Skip to content

Upgrade Lodash dependencies to latest#48

Closed
karlhorky wants to merge 1 commit intomailgun:masterfrom
karlhorky:master
Closed

Upgrade Lodash dependencies to latest#48
karlhorky wants to merge 1 commit intomailgun:masterfrom
karlhorky:master

Conversation

@karlhorky
Copy link
Copy Markdown

@karlhorky karlhorky commented Jul 11, 2019 •
edited
Loading

To fix high severity security issue in lodash.merge.

More info: https://snyk.io/blog/snyk-research-team-discovers-severe-prototype-pollution-security-vulnerabilities-affecting-all-versions-of-lodash/

Wasn't able to run the tests or the build locally (gave me errors), so maybe I can get some guidance whether this will break anything...

karlhorky added a commit to karlhorky/mailgun-js-suppression-notifications-poc that referenced this pull request Jul 11, 2019
@karlhorky
Add resolution for lodash.merge security issue
bd6c9c2 
Ref: lodash/lodash#4336
Ref: https://snyk.io/blog/snyk-research-team-discovers-severe-prototype-pollution-security-vulnerabilities-affecting-all-versions-of-lodash/
Ref: mailgun/mailgun.js#48
@karlhorky
Copy link
Copy Markdown
Author

karlhorky commented Jul 11, 2019

My fix in karlhorky/mailgun-js-suppression-notifications-poc@bd6c9c2 with Yarn resolutions seems to not cause problems. But I'm not using much of the mailgun.js API either...

@karlhorky
Copy link
Copy Markdown
Author

karlhorky commented Jul 11, 2019

cc @jessespears @jmontemayor @srph

@karlhorky
Copy link
Copy Markdown
Author

karlhorky commented Jul 11, 2019

The tests appear to be broken for all PRs, with peer dependency errors:

npm ERR! Linux 4.15.0-1028-gcp
npm ERR! argv "/home/travis/.nvm/versions/node/v4.1.2/bin/node" "/home/travis/.nvm/versions/node/v4.1.2/bin/npm" "install"
npm ERR! node v4.1.2
npm ERR! npm  v2.14.4
npm ERR! code EPEERINVALID
npm ERR! peerinvalid The package webpack@1.15.0 does not satisfy its siblings' peerDependencies requirements!
npm ERR! peerinvalid Peer expose-loader@0.7.5 wants webpack@^2.0.0 || ^3.0.0 || ^4.0.0
npm ERR! peerinvalid Peer webpack-dev-server@1.16.5 wants webpack@>=1.3.0 <3
npm ERR! peerinvalid Peer babel-loader@5.4.2 wants webpack@1 || 2 || ^2.1.0-beta

Also broken on my PR #47, which is a simple edit to the readme.

@mfanuzzi
Copy link
Copy Markdown

mfanuzzi commented Jul 17, 2020

Dependbot flagging this since introducing Mailgun to my project recently.

That this is still an issue a year after this ticket was opened is kinda making me question my choice to go with Mailgun TBH.

@olexandr-mazepa
Copy link
Copy Markdown
Collaborator

olexandr-mazepa commented Nov 18, 2021

It seems we don't use lodash anymore but anyway thank you for your PR.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

3 participants

@karlhorky @mfanuzzi @olexandr-mazepa