Lodash.merge is a utility in the Lodash library specifically designed for deeply merging objects. Version 3.1.0 and 3.0.3 represent incremental updates to this module, offering developers a refined approach to object merging. One key difference between version 3.1.0 and the prior 3.0.3 lies within their dependencies. Version 3.1.0 introduces lodash.isnative and lodash.keysin as dependencies, elements not present in 3.0.3. lodash.isnative likely enhances the robustness of the merging process by allowing the function to detect and handle native JavaScript objects and functions differently, while lodash.keysin probably expands the range of properties considered during the merge by including inherited properties in the object traversal. This improvement can be crucial when dealing with complex object hierarchies and inheritance patterns.
Both versions share core dependencies which ensures backward compatibility for most use cases but the addition of lodash.keysin and lodash.isnative makes 3.1.0 a more comprehensive and robust solution, particularly beneficial in scenarios where deep inheritance chains and interactions with native JavaScript objects are prevalent. For developers, upgrading to 3.1.0 offers a more refined and complete merging utility, potentially resolving edge cases related to native objects or inherited properties that might occur using version 3.0.3. The MIT` license and the active repository on GitHub assure developers of a well-maintained and reliable utility.
All the vulnerabilities related to the version 3.1.0 of the package
Prototype Pollution in lodash.merge
Versions of lodash.merge before 4.6.1 are vulnerable to Prototype Pollution. The function 'merge' may allow a malicious user to modify the prototype of Object via __proto__ causing the addition or modification of an existing property that will exist on all objects.
Update to version 4.6.1 or later.
Prototype Pollution in lodash.merge
Versions of lodash.merge before 4.6.2 are vulnerable to prototype pollution. The function merge may allow a malicious user to modify the prototype of Object via {constructor: {prototype: {...}}} causing the addition or modification of an existing property that will exist on all objects.
Update to version 4.6.2 or later.
