How can I update only the lodash package a child dependent(required dependency package for babel/core) from lodash@4.17.19 to v4.17.21

user_1355504 0
Viewed 2117

Recently lodash package reported a security vulnerability issue on the github page. You can find details here. https://github.com/lodash/lodash/issues/5083.

This latest version of lodash has security vulnerability of Command Injection (CVE-2021-23337).
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-23337
https://snyk.io/vuln/SNYK-JS-LODASH-1040724

All versions of package lodash; all versions of package org.fujion.webjars:lodash are vulnerable to Command Injection via template.

They have resolved the issue and its fix is present in the lodash v4.17.21. I am using the Angular 10 version. I am not using lodash directly but, One of the angular package that is @angular/localize@10.0.7 internally uses uses @babel/core@7.8.3 and this babel internally uses lodash@4.17.19.

Angular people will update the version number in their latest release and currently, I don't want to upgrade to the latest version of angular. Therefore, my question is how can I update only the lodash package, a child dependent(required dependency package for babel/core) from lodash@4.17.19 to v4.17.21 ?

angular-localize lodash npm angular javascript
1 Answers

npm update lodash did the trick for me.

$ npm -v
7.6.0
$ npm ls lodash  
temp@1.0.0 /Users/trott/temp
└─┬ @angular/localize@10.2.4
  └─┬ @babel/core@7.8.3
    ├─┬ @babel/traverse@7.13.0
    │ └── lodash@4.17.19 deduped
    ├─┬ @babel/types@7.13.0
    │ └── lodash@4.17.19 deduped
    └── lodash@4.17.19

$ npm update lodash

changed 1 package, and audited 99 packages in 1s

6 packages are looking for funding
  run `npm fund` for details

found 0 vulnerabilities
$ npm ls lodash
temp@1.0.0 /Users/trott/temp
└─┬ @angular/localize@10.2.4
  └─┬ @babel/core@7.8.3
    ├─┬ @babel/traverse@7.13.0
    │ └── lodash@4.17.21 deduped
    ├─┬ @babel/types@7.13.0
    │ └── lodash@4.17.21 deduped
    └── lodash@4.17.21

$

This isn't exactly what you asked for because it updates to the latest lodash that satisfies the requirements of your dependencies, rather than the specific version 4.17.21. It just so happens that (at the time of this writing), that latest version for @angular/localize is 4.17.21. If you genuinely need a specific version that isn't the latest that satisfies your dependencies, read on.

Let's say, hypothetically, you wanted to update to 4.17.20. You might try npm update lodash@4.17.20. Alas, that doesn't work. The command runs fine, but doesn't update anything. In that case, you'd have to npm install lodash@4.17.20 first. That will update all your dependencies as well (assuming 4.17.20 satisfies their requirements). Then npm uninstall lodash@4.17.20 to remove it from your direct dependencies.

user_4366410
Related