-
Notifications
You must be signed in to change notification settings - Fork 4.5k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
chore(apps): Update lodash #4397
base: main
Are you sure you want to change the base?
Conversation
…ecurity vulnerability
…curity vulnerability
@JensAstrup is attempting to deploy a commit to the shadcn-pro Team on Vercel. A member of the Team first needs to authorize it. |
# Conflicts: # apps/www/components/theme-customizer.tsx
would be great if this could be merged in |
Any idea about what is missing to merge it? |
I have no idea who I'm waiting on or what the next step is, unless I'm missing something from |
Would also appreciate it if maintainers could take a look. Thank you! |
Thanks for the work @JensAstrup.ave you heard back from them through any other channels? I'm guessing not... |
No, haven't heard anything yet :/ |
Please expedite this PR |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Thank you.
No update has been made on their end and the project was last updated 5 years ago.
I was surprised to read this but it's true.
The latest updates on your projects. Learn more about Vercel for Git ↗︎
|
@shadcn Way more checks were run after that merge, I assume that has to do with the failing Vercel build? I'll take a look into the others 👀 |
Background
There is currently a vulnerability in
lodash.template
that is of high severity which this repository relies on. No update has been made on their end and the project was last updated 5 years ago.Solution
In order to resolve the vulnerability I replaced
lodash.template
with the current version oflodash
and replaced usages ofimport template from "lodash.template"
withimport { template } from "lodash"
which should achieve the same functionalityCloses #3978