Lodash.merge is a utility function, part of the popular Lodash library, designed for deeply merging objects. The provided data highlights two closely related versions: 2.4.0 and 2.4.1. Both versions serve the same core purpose, offering the _.merge functionality as a standalone Node.js module, generated using lodash-cli. This allows developers to selectively include only the merge function, minimizing their project's footprint.
A key difference lies in the dependencies. Version 2.4.1 relies on ~2.4.1 of its internal lodash components such as lodash._basecreatecallback, lodash._basemerge, lodash._getarray, lodash.isobject, lodash._releasearray, and lodash._slice. Similarly, version 2.4.0 depends on ~2.4.0 of the same internal components. This suggests that the update from 2.4.0 to 2.4.1 primarily involves updates and bug fixes within these internal lodash modules, likely related to improvements in the base merge functionality, array handling, or object checks.
From a developer's perspective, the choice between these versions may depend on the specific needs of your project and constraints. While the core API remains the same, using version 2.4.1 ensures incorporating the latest bug fixes and potential performance enhancements present in its updated dependencies. Both versions are licensed under the MIT license, granting developers broad permissions for usage, modification, and distribution. Lodash is known for its well-tested and reliable code, making lodash.merge a dependable choice for complex object merging scenarios in Node.js projects.
All the vulnerabilities related to the version 2.4.1 of the package
Prototype Pollution in lodash.merge
Versions of lodash.merge before 4.6.1 are vulnerable to Prototype Pollution. The function 'merge' may allow a malicious user to modify the prototype of Object via __proto__ causing the addition or modification of an existing property that will exist on all objects.
Update to version 4.6.1 or later.
Prototype Pollution in lodash.merge
Versions of lodash.merge before 4.6.2 are vulnerable to prototype pollution. The function merge may allow a malicious user to modify the prototype of Object via {constructor: {prototype: {...}}} causing the addition or modification of an existing property that will exist on all objects.
Update to version 4.6.2 or later.
