diff --git a/packages/@uppy/companion/package.json b/packages/@uppy/companion/package.json
index 330499d10..97465c514 100644
--- a/packages/@uppy/companion/package.json
+++ b/packages/@uppy/companion/package.json
@@ -59,7 +59,7 @@
     "ioredis": "^5.3.2",
     "ipaddr.js": "^2.0.1",
     "jsonwebtoken": "9.0.2",
-    "lodash": "^4.17.21",
+    "lodash": "^4.17.23",
     "mime-types": "2.1.35",
     "moment": "^2.29.2",
     "moment-timezone": "^0.5.31",
diff --git a/packages/@uppy/core/package.json b/packages/@uppy/core/package.json
index 245642eb7..1a16f5548 100644
--- a/packages/@uppy/core/package.json
+++ b/packages/@uppy/core/package.json
@@ -44,7 +44,7 @@
     "@transloadit/prettier-bytes": "^0.3.4",
     "@uppy/store-default": "workspace:^",
     "@uppy/utils": "workspace:^",
-    "lodash": "^4.17.21",
+    "lodash": "^4.17.23",
     "mime-match": "^1.0.2",
     "namespace-emitter": "^2.0.1",
     "nanoid": "^5.0.9",
diff --git a/packages/@uppy/dashboard/package.json b/packages/@uppy/dashboard/package.json
index 241bc3795..ce3c0a1ab 100644
--- a/packages/@uppy/dashboard/package.json
+++ b/packages/@uppy/dashboard/package.json
@@ -49,7 +49,7 @@
     "@uppy/thumbnail-generator": "workspace:^",
     "@uppy/utils": "workspace:^",
     "classnames": "^2.2.6",
-    "lodash": "^4.17.21",
+    "lodash": "^4.17.23",
     "nanoid": "^5.0.9",
     "preact": "^10.26.10",
     "shallow-equal": "^3.0.0"
diff --git a/packages/@uppy/golden-retriever/package.json b/packages/@uppy/golden-retriever/package.json
index 38cc97e04..6ab3c7eab 100644
--- a/packages/@uppy/golden-retriever/package.json
+++ b/packages/@uppy/golden-retriever/package.json
@@ -43,7 +43,7 @@
   },
   "dependencies": {
     "@uppy/utils": "workspace:^",
-    "lodash": "^4.17.21"
+    "lodash": "^4.17.23"
   },
   "peerDependencies": {
     "@uppy/core": "workspace:^"
diff --git a/packages/@uppy/provider-views/package.json b/packages/@uppy/provider-views/package.json
index df5470140..4d3c3abee 100644
--- a/packages/@uppy/provider-views/package.json
+++ b/packages/@uppy/provider-views/package.json
@@ -42,7 +42,7 @@
   "dependencies": {
     "@uppy/utils": "workspace:^",
     "classnames": "^2.2.6",
-    "lodash": "^4.17.21",
+    "lodash": "^4.17.23",
     "nanoid": "^5.0.9",
     "p-queue": "^8.0.0",
     "preact": "^10.26.10"
diff --git a/packages/@uppy/utils/package.json b/packages/@uppy/utils/package.json
index 8480f029c..77ead056b 100644
--- a/packages/@uppy/utils/package.json
+++ b/packages/@uppy/utils/package.json
@@ -33,7 +33,7 @@
     "./package.json": "./package.json"
   },
   "dependencies": {
-    "lodash": "^4.17.21",
+    "lodash": "^4.17.23",
     "preact": "^10.26.10"
   },
   "devDependencies": {
diff --git a/yarn.lock b/yarn.lock
index bb1b78ec0..3c5b2b641 100644
--- a/yarn.lock
+++ b/yarn.lock
@@ -8843,7 +8843,7 @@ __metadata:
     ioredis: "npm:^5.3.2"
     ipaddr.js: "npm:^2.0.1"
     jsonwebtoken: "npm:9.0.2"
-    lodash: "npm:^4.17.21"
+    lodash: "npm:^4.17.23"
     mime-types: "npm:2.1.35"
     moment: "npm:^2.29.2"
     moment-timezone: "npm:^0.5.31"
@@ -8923,7 +8923,7 @@ __metadata:
     cssnano: "npm:^7.0.7"
     deep-freeze: "npm:^0.0.1"
     jsdom: "npm:^26.1.0"
-    lodash: "npm:^4.17.21"
+    lodash: "npm:^4.17.23"
     mime-match: "npm:^1.0.2"
     namespace-emitter: "npm:^2.0.1"
     nanoid: "npm:^5.0.9"
@@ -8953,7 +8953,7 @@ __metadata:
     classnames: "npm:^2.2.6"
     cssnano: "npm:^7.0.7"
     jsdom: "npm:^26.1.0"
-    lodash: "npm:^4.17.21"
+    lodash: "npm:^4.17.23"
     nanoid: "npm:^5.0.9"
     playwright: "npm:1.57.0"
     postcss: "npm:^8.5.6"
@@ -9051,7 +9051,7 @@ __metadata:
     "@uppy/utils": "workspace:^"
     "@uppy/xhr-upload": "workspace:^"
     "@vitest/browser": "npm:^3.2.4"
-    lodash: "npm:^4.17.21"
+    lodash: "npm:^4.17.23"
     typescript: "npm:^5.8.3"
     vitest: "npm:^3.2.4"
   peerDependencies:
@@ -9192,7 +9192,7 @@ __metadata:
     classnames: "npm:^2.2.6"
     cssnano: "npm:^7.0.7"
     jsdom: "npm:^26.1.0"
-    lodash: "npm:^4.17.21"
+    lodash: "npm:^4.17.23"
     nanoid: "npm:^5.0.9"
     p-queue: "npm:^8.0.0"
     postcss: "npm:^8.5.6"
@@ -9440,7 +9440,7 @@ __metadata:
   dependencies:
     "@types/lodash": "npm:^4.14.199"
     jsdom: "npm:^26.1.0"
-    lodash: "npm:^4.17.21"
+    lodash: "npm:^4.17.23"
     preact: "npm:^10.26.10"
     typescript: "npm:^5.8.3"
     vitest: "npm:^3.2.4"
@@ -16699,6 +16699,13 @@ __metadata:
   languageName: node
   linkType: hard
 
+"lodash@npm:^4.17.23":
+  version: 4.17.23
+  resolution: "lodash@npm:4.17.23"
+  checksum: 10/82504c88250f58da7a5a4289f57a4f759c44946c005dd232821c7688b5fcfbf4a6268f6a6cdde4b792c91edd2f3b5398c1d2a0998274432cff76def48735e233
+  languageName: node
+  linkType: hard
+
 "log-symbols@npm:^4.1.0":
   version: 4.1.0
   resolution: "log-symbols@npm:4.1.0"