[Security] Lodash vulnerability about exec HOT 3 CLOSED

Currently this library uses lodash v4.17.4

that version is defined as the lower bound of the defined range for the dependency. the patched version is also in-range. simply update your lockfile. you do not need to depend on an update of this package to update to the latest version

from exec.

@travi but if I directly update my lockfile, the changes will be overriden with npm install. I am facing issue in this

from exec.

i understand that this might not have been clear in my response, but i am not advocating for manually modifying your lockfile directly. you should always use the npm cli to do modifications to the package-lock.json.

for example, if you npm rm semantic-release && npm i semantic-release -D, you will remove and reinstall in a way that the npm cli will rebuild the tree in your lock file with the latest in-range versions throughout the tree.

alternatively, you might consider our recommendation to avoid depending on semantic-release as a dependency that ends up in your lockfile and instead use npx to install as late as possible only when you are executing a release from your CI pipeline. that helps avoid the staleness problem that can result if you are not regularly refreshing your lockfile.

from exec.