bodybuilder
bodybuilder copied to clipboard
Dependency lodash.set has Prototype Pollution vulnerability
https://security.snyk.io/vuln/SNYK-JS-LODASHSET-1320032
I advise replacing that dependency.
There is no fixed version for lodash.set.
We use lodash.set in several places in the code. Do you have any suggested alternatives by chance?
I just learned about https://www.npmjs.com/package/wild-wild-path, perhaps this has too much functionality. Or lodash itself and depend on tree shaking to only package used functions.
Hi. I opened a pull request for this matter. Please consider checking it out. It's a simple change. https://github.com/danpaz/bodybuilder/pull/309
Hello, I also opened a pull request for this issue. #315 . It would be great if you could have a look.
Thanks for solving this @StefOodle. Could we get a version with the fix published onto npm please @danpaz?
Yes just published as 2.5.1. This reminded me publishing from Travis CI is still broken https://github.com/danpaz/bodybuilder/issues/297 😞