React-color: Update lodash dependency (see CVE-2020-8203)
Current used version is 4.17.15.
Please refer to https://nvd.nist.gov/vuln/detail/CVE-2020-8203 and consider update to 4.17.20 (latest).
felixhix
👍2
All 2 comments
this issue will fail any automated security scanning and it is preventing users from consuming this package. There is no fixing lodash-es and it is permanently stuck at .15 which has a critical security issue. Until this is fixed, the current version is unusable.
slangberg
on 3 Nov 2020
👍2
@slangberg is right. [email protected] needs to be removed to avoid the security flag. The normal version of lodash-es can be controlled via upgrading or adding to resolutions, but lodash-ES is locked, and is a vulnerability.
rubinj30
on 7 Dec 2020
👍2
Was this page helpful?
0 / 5 - 0 ratings
Related issues
rpearce
路
4Comments
japgolly
路
5Comments
darkowic
路
3Comments
redguardtoo
路
4Comments
imsheng
路
6Comments
Most helpful comment
@slangberg is right. [email protected] needs to be removed to avoid the security flag. The normal version of lodash-es can be controlled via upgrading or adding to resolutions, but lodash-ES is locked, and is a vulnerability.