Dependency Issues

[nothingismagick]

You are using the modularized versions of lodash, and these are outdated. Specifically lodash.merge is vulnerable to prototype pollution: https://snyk.io/vuln/SNYK-JS-LODASHMERGE-173732

I would recommend moving to lodash 4.17.11 or greater.

Here are the packages you are using:

    "lodash.isobject": "^3.0.2",
    "lodash.isplainobject": "^4.0.6",
    "lodash.merge": "^4.6.1",
    "lodash.omit": "^4.5.0",
    "lodash.trim": "^4.5.1",

Is there a reason not to just import like this:

const merge = require('lodash/merge');

[marshallswain]

Hi, @nothingismagick. Thanks for notifying me about this. I didn't realize they were out of sync with the rest of lodash. The goal was to keep the package size as small as possible. The new build system supports tree shaking, so it should be an easy switch, now.

[nothingismagick]

That’s great, because I had to relax my auditing configuration for the app-extension I’m building for the Quasar framework, thanks for the consideration!

[marshallswain]

I believe I have all of these fixed in my current PR for feathers-vuex@2.0.x.

#216