Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

chore(apps): Update lodash #4397

Open
wants to merge 6 commits into
base: main
Choose a base branch
from

Conversation

JensAstrup
Copy link

Background

There is currently a vulnerability in lodash.template that is of high severity which this repository relies on. No update has been made on their end and the project was last updated 5 years ago.

Solution

In order to resolve the vulnerability I replaced lodash.template with the current version of lodash and replaced usages of import template from "lodash.template" with import { template } from "lodash" which should achieve the same functionality

Closes #3978

Copy link

vercel bot commented Jul 23, 2024

@JensAstrup is attempting to deploy a commit to the shadcn-pro Team on Vercel.

A member of the Team first needs to authorize it.

@DominikScholz
Copy link

would be great if this could be merged in

@alexsilvar
Copy link

Any idea about what is missing to merge it?

@JensAstrup
Copy link
Author

I have no idea who I'm waiting on or what the next step is, unless I'm missing something from CONTRIBUTING.md, I'm fairly certain I've done everything. @shadcn Any assistance here? 🥺

@MoSheikh
Copy link

Would also appreciate it if maintainers could take a look. Thank you!

@jaxazam
Copy link

jaxazam commented Oct 3, 2024

Thanks for the work @JensAstrup.ave you heard back from them through any other channels? I'm guessing not...

@JensAstrup
Copy link
Author

No, haven't heard anything yet :/

@alexsilvar
Copy link

Please expedite this PR

Copy link
Collaborator

@shadcn shadcn left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thank you.

No update has been made on their end and the project was last updated 5 years ago.

I was surprised to read this but it's true.

Copy link

vercel bot commented Oct 23, 2024

The latest updates on your projects. Learn more about Vercel for Git ↗︎

Name Status Preview Updated (UTC)
ui ❌ Failed (Inspect) Oct 23, 2024 0:28am

@JensAstrup
Copy link
Author

@shadcn Way more checks were run after that merge, I assume that has to do with the failing Vercel build? I'll take a look into the others 👀

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

[bug]: There is a vulnerability in [email protected] > [email protected]
6 participants