Lodash.merge is a utility function, part of the larger Lodash library, designed for deeply merging objects. Version 2.3.0 and 2.2.1, both generated by lodash-cli, offer this functionality as a standalone Node.js module. The key difference lies in the updated dependencies and the introduction of lodash._slice in version 2.3.0. Both rely on internal lodash components like lodash._basecreatecallback, lodash._basemerge, lodash._getarray, lodash.isobject, and lodash._releasearray, but the newer version brings a more complete set of tools.
For developers, the lodash.merge package provides a reliable way to combine objects, handling nested structures gracefully compared to simpler merge operations. The package is governed by the permissive MIT license, making it suitable for a wide range of project types. The repository field points to the lodash-cli GitHub repository, indicating that lodash-cli has generated the module. Released in late 2013, they may be older libraries, and developers should also make note, when selecting versions, that the dependencies are pegged to the appropriate minor releases to maintain api compatibility. Users upgrading from 2.2.1 to 2.3.0 should note the potential changes in dependency versions and understand how they might affect nested/internal behavior. The lodash.merge package remains useful where backward compatibility is an overriding concern..
All the vulnerabilities related to the version 2.3.0 of the package
Prototype Pollution in lodash.merge
Versions of lodash.merge
before 4.6.1 are vulnerable to Prototype Pollution. The function 'merge' may allow a malicious user to modify the prototype of Object
via __proto__
causing the addition or modification of an existing property that will exist on all objects.
Update to version 4.6.1 or later.
Prototype Pollution in lodash.merge
Versions of lodash.merge
before 4.6.2 are vulnerable to prototype pollution. The function merge
may allow a malicious user to modify the prototype of Object
via {constructor: {prototype: {...}}}
causing the addition or modification of an existing property that will exist on all objects.
Update to version 4.6.2 or later.