Lodash.merge is a utility function that performs a deep merge of objects, combining properties from one or more source objects into a destination object. Lodash.merge version 4.3.4 follows closely on the heels of its predecessor, version 4.3.3. Both packages provide the same core functionality: the isolated _.merge method from the popular Lodash library, enabling developers to selectively include only the merge functionality in their projects, reducing bundle size and improving performance.
Examining the metadata, the key distinctions reside primarily in package versioning and release timing. Version 4.3.4 was released on April 3rd, 2016, a few days after version 4.3.3 which was released on March 30th, 2016. The dependency lists of both versions are identical, specifying dependencies on lodash._baseclone, lodash._stack, lodash.isplainobject, lodash.keysin, and lodash.rest, all within compatible version ranges. This suggests that the update from 4.3.3 to 4.3.4 likely contains minor bug fixes, performance enhancements, or documentation updates, rather than significant feature additions or breaking changes. Developers should consult the Lodash changelog or commit history for detailed specifics on the changes between these two versions. For the average developer, upgrading from 4.3.3 to 4.3.4 is likely a low-risk operation, offering potential improvements without requiring major code modifications.
All the vulnerabilities related to the version 4.3.4 of the package
Prototype Pollution in lodash.merge
Versions of lodash.merge before 4.6.1 are vulnerable to Prototype Pollution. The function 'merge' may allow a malicious user to modify the prototype of Object via __proto__ causing the addition or modification of an existing property that will exist on all objects.
Update to version 4.6.1 or later.
Prototype Pollution in lodash.merge
Versions of lodash.merge before 4.6.2 are vulnerable to prototype pollution. The function merge may allow a malicious user to modify the prototype of Object via {constructor: {prototype: {...}}} causing the addition or modification of an existing property that will exist on all objects.
Update to version 4.6.2 or later.
