Lodash dependency causes prototype pollution issue: can you use another package instead of lodash?

[marcoippolito]

│ Low │ Prototype Pollution │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Package │ lodash │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Patched in │ No patch available │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Dependency of │ @vue/cli-service │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Path │ @vue/cli-service > webpack-merge > lodash │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ More info │ https://npmjs.com/advisories/1523

https://www.npmjs.com/advisories/1523 : "No fix is currently available. Consider using an alternative package until a fix is made available."

webpack-merge@4.2.2

Can you use another package instead of lodash?

[bebraw]

What would be a good alternative? I can resolve this in the next major version.

[marcoippolito]

@bebraw I'm not that expert of Lodash.
Just looking around I found these info:

• https://stackshare.io/lodash/alternatives

• https://js.libhunt.com/lodash-alternatives

• https://www.sitepoint.com/lodash-features-replace-es6/

[bebraw]

No worries. It’s only a couple of functions we are using so likely it’s not a big deal to replace them.

…

On 2. Jul 2020, at 13.09, Marco Ippolito ***@***.***> wrote:  @bebraw I'm not that expert of Lodash. Just looking around I found these info: https://stackshare.io/lodash/alternatives https://js.libhunt.com/lodash-alternatives https://www.sitepoint.com/lodash-features-replace-es6/ — You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub, or unsubscribe.

[marcoippolito]

@bebraw Thank you very much!!!

[bebraw]

I've done this at the develop branch and the change is going to be included to the next major version.

[marcoippolito]

I've done this at the develop branch and the change is going to be included to the next major version.

Thank you very much!!!

[bebraw]

@marcoippolito Check #136 for the beta.