Lodash.merge is a utility function, part of the popular Lodash library, designed for deep merging of objects. Examining versions 4.2.0 and 4.1.1 reveals subtle yet important alterations for developers. Both versions share the core functionality of deeply merging objects, handling various data types, and providing a convenient way to combine configurations or settings. They also maintain the same MIT license, author, and repository details.
The key difference lies in the dependencies. Version 4.1.1 relies on "lodash._arrayeach":"^3.0.0" while version 4.2.0 replaces it with "lodash.basefor":"^3.0.0". This suggests a refactoring in the underlying implementation of the merge logic. Developers upgrading to 4.2.0 might not immediately notice behavioral changes in typical merge scenarios, but the internal shift likely brought performance enhancements or code simplification. The shift to basefor suggests a more generalized approach in iterating properties, potentially offering broader compatibility or performance gains across different JavaScript environments.
Both versions depend on other Lodash modules like lodash._root, lodash._stack, lodash.isbuffer, lodash.isplainobject, lodash.keys, lodash.keysin, and lodash.rest, ensuring consistent behavior and compatibility with the wider Lodash ecosystem. Developers should always refer to the official Lodash documentation for comprehensive details on usage and potential edge cases, especially concerning custom object types and complex merge scenarios. The release dates also indicate that both versions were released within a very short time frame, suggesting a rapid resolution of identified issues or quick optimization.
All the vulnerabilities related to the version 4.2.0 of the package
Prototype Pollution in lodash.merge
Versions of lodash.merge before 4.6.1 are vulnerable to Prototype Pollution. The function 'merge' may allow a malicious user to modify the prototype of Object via __proto__ causing the addition or modification of an existing property that will exist on all objects.
Update to version 4.6.1 or later.
Prototype Pollution in lodash.merge
Versions of lodash.merge before 4.6.2 are vulnerable to prototype pollution. The function merge may allow a malicious user to modify the prototype of Object via {constructor: {prototype: {...}}} causing the addition or modification of an existing property that will exist on all objects.
Update to version 4.6.2 or later.
