multiple vulnerabilities that exist in lodash.findlast

[michaelrodov]

Hi
I see multiple vulnerabilities that exist in lodash.findlast
in the latest version (4.6.0)

BDSA-2019-3842
BDSA-2020-3839
CVE-2020-8203 (BDSA-2020-1674)
CVE-2021-23337 (BDSA-2021-0392)
CVE-2019-10744 (BDSA-2019-2112)

When is it planned to attend these vulnerabilities
thank you!

[johnmc-tc]

In the same boat. They've been flagged by our security tools as Critical and we need to remediate. Any plans to address these?

[mihob]

Any news on this issue?

[Trott]

The Lodash documentation encourages people to stop using per-method packages like lodash.findlast and install lodash instead. That won't help for indirect dependencies, but you know, FYI, if you're using lodash.findlast directly, perhaps consider switching to lodash and using _.findlast() that way instead.

[mihob]

In our case, it is lodash.template and a sub-dependency of another package. That's why we can't do anything about it directly.