Lodash.merge is a versatile JavaScript utility, part of the popular Lodash library, designed for deeply merging objects and their properties. Versions 3.3.1 and 3.3.2, while seemingly close, offer distinct release points for developers seeking reliable object merging capabilities. Both versions maintain the core functionality of deeply merging objects, handling nested structures, and resolving conflicts by prioritizing properties from source objects. They depend on a suite of internal Lodash modules ensuring consistent behavior across different JavaScript environments, including modules for array handling, object type checking, and native function retrieval.
The key difference resides in the release date and potential bug fixes or minor performance improvements incorporated in version 3.3.2. Released in late June 2015, version 3.3.2 likely addresses issues identified in the earlier 3.3.1 version from late May 2015. For developers, this means opting for version 3.3.2 offers the advantage of a potentially more stable and refined merging process.
If you're starting a new project, version 3.3.2 is typically the preferred choice. Existing projects using 3.3.1 should evaluate the changelog (if available) or test suite results to determine if upgrading to 3.3.2 provides meaningful benefits or resolves known issues encountered in their specific use cases. Lodash.merge, in either version, provides a robust solution for complex object manipulation, saving developers significant time and effort compared to writing custom merging logic. Both versions are distributed under the MIT license.
All the vulnerabilities related to the version 3.3.2 of the package
Prototype Pollution in lodash.merge
Versions of lodash.merge before 4.6.1 are vulnerable to Prototype Pollution. The function 'merge' may allow a malicious user to modify the prototype of Object via __proto__ causing the addition or modification of an existing property that will exist on all objects.
Update to version 4.6.1 or later.
Prototype Pollution in lodash.merge
Versions of lodash.merge before 4.6.2 are vulnerable to prototype pollution. The function merge may allow a malicious user to modify the prototype of Object via {constructor: {prototype: {...}}} causing the addition or modification of an existing property that will exist on all objects.
Update to version 4.6.2 or later.
