fix: update to security-patched dependency versions

.circleci/config.yml

@@ -0,0 +1,61 @@
+version: 2.1
+
+commands:
+  test:
+    steps:
+      - run:
+          name: Versions
+          command: npm version
+      - checkout
+      - restore_cache:
+          keys:
+            - {{ checksum "yarn.lock" }}
+      - run:
+          name: Install dependencies
+          command: yarn install
+      - run:
+          name: Audit dependencies
+          command: yarn audit
+      - run:
+          name: Build packages
+          command: yarn build
+      - run:
+          name: Lint project
+          command: yarn lint
+      - run:
+          name: Check dependencies
+          command: yarn deps
+      - run:
+          name: Test
+          command: yarn test
+      - save-npm-cache
+  save-npm-cache:
+    steps:
+      - save_cache:
+          key: v{{ .Environment.CIRCLE_CACHE_VERSION }}-{{ arch }}-npm-lock-{{ .Branch }}-{{ .Environment.CIRCLE_JOB }}-{{ checksum "yarn.lock" }}
+          paths:
+            - node_modules
+
+jobs:
+  node-v6:
+    docker:
+      - image: node:6
+    steps:
+      - test
+  node-v8:
+    docker:
+      - image: node:8
+    steps:
+      - test
+  node-v10:
+    docker:
+      - image: node:10
+    steps:
+      - test
+
+workflows:
+  node-multi-build:
+    jobs:
+      - node-v6
+      - node-v8
+      - node-v10

.travis.yml

@@ -5,7 +5,7 @@ node_js:
   - '6'
 install:
   - npm install -g npx
-  - npx yarn install
+  - npx yarn install --ignore-engines
   - npx lerna bootstrap
   - npm --version
   - yarn --version

@commitlint/cli/package.json

@@ -82,8 +82,7 @@
     "babel-polyfill": "6.26.0",
     "chalk": "2.3.1",
     "get-stdin": "5.0.1",
-    "lodash.merge": "4.6.1",
-    "lodash.pick": "4.4.0",
+    "lodash": "4.17.11",
     "meow": "5.0.0",
     "resolve-from": "^4.0.0",
     "resolve-global": "^0.1.0"

@commitlint/cli/src/cli.js

@@ -5,8 +5,7 @@ const load = require('@commitlint/load');
 const lint = require('@commitlint/lint');
 const read = require('@commitlint/read');
 const meow = require('meow');
-const merge = require('lodash.merge');
-const pick = require('lodash.pick');
+const {merge, pick} = require('lodash');
 const stdin = require('get-stdin');
 const resolveFrom = require('resolve-from');
 const resolveGlobal = require('resolve-global');

@commitlint/cli/src/cli.test.js

@@ -2,7 +2,7 @@ import path from 'path';
 import {fix, git} from '@commitlint/test';
 import test from 'ava';
 import execa from 'execa';
-import merge from 'lodash.merge';
+import {merge} from 'lodash';
 import * as sander from 'sander';
 import stream from 'string-to-stream';
 

@commitlint/config-patternplate/index.js

@@ -1,6 +1,6 @@
 const path = require('path');
 const globby = require('globby');
-const merge = require('lodash.merge');
+const {merge} = require('lodash');
 
 function pathToId(root, filePath) {
 	const relativePath = path.relative(root, filePath);

@commitlint/config-patternplate/package.json

@@ -33,7 +33,7 @@
   "dependencies": {
     "@commitlint/config-angular": "^7.1.2",
     "globby": "8.0.1",
-    "lodash.merge": "4.6.1"
+    "lodash": "4.17.11"
   },
   "devDependencies": {
     "@commitlint/utils": "^7.1.2",

@commitlint/ensure/package.json

@@ -68,15 +68,10 @@
     "concurrently": "3.5.1",
     "cross-env": "5.1.1",
     "globby": "8.0.1",
-    "lodash.values": "4.3.0",
     "rimraf": "2.6.1",
     "xo": "0.20.3"
   },
   "dependencies": {
-    "lodash.camelcase": "4.3.0",
-    "lodash.kebabcase": "4.1.1",
-    "lodash.snakecase": "4.1.1",
-    "lodash.startcase": "4.4.0",
-    "lodash.upperfirst": "4.3.1"
+    "lodash": "4.17.11"
   }
 }

@commitlint/ensure/src/case.js

@@ -1,8 +1,4 @@
-import camelCase from 'lodash.camelcase';
-import kebabCase from 'lodash.kebabcase';
-import snakeCase from 'lodash.snakecase';
-import upperFirst from 'lodash.upperfirst';
-import startCase from 'lodash.startcase';
+import * as _ from 'lodash';
 
 export default ensureCase;
 
@@ -24,15 +20,15 @@ function ensureCase(raw = '', target = 'lowercase') {
 function toCase(input, target) {
 	switch (target) {
 		case 'camel-case':
-			return camelCase(input);
+			return _.camelCase(input);
 		case 'kebab-case':
-			return kebabCase(input);
+			return _.kebabCase(input);
 		case 'snake-case':
-			return snakeCase(input);
+			return _.snakeCase(input);
 		case 'pascal-case':
-			return upperFirst(camelCase(input));
+			return _.upperFirst(_.camelCase(input));
 		case 'start-case':
-			return startCase(input);
+			return _.startCase(input);
 		case 'upper-case':
 		case 'uppercase':
 			return input.toUpperCase();

@commitlint/ensure/src/index.test.js

@@ -1,8 +1,7 @@
 import path from 'path';
 import test from 'ava';
 import globby from 'globby';
-import camelCase from 'lodash.camelcase';
-import values from 'lodash.values';
+import {camelCase, values} from 'lodash';
 import * as ensure from '.';
 
 test('exports all rules', async t => {

@commitlint/format/package.json

@@ -67,7 +67,7 @@
     "babel-register": "6.26.0",
     "concurrently": "3.5.1",
     "cross-env": "5.1.1",
-    "lodash.includes": "4.3.0",
+    "lodash": "4.17.11",
     "rimraf": "2.6.1",
     "xo": "0.20.3"
   },

@commitlint/format/src/index.test.js

@@ -1,6 +1,6 @@
 import test from 'ava';
 import chalk from 'chalk';
-import includes from 'lodash.includes';
+import {includes} from 'lodash';
 import format from '.';
 
 const ok = chalk.bold(

@commitlint/lint/package.json

@@ -69,15 +69,14 @@
     "cross-env": "5.1.1",
     "execa": "0.9.0",
     "globby": "8.0.1",
-    "lodash.includes": "4.3.0",
+    "lodash": "4.17.11",
     "rimraf": "2.6.1",
     "xo": "0.20.3"
   },
   "dependencies": {
     "@commitlint/is-ignored": "^7.2.1",
     "@commitlint/parse": "^7.1.2",
     "@commitlint/rules": "^7.2.0",
-    "babel-runtime": "^6.23.0",
-    "lodash.topairs": "4.3.0"
+    "babel-runtime": "^6.23.0"
   }
 }

@commitlint/lint/src/index.js

@@ -2,7 +2,7 @@ import util from 'util';
 import isIgnored from '@commitlint/is-ignored';
 import parse from '@commitlint/parse';
 import implementations from '@commitlint/rules';
-import entries from 'lodash.topairs';
+import {toPairs} from 'lodash';
 
 const buildCommitMesage = ({header, body, footer}) => {
 	let message = header;
@@ -41,7 +41,7 @@ export default async (message, rules = {}, opts = {}) => {
 		);
 	}
 
-	const invalid = entries(rules)
+	const invalid = toPairs(rules)
 		.map(([name, config]) => {
 			if (!Array.isArray(config)) {
 				return new Error(
@@ -106,9 +106,9 @@ export default async (message, rules = {}, opts = {}) => {
 	}
 
 	// Validate against all rules
-	const results = entries(rules)
+	const results = toPairs(rules)
 		.filter(entry => {
-			const [, [level]] = entry;
+			const [, [level]] = toPairs(entry);
 			return level > 0;
 		})
 		.map(entry => {

@commitlint/load/package.json

@@ -77,10 +77,7 @@
     "@commitlint/resolve-extends": "^7.1.2",
     "babel-runtime": "^6.23.0",
     "cosmiconfig": "^4.0.0",
-    "lodash.merge": "4.6.1",
-    "lodash.mergewith": "4.6.1",
-    "lodash.pick": "4.4.0",
-    "lodash.topairs": "4.3.0",
-    "resolve-from": "4.0.0"
+    "lodash": "4.17.11",
+    "resolve-from": "^4.0.0"
   }
 }

@commitlint/load/src/index.js

@@ -2,10 +2,7 @@ import path from 'path';
 import executeRule from '@commitlint/execute-rule';
 import resolveExtends from '@commitlint/resolve-extends';
 import cosmiconfig from 'cosmiconfig';
-import entries from 'lodash.topairs';
-import merge from 'lodash.merge';
-import mergeWith from 'lodash.mergewith';
-import pick from 'lodash.pick';
+import {toPairs, merge, mergeWith, pick} from 'lodash';
 import resolveFrom from 'resolve-from';
 
 const w = (a, b) => (Array.isArray(b) ? b : undefined);
@@ -67,7 +64,7 @@ export default async (seed = {}, options = {cwd: process.cwd()}) => {
 			.map(async item => {
 				const [key, value] = item;
 				const executedValue = await Promise.all(
-					entries(value || {}).map(entry => executeRule(entry))
+					toPairs(value || {}).map(entry => executeRule(entry))
 				);
 				return [
 					key,

@commitlint/prompt/package.json

@@ -72,13 +72,8 @@
     "@commitlint/load": "^7.2.1",
     "babel-runtime": "^6.23.0",
     "chalk": "^2.0.0",
-    "lodash.camelcase": "4.3.0",
-    "lodash.kebabcase": "4.1.1",
-    "lodash.snakecase": "4.1.1",
-    "lodash.startcase": "4.4.0",
-    "lodash.topairs": "4.3.0",
-    "lodash.upperfirst": "4.3.1",
+    "lodash": "4.17.11",
     "throat": "^4.1.0",
-    "vorpal": "^1.10.0"
+    "vorpal": "^1.12.0"
   }
 }

@commitlint/prompt/src/library/format.js

@@ -1,5 +1,5 @@
 import chalk from 'chalk';
-import entries from 'lodash.topairs';
+import {toPairs} from 'lodash';
 
 export default format;
 
@@ -11,7 +11,7 @@ export default format;
  */
 function format(input, debug = false) {
 	const results = debug
-		? entries(input).reduce((registry, item) => {
+		? toPairs(input).reduce((registry, item) => {
 				const [name, value] = item;
 				registry[name] =
 					value === null ? chalk.grey(`<${name}>`) : chalk.bold(value);

@commitlint/prompt/src/library/get-forced-case-fn.js

@@ -1,8 +1,4 @@
-import camelCase from 'lodash.camelcase';
-import kebabCase from 'lodash.kebabcase';
-import snakeCase from 'lodash.snakecase';
-import upperFirst from 'lodash.upperfirst';
-import startCase from 'lodash.startcase';
+import * as _ from 'lodash';
 
 /**
  * Get forced case for rule
@@ -42,15 +38,15 @@ export default function getForcedCaseFn(rule) {
 
 	switch (target) {
 		case 'camel-case':
-			return input => camelCase(input);
+			return input => _.camelCase(input);
 		case 'kebab-case':
-			return input => kebabCase(input);
+			return input => _.kebabCase(input);
 		case 'snake-case':
-			return input => snakeCase(input);
+			return input => _.snakeCase(input);
 		case 'pascal-case':
-			return input => upperFirst(camelCase(input));
+			return input => _.upperFirst(_.camelCase(input));
 		case 'start-case':
-			return input => startCase(input);
+			return input => _.startCase(input);
 		case 'upper-case':
 		case 'uppercase':
 			return input => input.toUpperCase();

@commitlint/prompt/src/library/meta.js

@@ -1,5 +1,5 @@
 import chalk from 'chalk';
-import entries from 'lodash.topairs';
+import {toPairs} from 'lodash';
 
 /**
  * Get formatted meta hints for configuration
@@ -8,7 +8,7 @@ import entries from 'lodash.topairs';
  */
 export default function meta(settings) {
 	return chalk.grey(
-		entries(settings)
+		toPairs(settings)
 			.filter(item => item[1])
 			.map(item => {
 				const [name, value] = item;

@commitlint/resolve-extends/package.json

@@ -75,8 +75,7 @@
   },
   "dependencies": {
     "babel-runtime": "6.26.0",
-    "lodash.merge": "4.6.1",
-    "lodash.omit": "4.5.0",
+    "lodash": "4.17.11",
     "require-uncached": "^1.0.3",
     "resolve-from": "^4.0.0",
     "resolve-global": "^0.1.0"

@commitlint/resolve-extends/src/index.js

@@ -3,8 +3,7 @@ import path from 'path';
 import 'resolve-global'; // eslint-disable-line import/no-unassigned-import
 import requireUncached from 'require-uncached';
 import resolveFrom from 'resolve-from';
-import merge from 'lodash.merge';
-import omit from 'lodash.omit';
+import {merge, omit} from 'lodash';
 
 // Resolve extend configs
 export default function resolveExtends(config = {}, context = {}) {

@commitlint/rules/package.json

@@ -70,7 +70,7 @@
     "conventional-changelog-angular": "1.6.6",
     "cross-env": "5.1.1",
     "globby": "8.0.1",
-    "lodash.values": "4.3.0",
+    "lodash": "4.17.11",
     "rimraf": "2.6.1",
     "xo": "0.20.3"
   },

@commitlint/rules/src/index.test.js

@@ -1,7 +1,7 @@
 import path from 'path';
 import test from 'ava';
 import globby from 'globby';
-import values from 'lodash.values';
+import {values} from 'lodash';
 import rules from '.';
 
 test('exports all rules', async t => {