fix: resolve lodash-es prototype pollution vulnerability (GHSA-xxjr-mmjv-4gpg)

Author: uberbinge

.projenrc.js

@@ -45,6 +45,13 @@ project.addDevDeps('jest@^29');
 project.addDevDeps('ts-jest@^29');
 project.addBundledDeps('js-toml@^1.0.2');
 
+// Fix for GHSA-xxjr-mmjv-4gpg: lodash-es prototype pollution vulnerability
+// js-toml -> chevrotain -> lodash-es@4.17.21 is vulnerable
+// Force chevrotain@11.1.1+ which uses lodash-es@4.17.23 (patched)
+project.package.addField('resolutions', {
+  'chevrotain': '^11.1.1',
+});
+
 project.addGitIgnore('target');
 project.gitignore.removePatterns('*.tgz');