fix: update union-value

[scttcper]

avoid vulnerability from cache-base > union-value > set-value

https://www.npmjs.com/advisories/1012

[scttcper]

this is no longer as annoying as it once was as seen in #13 but an upgrade would still be okay

[jonschlinkert]

this is no longer as annoying as it once was as seen in #13 but an upgrade would still be okay

Indeed! Sorry for the late reply and thank you for the PR! I'll get this merged ASAP!

[iveelsm]

Any progress on this change? We have some security vulnerabilities we would like to address and it appears that this may holding us up.

[liddiard]

@jonschlinkert also following up on this. We're getting security vulnerability notifications from the old version of union-value used by this package (which is in turn using the vulnerable version of set-value). Could we get a new release with this package upgrade?

[cyberhck]

hello? can we get this merged?

[finppp]

@jonschlinkert would it be possible to get this merged?

Many thanks,
Finlay

[cyberhck]

this package is probably no longer being maintained, last update was 2 years ago,

[doowb]

This update isn't necessary due to the patches applied in the dependencies and the semver ranges used.

If you're still getting security warnings from another tool you use, this guide might help ensure you have the latest versions. After that, if you're still receiving notices, there's probably incorrect information for version ranges specified for the security tool.

We'll merge this PR when we have other changes to make in this library.

[thomasballinger]

I'm probably missing something here, but it seems to me that this PR would still be useful.
Without this PR,

• cache-base requires "union-value": "^1.0.0" so union-value@2.0.1 does not fulfill this requirement. (the syntax ^1.0.0 allows 1.0.1 and 1.1.1, but not 2.0.0)
• union-value@1.x.x requires "set-value": "^0.4.3" so set-value@2.0.1 does not fulfill this requirement. (the syntax ^0.4.3 allows 0.9.9 but not 2.0.1)

So it seems every published version of union-value still requires a set-value version which is triggering security tools.

[doowb]

@thomasballinger union-value@1.0.0 was patched to use set-value@2.0.1 and bumped to union-value@1.0.1.