javascriptchimurai/http-proxy-middleware #452Not a task: already works

Lodash dependency causes prototype pollution issue: can you use another package instead of lodash?

envgap__chimurai__http-proxy-middleware-452

Original GitHub issue ↗Dated source checkout ↗Opened 2020-07-02

01 / FAILURE SIGNATURE

As reported upstream

No identifying execution failure has been captured.

Not a benchmark task.

The project already builds and runs before the fix, so there is nothing to repair.

02 / ENVIRONMENT RECIPE

Base commit: 5b99f5a65e6c87f1e6817628f668557ca9468eee
Manifest: package.json
Reproduce: Awaiting issue-specific recipe
Run under trace: Awaiting a meaningful runtime command

03 / ORIGINAL ISSUE TEXT

chimurai/http-proxy-middleware #452 · read the original issue

┌───────────────┬──────────────────────────────────────────────────────────────┐

│ Low           │ Prototype Pollution                                          │

├───────────────┼──────────────────────────────────────────────────────────────┤

│ Package       │ lodash                                                       │

├───────────────┼──────────────────────────────────────────────────────────────┤

│ Patched in    │ No patch available                                           │

├───────────────┼──────────────────────────────────────────────────────────────┤

│ Dependency of │ webpack-dev-server                                           │

├───────────────┼──────────────────────────────────────────────────────────────┤

│ Path          │ webpack-dev-server > http-proxy-middleware > lodash          │

├───────────────┼──────────────────────────────────────────────────────────────┤

│ More info     │ https://npmjs.com/advisories/1523         



https://www.npmjs.com/advisories/1523



"No fix is currently available. Consider using an alternative package until a fix is made available."



So... can you use another package instead of lodash?



Environment Info:



  System:

    OS: Linux 5.3 Ubuntu 18.04.4 LTS (Bionic Beaver)

    CPU: (8) x64 Intel(R) Core(TM) i7-4790K CPU @ 4.00GHz

  Binaries:

    Node: 14.3.0 - ~/.nvm/versions/node/v14.3.0/bin/node

   Yarn: 1.22.4 - /usr/bin/yarn

    npm: 6.14.5 - ~/.nvm/versions/node/v14.3.0/bin/npm



    http-proxy-middleware@0.19.1

Continue on GitHub ↗

04 / LABELS

Labels from the report text only; not yet run

No supported category has been assigned.

Label rules and the text that matched

[]