Lodash.merge is a utility library focused on providing just the _.merge method from the popular Lodash library. This allows developers to include only the merge functionality in their projects, reducing the overall bundle size. Comparing versions 4.4.0 and 4.3.5, we see incremental improvements and dependency adjustments.
Both versions share the same core description, license (MIT), repository, and author, indicating a continuous development process. They both rely on lodash._baseclone, lodash.isplainobject, lodash.keysin and lodash.rest, ensuring consistent behavior for cloning, plain object validation, key enumeration and rest parameter handling.
The key difference lies in the internal dependencies. Version 4.4.0 replaces the dependency on lodash._stack (version ~4.1.0) present in 4.3.5 with lodash._root (version ~3.0.0). This suggest a potential refactoring towards a different strategy for managing the merging process internally, possibly related to stack management or root context awareness. While the public API remains the same, this internal change might affect performance or memory usage in specific edge cases, although the developers likely optimized for general use cases. The update to lodash._root also indicates a potential attempt to stay aligned with the latest lodash standards and internal APIs.
For developers, upgrading to 4.4.0 should be straightforward, because the core behavior is not impacted. However, it's always recommended to run integration tests to catch any unforeseen consequences related to the internal dependency change, especially if the application utilizes lodash.merge in complex scenarios.
All the vulnerabilities related to the version 4.4.0 of the package
Prototype Pollution in lodash.merge
Versions of lodash.merge before 4.6.1 are vulnerable to Prototype Pollution. The function 'merge' may allow a malicious user to modify the prototype of Object via __proto__ causing the addition or modification of an existing property that will exist on all objects.
Update to version 4.6.1 or later.
Prototype Pollution in lodash.merge
Versions of lodash.merge before 4.6.2 are vulnerable to prototype pollution. The function merge may allow a malicious user to modify the prototype of Object via {constructor: {prototype: {...}}} causing the addition or modification of an existing property that will exist on all objects.
Update to version 4.6.2 or later.
