High severity lodash vulnerability

[davetapley]

$ npm audit
                                                                                
                       === npm audit security report ===                        
                                                                                
┌──────────────────────────────────────────────────────────────────────────────┐
│                                Manual Review                                 │
│            Some vulnerabilities require your attention to resolve            │
│                                                                              │
│         Visit https://go.npm.me/audit-guide for additional guidance          │
└──────────────────────────────────────────────────────────────────────────────┘
┌───────────────┬──────────────────────────────────────────────────────────────┐
│ High          │ Prototype Pollution                                          │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Package       │ lodash                                                       │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Patched in    │ >=4.17.12                                                    │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Dependency of │ graphql-codegen-add [dev]                                    │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Path          │ graphql-codegen-add > graphql-codegen-core > graphql-toolkit │
│               │ > lodash                                                     │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ More info     │ https://npmjs.com/advisories/1065                            │
└───────────────┴──────────────────────────────────────────────────────────────┘

---

This advisory is fixed downstream in graphql-toolkit here.
But we are pinned to a version without the fix:

graphql-code-generator/packages/graphql-codegen-core/package.json

Line 43 in b30e190

"graphql-toolkit": "0.5.8",

I propose that ⬆️ is relaxed to allow npm audit fix to resolve this.

[dotansimha]

Thanks @dukedave, the fix in graphql-toolkit was in Jul 9, and since than we released multiple version.
Running yarn why suggest that graphql-toolkit brings the following:

=> Found "graphql-toolkit#lodash@4.17.15"
info This module exists because "_project_#@graphql-codegen#cli#graphql-toolkit" depends on it.
info Disk size without dependencies: "4.86MB"
info Disk size with unique dependencies: "4.86MB"
info Disk size with transitive dependencies: "4.86MB"
info Number of shared dependencies: 0

Which includes the latest fix.
I suggest to update to the latest version of the codegen.

Thanks!