Lodash security issue

[hkernbach]

Lodash dependency needs to be raised, see:

High:

┌───────────────┬──────────────────────────────────────────────────────────────┐
│ High          │ Prototype Pollution                                          │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Package       │ lodash                                                       │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Patched in    │ >=4.17.11                                                    │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Dependency of │ grunt-processhtml [dev]                                      │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Path          │ grunt-processhtml > htmlprocessor > lodash                   │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ More info     │ https://npmjs.com/advisories/782                             │
└───────────────┴──────────────────────────────────────────────────────────────┘

┌───────────────┬──────────────────────────────────────────────────────────────┐
│ High          │ Prototype Pollution                                          │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Package       │ lodash                                                       │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Patched in    │ >=4.17.12                                                    │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Dependency of │ grunt-processhtml [dev]                                      │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Path          │ grunt-processhtml > htmlprocessor > lodash                   │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ More info     │ https://npmjs.com/advisories/1065                            │
└───────────────┴──────────────────────────────────────────────────────────────┘

Low:

┌───────────────┬──────────────────────────────────────────────────────────────┐
│ Low           │ Prototype Pollution                                          │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Package       │ lodash                                                       │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Patched in    │ >=4.17.5                                                     │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Dependency of │ grunt-processhtml [dev]                                      │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Path          │ grunt-processhtml > htmlprocessor > lodash                   │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ More info     │ https://npmjs.com/advisories/577                             │
└───────────────┴──────────────────────────────────────────────────────────────┘

[june07]

@dciccale Any chance we can get someone to accept #122...
Is this still supported? If not... a replacement recommended? Thanks.

[june07]

@dciccale Any chance we can get someone to accept #122...
Is this still supported? If not... a replacement recommended? Thanks.

@marcobiedermann ...

[marcobiedermann]

@june07

I'm sorry but I am not a maintainer of this project and therefore can not approve the changes.
In general, the update looks good to me.

I guess @dciccale can help out

[dciccale]

#122 has been merged.

[parasyte]

A new vulnerability was patched with #124

  High            Command Injection
  Package         lodash
  Patched in      >=4.17.21
  Dependency of   grunt-processhtml [dev]
  Path            grunt-processhtml > htmlprocessor > lodash
  More info       https://npmjs.com/advisories/1673