spotify icon indicating copy to clipboard operation
spotify copied to clipboard

fix(deps): update dependency lodash to v4.17.21 [security]

Open renovate[bot] opened this issue 6 months ago • 0 comments

This PR contains the following updates:

Package Change Age Adoption Passing Confidence
lodash (source) 4.17.19 -> 4.17.21 age adoption passing confidence

GitHub Vulnerability Alerts

CVE-2021-23337

lodash versions prior to 4.17.21 are vulnerable to Command Injection via the template function.

CVE-2019-10744

Versions of lodash before 4.17.12 are vulnerable to Prototype Pollution. The function defaultsDeep allows a malicious user to modify the prototype of Object via {constructor: {prototype: {...}}} causing the addition or modification of an existing property that will exist on all objects.

Recommendation

Update to version 4.17.12 or later.


Release Notes

lodash/lodash (lodash)

v4.17.21

Compare Source

v4.17.20

Compare Source


Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Enabled.

Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.


  • [ ] If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

renovate[bot] avatar Aug 06 '24 09:08 renovate[bot]