Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

refactor: replace lodash with lodash.iserror #18

Open
wants to merge 1 commit into
base: master
Choose a base branch
from

Conversation

erisu
Copy link

@erisu erisu commented Oct 11, 2021

Issue

Lodash is one of those packages that seems to have reoccuring reports for vulnerabilities. We are also loading an entire lodash library for only one method.

As it appears that nerror isnt updated frequently, we should try to not rely on a package that might lead to reoccuring vulnerabilities as we might need to constantly monitoring and updating if they decided to stop pushing updates to older releases.

Solution

IMO, it would be safer to install the specific lodash export module for the isError method. Out of the entire lodash pacakge, we only use the isError method.

In this case, we can install the lodash.iserror package instead of lodash. This will potential reduce the possibility of seeing a vulnerability.

As an additional bonus, using lodash.iserror package will also greatly reduce the size of the install.

lodash:

npm notice package size:  319.0 kB
npm notice unpacked size: 1.4 MB

lodash.iserror:

npm notice package size:  2.2 kB
npm notice unpacked size: 4.4 kB

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

1 participant