[Dependency] lodash range ≥4.0.0 ≤4.17.22 flagged by audit (cloudinary → lodash)

Open
  • Is something wrong?
#734 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Assessment

Difficulty
2/5
Estimated time
1-3 hours
Newbie friendliness
58/100
Issue type
Bug
Clarity
Mostly clear
Activity status
Quiet
Tech stack
javascript, nodejs
Domain
backend, security

Research direction

Start with the cloudinary dependency declaration in package.json, then reproduce the reported result with npm install or bun install and bun audit. Confirm whether the resolved lodash range is still flagged and update the dependency if appropriate; done means the audit no longer reports the transitive vulnerability and the SDK has a patch release.

Written by the indexing model from the issue text.

Description

Bug report for Cloudinary NPM SDK

Before proceeding, please update to latest version and test if the issue persists.

We are on [email protected] (latest on npm). bun audit still flags lodash pulled in by this package.

Describe the bug in a sentence or two.

The Cloudinary NPM SDK declares a dependency on lodash (^4.17.21 in [email protected]). The resolved lodash version falls in the range reported as vulnerable by multiple GitHub Security Advisories (lodash >=4.0.0 <=4.17.22). Security scanners (e.g. bun audit / npm audit) therefore report high and moderate findings on installs that only add cloudinary as a direct dependency.

Issue Type (Can be multiple)

  • Build - Can’t install or import the SDK
  • Babel - Babel errors or cross browser issues
  • Performance - Performance issues
  • Behaviour - Functions aren’t working as expected (Such as generate URL)
  • Documentation - Inconsistency between the docs and behaviour
  • Incorrect Types - For typescript users who are having problems with our d.ts files
  • Other (Specify): Transitive dependency vulnerability (lodash); audit reports CVEs/GHSAs after install

Steps to reproduce

  1. Create a minimal project with "cloudinary": "^2.9.0" in package.json.
  2. Run npm install or bun install.
  3. Run bun audit (or npm audit).
  4. Observe findings for lodash, dependency path cloudinary › lodash, vulnerable range >=4.0.0 <=4.17.22.

Error screenshots

bun audit output (excerpt):

Image

Suggested fix

Bump the lodash dependency in cloudinary to a patched version outside the vulnerable range (e.g. per the linked GHSAs, typically > 4.17.22 / latest 4.x patch), and release a patch version of the SDK so consumers clear audits without overrides / resolutions.

Dominant language
JavaScript
Stars
672
Forks
318
No merged PRs in 30d

Getting set up

  • No Dockerfile or Docker Compose file
  • Has a pull request template
  • No contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from cloudinary/cloudinary_npm

All issues in cloudinary/cloudinary_npm

Similar issues

More JavaScript issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.