JsCommunity / JsCommunity/jsonrpc-websocket-client
Please help bum lodash to 4.17.21 and upgrade the package version
Nobody has claimed this yet.
- Dominant language
- JavaScript
- Stars
- 6
- Forks
- 1
- PR merge metrics
- No merged PRs in 30d
Description
Hi,
We detect two alerts from our product as below. Could you please help us complete the changes to upgrade lodash to 4.17.21 for these packages jsonrpc-websocket-client json-rpc-peer and bump their versions in npm too?
Thanks,
Yvonne
Alert 1
Versions of lodash before 4.17.5 are vulnerable to prototype pollution.
The vulnerable functions are 'defaultsDeep', 'merge', and 'mergeWith' which allow a malicious user to modify the prototype of Object via {constructor: {prototype: {...}}} causing the addition or modification of an existing property that will exist on all objects.
Alert 2
Lodash versions prior to 4.17.21 are vulnerable to Command Injection via the template function.
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by locating the package manifests and dependency declarations for jsonrpc-websocket-client and json-rpc-peer. Update the lodash dependency to 4.17.21, determine the intended package-version bumps, and verify the resulting package metadata before publishing the updated npm versions.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- javascript
- Domain
- api
- Issue type
- Bug
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 45/100