Security warnings on lodash

[jenstornell]

Low Prototype Pollution

Package lodash

Patched in >=4.17.5

Dependency of timer-stopwatch

Path timer-stopwatch > lodash

More info https://npmjs.com/advisories/577

High Prototype Pollution

Package lodash

Patched in >=4.17.11

Dependency of timer-stopwatch

Path timer-stopwatch > lodash

More info https://npmjs.com/advisories/782

High Prototype Pollution

Package lodash

Patched in >=4.17.12

Dependency of timer-stopwatch

Path timer-stopwatch > lodash

More info https://npmjs.com/advisories/1065

[yahanvesh]

There is another CVE now - https://nvd.nist.gov/vuln/detail/CVE-2021-23337
The latest non vulnerable lodash module is 4.17.21

[nathantaal]

In the master branch this is fixed, so you could do npm install "https://github.com/MickCrozier/timer-stopwatch.git#master" --save