NPM Audit Report Vulnerability due to lodash.setwith

[andreisaikouski]

As per title, npm audit report provides:

lodash.setwith  *
Severity: high
Prototype Pollution in lodash - https://github.com/advisories/GHSA-p6mc-m468-83gw
fix available via `npm audit fix --force`
Will install [email protected], which is a breaking change
node_modules/lodash.setwith
  api  >=5.0.0-beta.0
  Depends on vulnerable versions of lodash.setwith
  node_modules/api

[brickfungus]

I was able to get around it with this lodash/lodash#5809 (comment)
but a fix here would be nice

[andreisaikouski]

@brickfungus thanks for the recommend. Yeah I did the same, but wanted to raise an issue here as I saw one doesn't exist

[jdleesmiller]

Thank you for merging the PR. Will there be a new release soon that includes the change?

[erunion]

Hi, sorry for the delay on this one but I've just published v7.0.0-beta.6 to our next channel.

[lpgera]

Hey! I totally understand that releasing a stable v7 may take a lot of time, so is there any chance for backporting this security patch and releasing it as v6.1.2? I'd be happy to create a PR if there's support for this and someone creates a v6 branch at e440a28 to serve as a base for it.

[erunion]

Apologies for dragging ass on this, I've just backported the lodash.<package> -> lodash package migrations that happened #859 down to our v6 series with a new v6.1.2 release on NPM.

v6.1.1...v6.1.2

[lpgera]

Much appreciated!