diff --git a/CHANGELOG.md b/CHANGELOG.md
index ca84d7c..5d356e5 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -28,8 +28,17 @@ committed `dist/` is still the `0.2.11` build.
   AMD module with an `exports` dependency instead of returning the exports,
   and extends an existing `SilverDecisions.Model` object instead of
   replacing it.
-- The runtime dependencies are unchanged (`sd-utils` `^0.1.15`, in the
-  lockfile with `lodash` 4.17.21 and `loglevel` 1.7.1).
+- The runtime dependencies are unchanged (`sd-utils` `^0.1.15`, with
+  `loglevel` 1.7.1 in the lockfile).
+
+### Dependencies
+
+- The lockfile resolves `lodash` (a dependency of sd-utils 0.1.15, range
+  `^4.17.21`) to 4.18.1 instead of 4.17.21: security fixes only (prototype
+  pollution in `_.unset`/`_.omit`, `_.template` imports validation).
+  `dist/standalone` bundles lodash, so the next release build contains
+  4.18.1. Consumers resolve lodash with their own lockfiles; bundles built
+  earlier (e.g. the published `dist/` of sd-utils 0.1.15) are not changed.
 - Tests: node:test contract tests (`test/contract/`), the Jasmine specs run in
   Node instead of Karma, `npm run test:build` checks the build in an isolated
   copy; GitHub Actions instead of Travis CI.
diff --git a/package-lock.json b/package-lock.json
index e65f84d..529d724 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -6890,9 +6890,10 @@
       }
     },
     "node_modules/lodash": {
-      "version": "4.17.21",
-      "resolved": "https://registry.npmjs.org/lodash/-/lodash-4.17.21.tgz",
-      "integrity": "sha512-v2kDEe57lecTulaDIuNTPy3Ry4gLGJ6Z1O3vE1krgXZNrsQ+LFTGHVxVjcXPs17LhbZVGedAJv8XZ1tvj5FvSg=="
+      "version": "4.18.1",
+      "resolved": "https://registry.npmjs.org/lodash/-/lodash-4.18.1.tgz",
+      "integrity": "sha512-dMInicTPVE8d1e5otfwmmjlxkZoUpiVLwyeTdUsi/Caj/gfzzblBcCE5sRHV/AsjuCmxWrte2TNGSYuCeCq+0Q==",
+      "license": "MIT"
     },
     "node_modules/lodash.debounce": {
       "version": "4.0.8",
@@ -8578,6 +8579,13 @@
         }
       }
     },
+    "node_modules/release-it/node_modules/lodash": {
+      "version": "4.17.21",
+      "resolved": "https://registry.npmjs.org/lodash/-/lodash-4.17.21.tgz",
+      "integrity": "sha512-v2kDEe57lecTulaDIuNTPy3Ry4gLGJ6Z1O3vE1krgXZNrsQ+LFTGHVxVjcXPs17LhbZVGedAJv8XZ1tvj5FvSg==",
+      "dev": true,
+      "license": "MIT"
+    },
     "node_modules/release-it/node_modules/lru-cache": {
       "version": "6.0.0",
       "resolved": "https://registry.npmjs.org/lru-cache/-/lru-cache-6.0.0.tgz",