refactor: replace lodash with lodash.iserror #18
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Issue
Lodash is one of those packages that seems to have reoccuring reports for vulnerabilities. We are also loading an entire lodash library for only one method.
As it appears that
nerror
isnt updated frequently, we should try to not rely on a package that might lead to reoccuring vulnerabilities as we might need to constantly monitoring and updating if they decided to stop pushing updates to older releases.Solution
IMO, it would be safer to install the specific lodash export module for the
isError
method. Out of the entire lodash pacakge, we only use theisError
method.In this case, we can install the
lodash.iserror
package instead oflodash
. This will potential reduce the possibility of seeing a vulnerability.As an additional bonus, using
lodash.iserror
package will also greatly reduce the size of the install.lodash
:lodash.iserror
: