Replace lodash with native JS equivalents

[Frank3K]

Description

Removes lodash (and @types/lodash) as a dependency. All usages are replaced with native ES2020 equivalents: optional chaining, Array methods, Object.entries/spread, and typeof checks. A shared isPlainObject helper is extracted to src/utils/objectutils.js.

Why

Lodash was a sensible utility belt in the Node.js 4.x era, but the language has long since caught up. Every lodash function used in this codebase now has a direct, readable native equivalent available in Node 20+ (which is already the minimum required by our engines field).

Reasons to drop it:

• CVE hygiene. Lodash has been the subject of multiple high-severity CVEs (prototype pollution, ReDoS).
• Simpler mental model. Native Array.isArray, ?.superstatic?.headers, typeof x === "function", .endsWith(), Object.entries(), and spread syntax are things every JS developer knows without consulting lodash docs.
• One fewer package to keep up with. No more scheduled bumps just to stay on the latest patch.

What changed

All lodash calls replaced with native equivalents across all files.

A shared isPlainObject helper is extracted to src/utils/objectutils.js to avoid duplication between src/responder.js and src/loaders/config-file.js.

Bundle size

Lodash itself remains in node_modules as a transitive dependency via glob-slasher, so the production install footprint is unchanged for now. I'm planning on creating a separate PR to replace glob-slasher, which is unmaintained for about 12 years, also to take a second look at #249.

@types/lodash is fully removed.

Verification

Tests are passing.

[Frank3K]

All names in the array are unchanged when passed through kebabCase.

[bkendall]

Can this be done in Typescript instead?

[Frank3K]

Yes. Fixed in 3d5302e.

[bkendall]

I've slowly tilted at this similarly before - honestly, a nice PR :) Looks like something will need adjustment for the license check, but this is great!

[Frank3K]

Looks like something will need adjustment for the license check, but this is great!

Thanks! I've added the license in 5a1c257.

[Frank3K]

I'm planning on creating a separate PR to replace glob-slasher, which is unmaintained for about 12 years, also to take a second look at #249.

Created #524.

[bkendall]

Sorry it took me so long to come back to this. It looks good. Thanks!