I think it makes sense for commons-ui to expose its lodash dependency and for the webapp to require that even for the 7.7 and 7.6 backport. That way we don't run the risk of accidentally using two different versions of lodash.
Some commits are missing the reference to the ticket. Related commits are:
Looks like the 7.6 branch of the camunda-bpm-webapp still needs to be updated to use the camunda-commons-ui version. Also, I think we can move lodash back to the dev-dependencies in camunda-bpm-webapp for 7.7. and 7.6