[Snyk] Security upgrade lodash from 4.17.10 to 4.17.23#223
[Snyk] Security upgrade lodash from 4.17.10 to 4.17.23#223ethanresnick wants to merge 1 commit intomasterfrom
Conversation
The following vulnerabilities are fixed with an upgrade: - https://snyk.io/vuln/SNYK-JS-LODASH-15053838
There was a problem hiding this comment.
Pull request overview
This PR upgrades the lodash dependency to address a medium-severity Prototype Pollution vulnerability (SNYK-JS-LODASH-15053838). The change updates lodash from ^4.17.17 to ^4.17.23 in package.json, though the PR description indicates the actual installed version is 4.17.10. The PR includes a warning that package-lock.json failed to update automatically and requires manual intervention before merging.
Changes:
- Upgrade lodash version from ^4.17.17 to ^4.17.23 to fix security vulnerability
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| "flat": "^1.2.1", | ||
| "immutable": "^3.8.2", | ||
| "lodash": "^4.17.17", | ||
| "lodash": "^4.17.23", |
There was a problem hiding this comment.
There's a discrepancy between the PR description and the actual code changes. The PR description states this upgrades lodash from version 4.17.10 to 4.17.23, but the diff shows the change is from ^4.17.17 to ^4.17.23. The package-lock.json file confirms that version 4.17.10 is currently installed. This suggests that either the package.json was previously updated without updating package-lock.json, or there's an inconsistency in the repository state. While this doesn't affect the security fix itself, it should be verified that the actual installed version will be upgraded from 4.17.10 to 4.17.23 when package-lock.json is updated.
2 participants
Snyk has created this PR to fix 1 vulnerabilities in the npm dependencies of this project.
Snyk changed the following file(s):
package.jsonVulnerabilities that will be fixed with an upgrade:
SNYK-JS-LODASH-15053838
Important
Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.
For more information:
🧐 View latest project report
📜 Customise PR templates
🛠 Adjust project settings
📚 Read about Snyk's upgrade logic
Learn how to fix vulnerabilities with free interactive lessons:
🦉 Prototype Pollution