Lodash.merge offers a modular approach to the popular _.merge function from the Lodash library, allowing developers to selectively include this specific utility without importing the entire Lodash collection. Versions 3.0.1 and 3.0.2 share the same core functionality: deeply merging properties of source objects into a destination object. Both versions depend on a suite of internal Lodash modules like lodash._arraycopy, lodash._arrayeach, lodash._basefor, lodash._createassigner, lodash.isarguments, lodash.isarray, lodash.isplainobject, lodash.istypedarray, lodash.keys, and lodash.toplainobject, ensuring consistent behavior and relying on vetted, performant code for its core logic. The primary distinction between these releases lies in their release dates, January 30, 2015 for v3.0.1 and February 20, 2015 for v3.0.2, suggesting that v3.0.2 likely incorporates bug fixes, performance enhancements, or minor internal adjustments not explicitly detailed in its metadata. For developers, this translates to a recommendation to use the latest version (3.0.2) for the most stable and potentially optimized experience. Since their core functionality and dependencies are the same, the upgrade should be seamless. This specialized Lodash module helps reduce project size and improve loading times compared to using all the library. It's licensed under MIT.
All the vulnerabilities related to the version 3.0.2 of the package
Prototype Pollution in lodash.merge
Versions of lodash.merge before 4.6.1 are vulnerable to Prototype Pollution. The function 'merge' may allow a malicious user to modify the prototype of Object via __proto__ causing the addition or modification of an existing property that will exist on all objects.
Update to version 4.6.1 or later.
Prototype Pollution in lodash.merge
Versions of lodash.merge before 4.6.2 are vulnerable to prototype pollution. The function merge may allow a malicious user to modify the prototype of Object via {constructor: {prototype: {...}}} causing the addition or modification of an existing property that will exist on all objects.
Update to version 4.6.2 or later.
