Bump Lodash to v4.17.17+ to fix NPM advisory

[khitrenovich]

Current behavior:

Lodash v4.17.17 was released, fixing https://npmjs.com/advisories/1523.

Cypress is using "fixed" version (v4.17.15) as dependency, causing npm audit to fail:

                                                                                
                       === npm audit security report ===                        
                                                                                
┌──────────────────────────────────────────────────────────────────────────────┐
│                                Manual Review                                 │
│            Some vulnerabilities require your attention to resolve            │
│                                                                              │
│         Visit https://go.npm.me/audit-guide for additional guidance          │
└──────────────────────────────────────────────────────────────────────────────┘
┌───────────────┬──────────────────────────────────────────────────────────────┐
│ Low           │ Prototype Pollution                                          │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Package       │ lodash                                                       │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Patched in    │ >=4.17.17                                                    │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Dependency of │ cypress [dev]                                                │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Path          │ cypress > lodash                                             │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ More info     │ https://npmjs.com/advisories/1523                            │
└───────────────┴──────────────────────────────────────────────────────────────┘
found 1 low severity vulnerability in 1476 scanned packages
  1 vulnerability requires manual review. See the full report for details.

Desired behavior:

Make sure npm audit fix is able to bump Lodash to the updated version.

Versions

Cypress 4.10 and lower.

[millette]

All dependencies are fixed, not using semver at all (~ or ^). Kinda strange if you ask me :-)

[jennifer-shehane]

We prefer locking dependencies so we know exactly what versions our users are using and ensure it works on these exact versions before publishing. We've run into issues in the past without locking. I can bring this up with the team to see if we should revisit this strategy.

Unless you’re hosting Cypress on a server and accepting unsanitized input from outside users - most security vulnerabilities will not affect you. We think this is an extremely unlikely use case.

We understand that a lot of people have policies about needing to pass npm audit for their build regardless. I've opened a PR here to address this #7926

You could use https://github.com/rogeriochaves/npm-force-resolutions to work around this in the meantime.

[cypress-bot]

The code for this is done in cypress-io/cypress#7954, but has yet to be released.
We'll update this issue and reference the changelog when it's released.

[cypress-bot]

Released in 4.11.0.

This comment thread has been locked. If you are still experiencing this issue after upgrading to
Cypress v4.11.0, please open a new issue.