# Lo-dash version has high severity security vulnerability
**URL:** https://meta.discourse.org/t/lo-dash-version-has-high-severity-security-vulnerability/117787
**Category:** Support
**Created:** [May 15, 2019, 9:53am UTC](https://meta.discourse.org/t/lo-dash-version-has-high-severity-security-vulnerability/117787 "2019-05-15T09:53:38Z")
**Posts on this page:** 9
**Page:** 1
### Author:  [@Ed\_S](https://meta.discourse.org/u/Ed_S)
#### Post date: [May 15, 2019, 9:53am UTC](https://meta.discourse.org/t/lo-dash-version-has-high-severity-security-vulnerability/117787/1 "2019-05-15T09:53:38Z")
Discourse embeds a custom copy of 1.3.0 version of lo-dash.
Google’s lighthouse analysis reports 4 security vulnerabilities on my up-to-date Discourse instance, 3 of which are in lo-dash and one of which is marked as High severity.
The lighthouse report links to
> **[lodash | Snyk](https://security.snyk.io/package/npm/lodash)**
>
> Security vulnerabilities and package health score for npm package lodash
Lighthouse is at
> **[PageSpeed Insights](https://pagespeed.web.dev/)**
and the report for this site, at
[https://lighthouse-dot-webdotdevsite.appspot.com/lh/html?url=https://meta.discourse.org](https://lighthouse-dot-webdotdevsite.appspot.com/lh/html?url=https://meta.discourse.org)
says under Best Practices
> Includes front-end JavaScript libraries with known security vulnerabilities **3 vulnerabilities detected**
>
> Some third-party scripts may contain known security vulnerabilities that are easily identified and exploited by attackers. [Learn more](https://developers.google.com/web/tools/lighthouse/audits/vulnerabilities?utm_source=lighthouse&utm_medium=unknown).
>
> | Library Version | Vulnerability Count | Highest Severity |
> | --- | --- | --- |
> | [Lo-Dash@1.3.0](https://snyk.io/vuln/npm:lodash?lh=1.3.0&utm_source=lighthouse&utm_medium=ref&utm_campaign=audit) | 3 | High |
---
### Author:  [@zogstrip](https://meta.discourse.org/u/zogstrip)
#### Post date: [May 15, 2019, 10:27am UTC](https://meta.discourse.org/t/lo-dash-version-has-high-severity-security-vulnerability/117787/2 "2019-05-15T10:27:04Z")
@j.jaffeux can you update lo-dash to latest version?
---
### Author:  [@sam](https://meta.discourse.org/u/sam)
#### Post date: [May 17, 2019, 12:47am UTC](https://meta.discourse.org/t/lo-dash-version-has-high-severity-security-vulnerability/117787/5 "2019-05-17T00:47:26Z")
@j.jaffeux just updated lodash and also reduced our surface area quite a lot by building a custom hand curated lodash that only includes a subset of function on offer that we use.
---
### Author:  [@Stephen](https://meta.discourse.org/u/Stephen)
#### Post date: [May 17, 2019, 1:04am UTC](https://meta.discourse.org/t/lo-dash-version-has-high-severity-security-vulnerability/117787/6 "2019-05-17T01:04:22Z")
Any chance it eliminated functionality which [certain plugins](https://meta.discourse.org/t/post-content-not-showing-up/117945/6) used?
---
### Author:  [@Falco](https://meta.discourse.org/u/Falco)
#### Post date: [May 17, 2019, 1:14am UTC](https://meta.discourse.org/t/lo-dash-version-has-high-severity-security-vulnerability/117787/7 "2019-05-17T01:14:46Z")
If you consider the huge jump in the version number, it should have changed a number of method signatures. Since it’s Lodash, developers should review the need and migrate to vanilla js whenever possible.
---
### Author:  [@Ed\_S](https://meta.discourse.org/u/Ed_S)
#### Post date: [May 17, 2019, 1:41am UTC](https://meta.discourse.org/t/lo-dash-version-has-high-severity-security-vulnerability/117787/8 "2019-05-17T01:41:36Z")
Hmm - I reran the report on lighthouse (pointing at this site), and it sees lo-dash now at version 4.17.5, which is a great deal newer but still has 2 vulnerabilities including the high severity one. It looks like the fix is in 4.17.11, according to
> **[lodash | Snyk](https://security.snyk.io/package/npm/lodash)**
>
> Security vulnerabilities and package health score for npm package lodash
---
### Author:  [@sam](https://meta.discourse.org/u/sam)
#### Post date: [May 17, 2019, 1:42am UTC](https://meta.discourse.org/t/lo-dash-version-has-high-severity-security-vulnerability/117787/9 "2019-05-17T01:42:34Z")
Thanks for letting us know, we will get it sorted.
---
### Author:  [@j.jaffeux](https://meta.discourse.org/u/j.jaffeux)
#### Post date: [May 17, 2019, 5:42am UTC](https://meta.discourse.org/t/lo-dash-version-has-high-severity-security-vulnerability/117787/11 "2019-05-17T05:42:45Z")
Ok I go tricked by a combination of things…
Most notably `yarn global add` will 4.17.5 no matter what… You have to install it from git repo:
```plaintext
➜ Projects yarn global add https://github.com/lodash-archive/lodash-cli
yarn global v1.16.0
[1/4] 🔍 Resolving packages...
[2/4] 🚚 Fetching packages...
[3/4] 🔗 Linking dependencies...
[4/4] 🔨 Building fresh packages...
success Installed "lodash-cli@4.17.11" with binaries:
- lodash
✨ Done in 5.90s.
```
Will be fixed by:
[https://github.com/discourse/discourse/pull/7565/commits](https://github.com/discourse/discourse/pull/7565/commits)
Thanks.
---
### Author:  [@j.jaffeux](https://meta.discourse.org/u/j.jaffeux)
#### Post date: [May 17, 2019, 4:00pm UTC](https://meta.discourse.org/t/lo-dash-version-has-high-severity-security-vulnerability/117787/12 "2019-05-17T16:00:13Z")
This topic was automatically closed after 10 hours. New replies are no longer allowed.