Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Update lodash to remove one security vulnerability #226

Merged
merged 4 commits into from
Sep 24, 2021

Conversation

MgenGlder
Copy link
Collaborator

@MgenGlder MgenGlder commented Sep 24, 2021

Summary

  • Fixes Bumping lodash version to maintain security #224
  • We have a couple pretty high security vulnerability in Lodash (i.e. Command Injection) that can be resolved with an upgrade. Lodash is pretty consistent about not breaking between versions so I feel pretty confident about this tweak.

Acceptance

  • Let's make sure that everything still works. Unfortunately there are no tests so we can do a ride along.

Notes

The exact errors are:

Prototype Pollution - https://npmjs.com/advisories/1065
Prototype Pollution - https://npmjs.com/advisories/1523
Command Injection - https://npmjs.com/advisories/1673
Prototype Pollution - https://npmjs.com/advisories/577
Prototype Pollution - https://npmjs.com/advisories/782

@MgenGlder MgenGlder self-assigned this Sep 24, 2021
@MgenGlder MgenGlder added the dependencies Pull requests that update a dependency file label Sep 24, 2021
@MgenGlder
Copy link
Collaborator Author

Compiling seems to still work ✅.
Generating docs doesn't seem to work ❌ - However it doesn't work for me on master so I don't think this caused that.

@MgenGlder
Copy link
Collaborator Author

Testing using the examples folder and found that _.any is no longer a function in lodash, we need to use _.some instead. Made the update for that as well.

@MgenGlder MgenGlder merged commit d31af47 into master Sep 24, 2021
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
dependencies Pull requests that update a dependency file
Development

Successfully merging this pull request may close these issues.

Bumping lodash version to maintain security
1 participant