grep -rl "esm.sh/lodash-es@4.17.21" src/ came back with forty-one files. Forty-one places where the same CDN URL, pinned to the same version, was typed out by hand at the top of a module. The security advisory said bump to 4.17.22. A sed one-liner across the repo felt fine until it silently skipped the two files that imported a named subpath with a slightly different query string.
That's the moment you find out your "no build step" app has a build-step problem anyway — you just moved it into your find-and-replace history.
Why you can't just write import _ from "lodash"
Node resolves that specifier by walking node_modules. A browser has no node_modules to walk. Try it in a plain <script type="module"> and you get this:
Uncaught TypeError: Failed to resolve module specifier "lodash".
