Lodash.merge is a utility library designed to deeply merge JavaScript objects and arrays. Version 4.0.2 arrived on January 26, 2016, succeeding version 4.0.1 which was released on January 13, 2016. Both versions share identical core functionality, providing a specialized implementation of the _.merge method extracted directly from the popular Lodash library. This allows developers to import and utilize the merge functionality without incorporating the entire Lodash package, reducing bundle size and improving performance for focused use cases.
The key components powering lodash.merge remain consistent between versions 4.0.1 and 4.0.2. Dependencies such as lodash._arrayeach, lodash._basefor, lodash._stack, lodash.isplainobject, lodash.keys, lodash.keysin, and lodash.rest are all present with equivalent version constraints, using the ^4.0.0 or ^3.0.0 ranges assuring they're compatible with existing code.
While the core functionality and dependencies appear consistent, the update between versions 4.0.1 and 4.0.2 likely contains bug fixes, performance enhancements, or minor internal adjustments that aren't explicitly reflected in the metadata. Though subtle, these changes assure enhanced stability. Developers should always favor the latest stable release to benefit from accumulative fixes in previous builds. The library is distributed under the MIT license, providing flexibility for integration into various projects. It can be easily installed via npm, and the source code is available on GitHub, enabling community contributions and transparency.
All the vulnerabilities related to the version 4.0.2 of the package
Prototype Pollution in lodash.merge
Versions of lodash.merge before 4.6.1 are vulnerable to Prototype Pollution. The function 'merge' may allow a malicious user to modify the prototype of Object via __proto__ causing the addition or modification of an existing property that will exist on all objects.
Update to version 4.6.1 or later.
Prototype Pollution in lodash.merge
Versions of lodash.merge before 4.6.2 are vulnerable to prototype pollution. The function merge may allow a malicious user to modify the prototype of Object via {constructor: {prototype: {...}}} causing the addition or modification of an existing property that will exist on all objects.
Update to version 4.6.2 or later.
