Lodash.merge, a modularized version of the popular _.merge function from the Lodash library, provides a deep merge utility for JavaScript objects. Comparing versions 3.2.0 and 3.1.0 reveals subtle, yet potentially impactful, differences for developers. Both versions share the same core goal: to deeply merge properties from source objects into a destination object, handling nested objects and arrays effectively. They maintain identical descriptions, licenses (MIT), repository information, and author details, ensuring continuity and provenance. Crucially, both versions rely on a suite of Lodash internal helper modules like lodash._arraycopy, lodash._arrayeach, lodash.isarray, and crucially, lodash.toplainobject, guaranteeing consistent internal operations.
The significant difference lies in the dependency list. Version 3.1.0 relies on lodash._basefor, while version 3.2.0 replaces this dependency with direct dependency on lodash._arrayeach. This change suggests potential internal refactoring related in how object properties are iterated through during the merge process, possibly aiming for improved performance or code clarity. While the end result of merging objects remains the same, developers might see minor variations in how quickly large or complex objects are merged. Also the release date differ of around 3 weeks, the 3.2.0 version being released on April 16, 2015, against the March 25 release date of version 3.1.0.
All the vulnerabilities related to the version 3.2.0 of the package
Prototype Pollution in lodash.merge
Versions of lodash.merge before 4.6.1 are vulnerable to Prototype Pollution. The function 'merge' may allow a malicious user to modify the prototype of Object via __proto__ causing the addition or modification of an existing property that will exist on all objects.
Update to version 4.6.1 or later.
Prototype Pollution in lodash.merge
Versions of lodash.merge before 4.6.2 are vulnerable to prototype pollution. The function merge may allow a malicious user to modify the prototype of Object via {constructor: {prototype: {...}}} causing the addition or modification of an existing property that will exist on all objects.
Update to version 4.6.2 or later.
