Possible security issue with lodash.includes

[x4121]

Possible security issue with lodash.includes

I received a warning from Sonatype DepShield that retext-spell is using a vulnerable version of lodash.includes and points to this advisory.

So maybe you can check if this repo can be updated to lodash 4.17.5.

I'm not too experienced with JavaScript, but this should be possible by replacing

package.json:30
- "lodash.includes": "^4.2.0",
+ "lodash": ">= 4.17.5",

and

index.js:7
- var includes = require('lodash.includes')
+ var includes = require('lodash/includes')

Steps to reproduce

If you want to get the same report, either enable Sonatype DepShield in your GitHub account or create a new repository using retext-spell and only enable DepShield for this repository (you can limit access to single repos on setup).

[ChristianMurphy]

@x4121 pull requests are welcome

[Murderlon]

The vulnerable functions are defaultsDeep, merge, and mergeWith which allow a malicious user to modify the prototype of Object via __proto__ causing the addition or modification of an existing property that will exist on all objects.

lodash.includes in this project is not susceptible to this vulnerability. This is a non-issue.