Dependency lodash.set has Prototype Pollution vulnerability

[MayGo]

https://security.snyk.io/vuln/SNYK-JS-LODASHSET-1320032

I advise replacing that dependency.

[danpaz]

There is no fixed version for lodash.set.

We use lodash.set in several places in the code. Do you have any suggested alternatives by chance?

[MayGo]

I just learned about https://www.npmjs.com/package/wild-wild-path, perhaps this has too much functionality.
Or lodash itself and depend on tree shaking to only package used functions.

[staxie]

Hi. I opened a pull request for this matter. Please consider checking it out. It's a simple change.
#309

[StefOodle]

Hello, I also opened a pull request for this issue. #315 . It would be great if you could have a look.

[remyoudemans]

Thanks for solving this @StefOodle. Could we get a version with the fix published onto npm please @danpaz?

[danpaz]

Yes just published as 2.5.1. This reminded me publishing from Travis CI is still broken #297 😞