casesandberg / casesandberg/react-color
Update lodash dependency (see CVE-2020-8203)
Open
- Dominant language
- JavaScript
- Stars
- 12.3k
- Forks
- 920
- PR merge metrics
- No merged PRs in 30d
Description
Current used version is 4.17.15.
Please refer to https://nvd.nist.gov/vuln/detail/CVE-2020-8203 and consider update to 4.17.20 (latest).
Contributor guide
Research direction
Start with the CVE-2020-8203 advisory and inspect where this repository declares lodash. Done means updating the dependency from 4.17.15 to 4.17.20 and confirming the project remains functional.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- javascript
- Domain
- security
- Issue type
- Bug
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100