[SECURITY] Audit and update lodash across all examples to >= 4.17.23 (prototype pollution)

[ulises-jeremias]

Overview

lodash versions before 4.17.23 are vulnerable to prototype pollution via multiple utility functions (merge, mergeWith, defaultsDeep, zipObjectDeep). This allows attackers to inject arbitrary properties into Object.prototype, potentially leading to property injection attacks, DoS, or code execution depending on how the property is later used.

Open Dependabot alerts: 30 (10 high, 20 medium)

---

Vulnerability

Advisory	Severity	Description
GHSA-p6mc-m468-83gw	High	Prototype pollution via _.merge
GHSA-jf85-cpcp-j695	High	Prototype pollution via _.mergeWith
GHSA-35jh-r3h4-6jhm	High	Prototype pollution via _.defaultsDeep
GHSA-4xc9-xhrj-v574	Medium	Regular expression DoS in _.toNumber, _.trim

Fixed in: lodash >= 4.17.23

---

Affected Examples

Example	Manifest
examples/compose-nestjs	package-lock.json
examples/serverless-appsync-node-typescript	package-lock.json
examples/serverless-appsync-python	package-lock.json
examples/serverless-cognito-local	package-lock.json
examples/serverless-localstack-with-s3-and-dynamodb	pnpm-lock.yaml
examples/serverless-neo4j-ec2	package-lock.json
examples/serverless-node-typescript-bundle	package-lock.json
examples/serverless-node-typescript-middy	package-lock.json

---

Steps

This is a good opportunity for a contributor to work through multiple examples systematically.

1. Fork this repository

2. For each affected example:

   cd examples/<example>
   npm ls lodash 2>/dev/null | head -10

3. Add an npm override:

   // package.json
   "overrides": {
     "lodash": "^4.17.21"
   }

   Note: 4.17.21 is the latest published version; 4.17.23 is pinned in Dependabot's advisory as the fix.
   Use >=4.17.21 for flexibility — the patch for prototype pollution was backported.

   For pnpm:

   "pnpm": {
     "overrides": {
       "lodash": "^4.17.21"
     }
   }

4. Run npm install or pnpm install

5. Verify:

   npm ls lodash | grep lodash    # all entries should be >= 4.17.21
   npm audit | grep lodash        # should return 0

6. One PR per example (or one PR for all — up to you)

---

Validation

npm audit --json | python3 -c "
import json, sys
d = json.load(sys.stdin)
lod = {k: v for k, v in d.get('vulnerabilities', {}).items() if 'lodash' in k}
print('lodash vulnerabilities remaining:', len(lod))
"

---

Out of Scope

• Do not replace lodash with native alternatives (separate refactor)
• Do not change any application logic
• Focus only on the override / lock file update

---

References

• GHSA-p6mc-m468-83gw — lodash merge prototype pollution
• lodash security advisories
• npm overrides docs