Remove lodash - Githubissues

Howdju / howdju

Monorepo for the Howdju crowdsourced fact checking and summarization platform

https://www.howdju.com

GNU Affero General Public License v3.0

5 stars 2 forks source link

Remove lodash #674

Open carlgieringer opened 5 months ago

carlgieringer commented 5 months ago

A version was last published in 2021. It is causing a critical vulnerability in our repo (link).

The repo has multiple unanswered issues relating to security/versioning:

https://github.com/lodash/lodash/issues/5832 (security vulnerabilities)
https://github.com/lodash/lodash/issues/5820 (no release in a long time)
https://github.com/lodash/lodash/issues/5781 (security vulnerability; false positive?)
https://github.com/lodash/lodash/issues/5780 (5 year old bug still in PR)

It should be possible to replace much of lodash's functionality with ECMAScript:

https://github.com/you-dont-need/You-Dont-Need-Lodash-Underscore