spotify
spotify copied to clipboard
fix(deps): update dependency lodash to v4.17.21 [security]
This PR contains the following updates:
Package | Change | Age | Adoption | Passing | Confidence |
---|---|---|---|---|---|
lodash (source) | 4.17.19 -> 4.17.21 |
GitHub Vulnerability Alerts
CVE-2021-23337
lodash
versions prior to 4.17.21 are vulnerable to Command Injection via the template function.
CVE-2019-10744
Versions of lodash
before 4.17.12 are vulnerable to Prototype Pollution. The function defaultsDeep
allows a malicious user to modify the prototype of Object
via {constructor: {prototype: {...}}}
causing the addition or modification of an existing property that will exist on all objects.
Recommendation
Update to version 4.17.12 or later.
Release Notes
Configuration
📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).
🚦 Automerge: Enabled.
♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
- [ ] If you want to rebase/retry this PR, check this box
This PR was generated by Mend Renovate. View the repository job log.