.1"
     mocha: "npm:^11.1.0"
     mocha-junit-reporter: "npm:^2.2.1"
     mocha-multi-reporters: "npm:^1.5.1"
@@ -7449,7 +7449,7 @@ __metadata:
     jsonwebtoken: "npm:^9.0.3"
     katex: "npm:^0.16.28"
     knip: "npm:^5.64.1"
-    lodash: "npm:^4.17.19"
+    lodash: "npm:^4.18.1"
     lottie-react: "npm:^2.4.1"
     lru-cache: "npm:^7.10.1"
     marked: "npm:^4.1.0"
@@ -23116,10 +23116,10 @@ __metadata:
   languageName: node
   linkType: hard
 
-"lodash@npm:4.17.23":
-  version: 4.17.23
-  resolution: "lodash@npm:4.17.23"
-  checksum: 10c0/1264a90469f5bb95d4739c43eb6277d15b6d9e186df4ac68c3620443160fc669e2f14c11e7d8b2ccf078b81d06147c01a8ccced9aab9f9f63d50dcf8cace6bf6
+"lodash@npm:4.18.1":
+  version: 4.18.1
+  resolution: "lodash@npm:4.18.1"
+  checksum: 10c0/757228fc68805c59789e82185135cf85f05d0b2d3d54631d680ca79ec21944ec8314d4533639a14b8bcfbd97a517e78960933041a5af17ecb693ec6eecb99a27
   languageName: node
   linkType: hard
 
@@ -25903,7 +25903,7 @@ __metadata:
     "@types/path-browserify": "npm:^1.0.3"
     chai: "npm:^3.3.0"
     check-types: "npm:^5.1.0"
-    lodash: "npm:^4.17.19"
+    lodash: "npm:^4.18.1"
     mocha: "npm:^11.1.0"
     mocha-junit-reporter: "npm:^2.2.1"
     mocha-multi-reporters: "npm:^1.5.1"
@@ -25951,7 +25951,7 @@ __metadata:
     http-status: "npm:^1.4.2"
     jsonwebtoken: "npm:^9.0.3"
     knex: "npm:^2.4.0"
-    lodash: "npm:^4.17.19"
+    lodash: "npm:^4.18.1"
     mocha: "npm:^11.1.0"
     mocha-junit-reporter: "npm:^2.2.1"
     mocha-multi-reporters: "npm:^1.5.1"