Dependency lodash.set has an unpatched CVE - Githubissues

Nikaple / nest-typed-config

Intuitive, type-safe configuration module for Nest framework ✨

MIT License

207 stars 25 forks source link

Dependency lodash.set has an unpatched CVE #492

Closed shprota closed 1 year ago

shprota commented 1 year ago

I'm submitting a...

[X] Regression
[ ] Bug report
[ ] Feature request
[ ] Documentation issue or request
[X] Support request

Current behavior

The lodash.set package has an open CVE: https://security.snyk.io/vuln/SNYK-JS-LODASHSET-1320032. The maintainer of Lodash will not release a patched version, and he considers the per-method packages https://github.com/lodash/lodash/issues/3793#issuecomment-389774153.

We should be able to use set-value as a drop-in replacement.

Nikaple commented 1 year ago

closed by #493