Upgrade lodash and resolve some CVEs - Githubissues

infinitered / gluegun

A delightful toolkit for building TypeScript-powered command-line apps.

MIT License

2.93k stars 147 forks source link

Upgrade lodash and resolve some CVEs #788

Closed andyasberry closed 6 months ago

andyasberry commented 8 months ago

Love this project! ❤️ Appreciate all the work that has went into this! 🙏

The reason for suggesting this change is in our project, we have a couple of "moderate" level CVEs in our project (from lodash.trim and lodash.trimEnd, dependencies of gluegun).

Some potential benefits/thoughts:

It seems that the individual lodash packages are not receiving new updates (trimEnd last published 7 years ago)
This change should make upgrading lodash easier
If package size increase with the full lodash package is a concern, maybe use esbuild for shaking out unused lodash functions?

Hoping this helps! If not, we can close it 👍

Screenshot 2023-10-24 at 2 47 43 PM

Screenshot 2023-10-24 at 2 48 06 PM

andyasberry commented 6 months ago

Closing this as stale. Please reopen if there is any interest and possibility for traction.