search

sudo-suhas / elastic-builder

A Node.js implementation of the elasticsearch Query DSL :construction_worker:
https://elastic-builder.js.org
MIT License
508 stars 75 forks source link

Vulnerability in old lodash dependencies. #199

Open vijaykerure opened 6 months ago

vijaykerure commented 6 months ago

I am using the most recent version of Elastic Builder, and following a vulnerability scan, we discovered a couple Lodash modules with critical vulnerabilities.

Vulnerable versions:

  1. lodash.head: 4.0.1
  2. lodash.isstring: 4.0.1

vulnerability

sudo-suhas commented 6 months ago

There is no newer version - https://www.npmjs.com/package/lodash.head, https://www.npmjs.com/package/lodash.isstring

PR to eliminate use of those packages is welcome.