Lodash.pick is a small, focused module providing just the _.pick functionality from the popular Lodash library. This allows developers to selectively include only the pick method in their projects, reducing overall bundle size and improving performance, especially in front-end applications. Both versions 4.3.0 and 4.4.0 offer identical core functionality, enabling users to create a new object containing only specified keys from an existing Javascript object. The primary use case is simplifying data transformations, where developers need to extract specific properties from a larger data structure without manually re-assigning each value.
The upgrade from version 4.3.0 to 4.4.0, released about three weeks later, doesn't introduce new features or API changes. The key difference lies in potential bug fixes, performance optimizations, or dependency updates within the Lodash core that trickle down to this individual module. Reviewing the detailed changelog for the broader Lodash library around that period would reveal the specifics of those changes and therefore highlight version 4.4.0's advantages. For developers already using lodash.pick, upgrading to 4.4.0 is generally recommended due to the likelihood of improvements and greater stability. New users should always opt for the latest version (4.4.0 in this case) to benefit from the most up-to-date and refined code. Each version's metadata includes the release date and tarball URL for direct download from the npm registry.
All the vulnerabilities related to the version 4.4.0 of the package
Prototype Pollution in lodash
Versions of lodash prior to 4.17.19 are vulnerable to Prototype Pollution. The functions pick, set, setWith, update, updateWith, and zipObjectDeep allow a malicious user to modify the prototype of Object if the property identifiers are user-supplied. Being affected by this issue requires manipulating objects based on user-provided property values or arrays.
This vulnerability causes the addition or modification of an existing property that will exist on all objects and may lead to Denial of Service or Code Execution under specific circumstances.
