Lodash.merge offers a modular approach to the popular _.merge function from the Lodash library, providing a focused solution for deeply merging JavaScript objects. These two versions, 3.0.0 and 3.0.1, represent minor iterations on this core functionality. Both versions share identical dependencies, including lodash._arraycopy, lodash._arrayeach, and lodash.keys, suggesting the underlying merging logic remained largely consistent. Developers using either version can expect reliable, deep object merging capabilities, building upon Lodash's reputation for utility functions. The key difference lies in the release date. Version 3.0.1 arrived just a few days after 3.0.0, suggesting it likely addresses bug fixes or minor performance tweaks discovered shortly after the initial 3.0.0 release. For most users, upgrading to 3.0.1 is advisable to leverage any potential improvements and ensure the most stable experience. The presence of properties like "releaseDate" is very useful for developers in order to track versions and eventual bug fixes that have been issued. While the core _.merge functionality remains the same across both, newer versions are generally preferable for benefiting from potential refinements and ensuring compatibility with the broader Lodash ecosystem, ensuring seamless integration and optimal performance within your JavaScript projects. Both are licensed under MIT, the same as the library, so any project can rely on them.
All the vulnerabilities related to the version 3.0.1 of the package
Prototype Pollution in lodash.merge
Versions of lodash.merge before 4.6.1 are vulnerable to Prototype Pollution. The function 'merge' may allow a malicious user to modify the prototype of Object via __proto__ causing the addition or modification of an existing property that will exist on all objects.
Update to version 4.6.1 or later.
Prototype Pollution in lodash.merge
Versions of lodash.merge before 4.6.2 are vulnerable to prototype pollution. The function merge may allow a malicious user to modify the prototype of Object via {constructor: {prototype: {...}}} causing the addition or modification of an existing property that will exist on all objects.
Update to version 4.6.2 or later.
