Lodash.merge version 3.0.3 represents a minor update over its predecessor, version 3.0.2, in the popular lodash library. Both versions provide the modern build of the _.merge function as a standalone module, offering developers a convenient way to incorporate this powerful object merging utility into their projects without requiring the entire lodash library. Each version is equipped with an identical set of dependencies, including lodash utilities like _arraycopy, _arrayeach, _basefor, _createassigner, isarguments, isarray, isplainobject, istypedarray, keys, and toplainobject, ensuring consistent behavior. The primary difference lies in the release date, with version 3.0.3 being published on March 9, 2015, while version 3.0.2 was released on February 20, 2015. This suggests that version 3.0.3 likely includes bug fixes, minor performance improvements, or internal refinements made in the intervening period. Developers who need a robust and well-tested object merging solution will appreciate the lodash.merge module. Choosing between these versions likely depends on the need for the newest adjustments. Ensure the specific changelog is consulted, if crucial fixes were implemented. Otherwise, both offer similar functionality for merging JavaScript objects, simplifying complex data manipulation tasks. Lodash.merge is lightweight, modular, and MIT licensed, making it a flexible and developer-friendly choice.
All the vulnerabilities related to the version 3.0.3 of the package
Prototype Pollution in lodash.merge
Versions of lodash.merge before 4.6.1 are vulnerable to Prototype Pollution. The function 'merge' may allow a malicious user to modify the prototype of Object via __proto__ causing the addition or modification of an existing property that will exist on all objects.
Update to version 4.6.1 or later.
Prototype Pollution in lodash.merge
Versions of lodash.merge before 4.6.2 are vulnerable to prototype pollution. The function merge may allow a malicious user to modify the prototype of Object via {constructor: {prototype: {...}}} causing the addition or modification of an existing property that will exist on all objects.
Update to version 4.6.2 or later.
