Lodash.merge is a utility package providing the _.merge method from the popular Lodash library as a standalone module. Version 4.3.0 builds upon version 4.2.0 with some subtle but important changes that developers should be aware of.
One key aspect differentiating the two versions lies in their dependencies. Version 4.3.0 replaces lodash._basefor, lodash._root, and lodash.isbuffer with lodash._baseclone. This switch suggests a potential shift in the internal implementation of the merge logic, possibly aiming for improved performance, reduced code size, or enhanced cloning capabilities within the merging process. The removal of lodash.isbuffer could signify a reduced scope in terms of handling buffer objects during merging, so developers who rely on merging objects containing buffers should check for compatibility.
Both versions share key dependencies like lodash._stack, lodash.isplainobject, lodash.keysin, and lodash.rest, indicating that the core functionality and approach to handling objects, keys, and function arguments remain consistent. Developers upgrading from 4.2.0 to 4.3.0 should investigate the implications of the dependency changes, particularly regarding how objects containing buffers are handled during the merging process. Lodash.merge continues to be released under the MIT license, making it a versatile choice for diverse projects. The package, authored by John-David Dalton, offers a reliable solution for deeply merging JavaScript objects, a common task in software development.
All the vulnerabilities related to the version 4.3.0 of the package
Prototype Pollution in lodash.merge
Versions of lodash.merge before 4.6.1 are vulnerable to Prototype Pollution. The function 'merge' may allow a malicious user to modify the prototype of Object via __proto__ causing the addition or modification of an existing property that will exist on all objects.
Update to version 4.6.1 or later.
Prototype Pollution in lodash.merge
Versions of lodash.merge before 4.6.2 are vulnerable to prototype pollution. The function merge may allow a malicious user to modify the prototype of Object via {constructor: {prototype: {...}}} causing the addition or modification of an existing property that will exist on all objects.
Update to version 4.6.2 or later.
