Merge pull request #40 from mknudsen/master

remove lodash.pick due to CVE-2020-8203
jsdoc2md · Jan 31, 2024 · ff28e97 · ff28e97
2 parents 013bd2d + 6a714d1
commit ff28e97
Show file tree

Hide file tree

Showing 3 changed files with 9 additions and 13 deletions.
diff --git a/lib/transform.js b/lib/transform.js
@@ -2,9 +2,17 @@ const testValue = require('test-value')
 const where = testValue.where
 const arrayify = require('array-back')
 const extract = require('reduce-extract')
-const pick = require('lodash.pick')
 const omit = require('lodash.omit')
 
+function pick(object, keys) {
+  return keys.reduce((obj, key) => {
+     if (object && object.hasOwnProperty(key)) {
+        obj[key] = object[key];
+     }
+     return obj;
+   }, {});
+}
+
 /**
  * @module transform
  */

diff --git a/package-lock.json b/package-lock.json
diff --git a/package.json b/package.json
@@ -21,7 +21,6 @@
   "dependencies": {
     "array-back": "^6.2.2",
     "lodash.omit": "^4.5.0",
-    "lodash.pick": "^4.4.0",
     "reduce-extract": "^1.0.0",
     "sort-array": "^4.1.5",
     "test-value": "^3.0.0"