Lodash.merge is a utility function, part of the popular Lodash library, designed for deeply merging objects. Versions 4.3.0 and 4.3.1 offer similar core functionality. Lodash, renowned for its performance and reliability, provides this method as a standalone module, optimizing application size by enabling developers to include only the specific functions they require rather than the entire library. Examining the metadata, both versions, released within a week of each other in February 2016, share identical dependencies: lodash._baseclone, lodash._stack, lodash.isplainobject, lodash.keysin, and lodash.rest, all constrained to the ^4.0.0 range. This suggests that the changes introduced between versions are unlikely to revolve around significant architectural modifications or dependency upgrades. The primary difference lies in the release date, indicating a potential patch or bug fix introduced in version 4.3.1. For developers, this means that while the core merge logic remains consistent, version 4.3.1 likely addresses a specific issue encountered in 4.3.0. While the exact nature of the fix isn't explicitly documented here, upgrading to the newer version is generally recommended to benefit from the stability improvements. Considering the small version bump it's advisable to upgrade to the latest patch version for reliability even though it does not contain new features. It offers the same core functionality as v4.3.0 but potentially with improved stability and bug fixes that improve the developer experience.
All the vulnerabilities related to the version 4.3.1 of the package
Prototype Pollution in lodash.merge
Versions of lodash.merge
before 4.6.1 are vulnerable to Prototype Pollution. The function 'merge' may allow a malicious user to modify the prototype of Object
via __proto__
causing the addition or modification of an existing property that will exist on all objects.
Update to version 4.6.1 or later.
Prototype Pollution in lodash.merge
Versions of lodash.merge
before 4.6.2 are vulnerable to prototype pollution. The function merge
may allow a malicious user to modify the prototype of Object
via {constructor: {prototype: {...}}}
causing the addition or modification of an existing property that will exist on all objects.
Update to version 4.6.2 or later.