Lodash.merge is a utility library offering the _.merge method as a standalone module, designed for deeply merging JavaScript objects. Comparing versions 4.0.3 and 4.0.4, developers will find predominantly similar functionalities focusing on robust object merging capabilities. Both versions share identical dependencies like lodash.\_arrayeach, lodash.\_basefor, lodash.\_stack, lodash.isplainobject, lodash.keys, lodash.keysin, and lodash.rest suggesting a consistent core functionality for the deep merge operation.
The key difference lies in the release date: version 4.0.4 was released on February 3, 2016, while version 4.0.3 was released on January 30, 2016. This small gap usually indicates bug fixes, performance improvements or minor adjustments rather than significant feature additions.
For developers, choosing Lodash.merge provides a reliable solution for complex object merging scenarios where simple assignment might fail. The consistent dependency list and functionality between these versions should provide confidence in stability. While the specific changes between 4.0.3 and 4.0.4 are not detailed in the provided data, upgrading to 4.0.4 is generally recommended to benefit from any potential bug fixes or performance enhancements made during that short period. Consider consulting the Lodash changelog for specific details about the changes incorporated in version 4.0.4. This package is released under the MIT license which allow a wide range of usages.
All the vulnerabilities related to the version 4.0.4 of the package
Prototype Pollution in lodash.merge
Versions of lodash.merge before 4.6.1 are vulnerable to Prototype Pollution. The function 'merge' may allow a malicious user to modify the prototype of Object via __proto__ causing the addition or modification of an existing property that will exist on all objects.
Update to version 4.6.1 or later.
Prototype Pollution in lodash.merge
Versions of lodash.merge before 4.6.2 are vulnerable to prototype pollution. The function merge may allow a malicious user to modify the prototype of Object via {constructor: {prototype: {...}}} causing the addition or modification of an existing property that will exist on all objects.
Update to version 4.6.2 or later.
