gulp-hash icon indicating copy to clipboard operation
gulp-hash copied to clipboard

Removing lodash.template depency as per the component Governance Alert

Open BrahminiPaleti opened this issue 1 year ago • 1 comments

As per the component governance alert made changes to remove lodash.template and replace with lodash. Made the fix as per the suggestion provided in below link.

https://github.com/lodash/lodash/issues/5851

"If you are using lodash.template directly in a project, to remove this alert you should install the latest version of lodash and use the template method off the main Lodash module instead, if you can't use another approach entirely."

BrahminiPaleti avatar Jul 23 '24 21:07 BrahminiPaleti

This address CVE-2021-23337, an open security issue with using lodash.template. Also lodash.template is considered unowned and unsupported at this point.

When can this get reviewed?

tlatin avatar Nov 19 '24 22:11 tlatin