search

panva / openid-client

OAuth 2 / OpenID Connect Client API for JavaScript Runtimes
MIT License
1.83k stars 392 forks source link

Consider stopping using `lodash`? #272

Closed s100 closed 4 years ago

s100 commented 4 years ago

There is a prototype pollution vulnerability in lodash, which lodash's maintainers seem not to be acting on. My suggestion is that moving away from lodash entirely might be an expedient way to resolve this.

Related, previously: #5, #171

panva commented 4 years ago

openid-client does not utilize the method in question and is therefore not affected. Nevertheless, removing lodash is something I’d support driving a PR forward for if you’re offering putting the time into it.