Lodash.merge is a standalone npm package that provides the _.merge method from the popular Lodash library, offering a convenient way to deeply merge objects and arrays. Comparing versions 4.1.0 and 4.1.1 highlights subtle but potentially important differences for developers relying on this utility. Both versions share the same core functionality, description, and licensing under MIT. They both depend on several internal lodash modules such as lodash._arrayeach, lodash._basefor, lodash._root, lodash._stack, lodash.isplainobject, lodash.keys, lodash.keysin and lodash.rest.
The key distinction lies in the added dependency of lodash.isbuffer in version 4.1.1. This suggests an enhancement to the merging logic to better handle Buffer objects, which are commonly used in Node.js for representing binary data. If your application deals extensively with buffers, upgrading to version 4.1.1 might provide improved merging behavior and prevent unexpected results.
Furthermore, examining the release dates reveals that version 4.1.1 was released approximately one week after version 4.1.0. Given the minor version bump (from 4.1.0 to 4.1.1), it likely addresses bug fixes, performance improvements, or specific edge cases related to object merging, potentially concerning buffer handling due to the new dependency. Although the full changelog isn't provided here, the added dependency is a crucial clue. Developers should assess whether their use case involves merging objects containing buffers and consider upgrading to benefit from the potential fixes and enhancements in the newer version.
All the vulnerabilities related to the version 4.1.1 of the package
Prototype Pollution in lodash.merge
Versions of lodash.merge before 4.6.1 are vulnerable to Prototype Pollution. The function 'merge' may allow a malicious user to modify the prototype of Object via __proto__ causing the addition or modification of an existing property that will exist on all objects.
Update to version 4.6.1 or later.
Prototype Pollution in lodash.merge
Versions of lodash.merge before 4.6.2 are vulnerable to prototype pollution. The function merge may allow a malicious user to modify the prototype of Object via {constructor: {prototype: {...}}} causing the addition or modification of an existing property that will exist on all objects.
Update to version 4.6.2 or later.
