fix(dep): migrate from lodash.set to lodash. #2306
Conversation
Listing `lodash` as a prod dependency has a few advantages over the single func dep we were using. Primarily, when a security vulnerability is patched in LoDash, those changes don't get published to individual function libs anymore. The most recent example being the prototype pollution that was patched in 4.17.16. That particular vulnerability didn't effect Nock because of our usage, however, Nock does show up as having a vulnerability because of it which is a pain for consumers. It also creates a future problem where the next patch could affect Nock more directly. #2279 It should be noted that LoDash itself discourages the use of these single function libs: https://lodash.com/per-method-packages This changes also removes the vendor-izing of two LoDash functions in favor of using the lib directly (`isPlainObject` and `mapValues`).
|
Normally, dependency updates would be a |
|
@paulmelnikow I know you were in favor of |
|
Hey @mastermatt I was wondering if this fix can be reviewed & merged, lodash won't be supporting individual packages anymore. It will be great if nock will be updated to remove this snyk vulnerability. |
|
I'm in favor of the current state of this PR, however, I need another maintainer to approve before it can be merged. With this change, the full LoDash dep is used by Node apps, which tend to have LoDash anyway and where package size isn't much of a consideration, and can use proper tree-shaking by anyone what cares abound bundle size. |
|
bump I'd love to see this MR merged - can this please be progressed? Thank you all in advance! |
|
bump can this please be progressed? Thank you all in advance! |
|
@nock/maintainers anyone else want to 👍🏼 |
|
@gr2m check my comment on this pr about the tests #2364 (comment) |
|
🎉 This PR is included in version 13.2.5 🎉 The release is available on: Your semantic-release bot 📦🚀 |
Listing
lodashas a prod dependency has a few advantages over the single func dep we were using.Primarily, when a security vulnerability is patched in LoDash, those changes don't get published to individual function libs anymore.
The most recent example being the prototype pollution that was patched in 4.17.16.
That particular vulnerability didn't effect Nock because of our usage, however, Nock does show up as having a vulnerability because of it which is a pain for consumers. It also creates a future problem where the next patch could affect Nock more directly.
#2279
It should be noted that LoDash itself discourages the use of these single function libs: https://lodash.com/per-method-packages
This changes also removes the vendor-izing of two LoDash functions in favor of using the lib directly (
isPlainObjectandmapValues).