search

ztoben / assets-webpack-plugin

Webpack plugin that emits a json file with assets paths
https://www.npmjs.com/package/assets-webpack-plugin
MIT License
958 stars 104 forks source link

Critical vulnerabilities in lodash #459

Open teepe-ABN opened 9 months ago

teepe-ABN commented 9 months ago

Describe the bug Importing the entirety of lodash triggers security tooling such as sonatype, see e.g. critical vulnerability sonatype-2019-0467.

To Reproduce Use assets-webpack-plugin

Expected behavior Only the parts of lodash that are actually used are included in the package.json

Webpack Config

Desktop (please complete the following information):