Lodash.merge is a utility function, part of the popular Lodash library, designed for deep merging of JavaScript objects. Version 2.1.0 and 2.0.0, both generated using lodash-cli, offer this functionality as a standalone Node.js module. Examining the differences reveals subtle version updates in dependencies. Crucially, lodash.merge 2.1.0 depends on "lodash._basecreatecallback", "lodash._basemerge", "lodash._getarray", "lodash.isobject", and "lodash._releasearray" all at version "~2.1.0", whereas the older 2.0.0 version pins these dependencies to "~2.0.0".
While the core functionality remains the same, this dependency update signifies bug fixes, performance improvements, or minor feature enhancements within those internal Lodash components. For developers, this means upgrading to 2.1.0 brings the benefit of the latest refinements in the underlying Lodash utilities, potentially resolving edge cases or improving overall stability. The release date also indicates that 2.1.0 was released very shortly after 2.0.0, on the same day, further suggesting it was likely a quick patch or minor update to address any immediate issues found in the initial 2.0.0 release. Lodash.merge is provided under the MIT license, making it free to use and integrate into any project. The source code repository is available on GitHub within the lodash-cli project.
All the vulnerabilities related to the version 2.1.0 of the package
Prototype Pollution in lodash.merge
Versions of lodash.merge before 4.6.1 are vulnerable to Prototype Pollution. The function 'merge' may allow a malicious user to modify the prototype of Object via __proto__ causing the addition or modification of an existing property that will exist on all objects.
Update to version 4.6.1 or later.
Prototype Pollution in lodash.merge
Versions of lodash.merge before 4.6.2 are vulnerable to prototype pollution. The function merge may allow a malicious user to modify the prototype of Object via {constructor: {prototype: {...}}} causing the addition or modification of an existing property that will exist on all objects.
Update to version 4.6.2 or later.
