Lodash.merge 4.5.0 and 4.4.0 are both modules exporting the _.merge method from the popular Lodash library, designed to deeply merge objects and their properties. Both versions share the same MIT license, author, and repository on GitHub, ensuring consistent maintenance and open-source accessibility. The primary distinction lies in their release dates and underlying dependencies. Version 4.5.0 was released on July 25, 2016, succeeding version 4.4.0 which was released on May 12, 2016. While version 4.5.0 offers direct access to the packaged method via a tarball distribution, version 4.4.0 details its dependencies, showcasing the internal Lodash modules it relies on. These include lodash._baseclone, lodash._root, lodash.isplainobject, lodash.keysin, and lodash.rest, each with specific version constraints. Developers utilizing version 4.4.0 can gain insight into the modular structure and pinpoint potential compatibility nuances related to these dependent modules. The jump to 4.5.0 likely incorporates dependency updates and potentially bug fixes or performance improvements within the core _.merge logic, without explicitly outlining the changes. For developers, choosing between the versions depends on their needs. Version 4.5.0 offers a straightforward import and usage experience, while version 4.4.0 exposes granular dependencies, allowing for finer-grained control and dependency management within a project. Checking the changelog of the main lodash library is adviced to understand the detailed differences between the versions.
All the vulnerabilities related to the version 4.5.0 of the package
Prototype Pollution in lodash.merge
Versions of lodash.merge before 4.6.1 are vulnerable to Prototype Pollution. The function 'merge' may allow a malicious user to modify the prototype of Object via __proto__ causing the addition or modification of an existing property that will exist on all objects.
Update to version 4.6.1 or later.
Prototype Pollution in lodash.merge
Versions of lodash.merge before 4.6.2 are vulnerable to prototype pollution. The function merge may allow a malicious user to modify the prototype of Object via {constructor: {prototype: {...}}} causing the addition or modification of an existing property that will exist on all objects.
Update to version 4.6.2 or later.
