Discourse embeds a custom copy of 1.3.0 version of lo-dash. Google’s lighthouse analysis reports 4 security vulnerabilities on my up-to-date Discourse instance, 3 of which are in lo-dash and one of which is marked as High severity. The lighthouse report links to [image] lodash | Snyk Security vulnerabilities and package health score for npm package lodash Lighthouse is at PageSpeed Insights and the report for this site, at https://lighthouse-dot-webdotdevsite.appspot.com/lh/html?url=https://meta.discourse.org says under Best Practices Includes front-end JavaScript libraries with known security vulnerabilities 3 vulnerabilities detected Some third-party scripts may contain known security vulnerabilities that are easily identified and exploited by attackers. Learn more. Library Version Vulnerability Count Highest Severity Lo-Dash@1.3.0 3 High

@j.jaffeux can you update lo-dash to latest version?

@j.jaffeux just updated lodash and also reduced our surface area quite a lot by building a custom hand curated lodash that only includes a subset of function on offer that we use.

If you consider the huge jump in the version number, it should have changed a number of method signatures. Since it’s Lodash, developers should review the need and migrate to vanilla js whenever possible.

Hmm - I reran the report on lighthouse (pointing at this site), and it sees lo-dash now at version 4.17.5, which is a great deal newer but still has 2 vulnerabilities including the high severity one. It looks like the fix is in 4.17.11, according to [image] lodash | Snyk Security vulnerabilities and package health score for npm package lodash

Thanks for letting us know, we will get it sorted.

Ok I go tricked by a combination of things… Most notably yarn global add will 4.17.5 no matter what… You have to install it from git repo: ➜ Projects yarn global add https://github.com/lodash-archive/lodash-cli yarn global v1.16.0 [1/4] 🔍 Resolving packages... [2/4] 🚚 Fetching packages... [3/4] 🔗 Linking dependencies... [4/4] 🔨 Building fresh packages... success Installed "lodash-cli@4.17.11" with binaries: - lodash ✨ Done in 5.90s. Will be fixed by: https://github.com/discourse/discourse/pull/7565/commits Thanks.

Lo-dash version has high severity security vulnerability

Product Support

Stephen (Stephen) May 17, 2019, 1:04am 6

Any chance it eliminated functionality which certain plugins used?

Topic		Replies	Views
Vulnerabilities in the official Docker image Development	1	945	May 19, 2023
Lodash.js missing Product Support unsupported-install	6	865	October 16, 2020
3.2.4: Security and bug fix release Announcements release-notes	0	408	July 15, 2024
Unable to find discourse version 2.9.0.beta6 Product Support	3	737	July 4, 2022
Vulnerability patching of npm/gem dependencies in discourse Self-hosting docker	2	228	October 13, 2025

Lo-dash version has high severity security vulnerability

Related topics