Lodash.merge is a utility library providing the _.merge function from the popular Lodash library as a standalone module. This allows developers to selectively use only the merge functionality, reducing bundle size and improving application performance compared to including the entire Lodash library. Versions 4.3.2 and 4.3.3 offer similar core functionality – deeply merging properties of source objects into a destination object.
However, notable differences exist in their dependencies. Version 4.3.2 relies on specific ^4.0.0 versions of its internal Lodash dependencies like lodash._baseclone, lodash._stack, lodash.isplainobject, lodash.keysin, and lodash.rest. This rigid dependency declaration might lead to conflicts if your project requires different minor or patch versions of those internal Lodash components.
Version 4.3.3 relaxes dependency constraints for lodash._baseclone to ~4.5.0 and lodash._stack to ~4.1.0. The tilde (~) operator allows for compatible updates within the same minor version, offering greater flexibility and reducing the likelihood of dependency conflicts. This seemingly small change is significant because it increases the library's compatibility with other Lodash-dependent packages in your project. Developers should upgrade to 4.3.3 to benefit from these dependency adjustments, ensuring a smoother integration experience and minimizing potential versioning issues. Both versions are licensed under the MIT license, making them suitable for a wide range of projects.
All the vulnerabilities related to the version 4.3.3 of the package
Prototype Pollution in lodash.merge
Versions of lodash.merge before 4.6.1 are vulnerable to Prototype Pollution. The function 'merge' may allow a malicious user to modify the prototype of Object via __proto__ causing the addition or modification of an existing property that will exist on all objects.
Update to version 4.6.1 or later.
Prototype Pollution in lodash.merge
Versions of lodash.merge before 4.6.2 are vulnerable to prototype pollution. The function merge may allow a malicious user to modify the prototype of Object via {constructor: {prototype: {...}}} causing the addition or modification of an existing property that will exist on all objects.
Update to version 4.6.2 or later.
