search

CirclonGroup / angular-tree-component

A simple yet powerful tree component for Angular (>=2)
https://angular2-tree.readme.io/docs
MIT License
1.1k stars 492 forks source link

NVD CVE-2020-8203 (BDSA-2020-1674) Issue with lodash-es 4.17.15 #862

Closed somuda86 closed 3 years ago

somuda86 commented 4 years ago

Please upgrade to lodash-es 4.17.20

https://www.openhub.net/p/616506

somuda86 commented 4 years ago

@tobiasengelhardt This is a high priority security issue. Please comment. angular tree component is using vulnerable lodash version. Thanks

tobiasengelhardt commented 4 years ago

@somuda86 It's sadly not an easy update. There is no lodash-es 4.17.20, we are using the most recent version. They seem to have issues publishing a new version. I hope they fix this soon.

matiassantos commented 3 years ago

What a pity., this issue will prevent the usage of this component in production environments until lodash fixes the issue. Do you have an estimate of the work needed to fix this project when the lodash version is updated to 4.17.20? any known breaking functionalities?

tobiasengelhardt commented 3 years ago

Looking at the changelog of lodash they did only bugfixes. If they finally publish 4.17.20 it should be just a simple package update.

tobiasengelhardt commented 3 years ago

Because there seems to be no real progress regarding the release of a new lodash version we started looking into removing lodash as a dependency. The pr/remove-lodash branch has lodash removed and all our build tests are passing (feel we to look, leave feedback and input). This is still a bigger change so we will do some more testing to see if it everything is working correctly. Hopefully there will be a new version released within the next two weeks. If lodash release a new version before we are done testing there will of course be a new version with the updated lodash version asap.

matiassantos commented 3 years ago

Sure! i'd be glad to help

somuda86 commented 3 years ago

@tobiasengelhardt 4.17.20.has been released. But my 2 cents on removing that dependency

tobiasengelhardt commented 3 years ago

Fix is released in 10.0.2. We will continue working on removing lodash.