🚨 [security] Update lodash: 4.17.11 → 4.17.15 (patch)

[depfu]

---

🚨 Your version of lodash has known security vulnerabilities 🚨

Advisory: CVE-2019-10744
Disclosed: July 10, 2019
URL: https://nvd.nist.gov/vuln/detail/CVE-2019-10744

Critical severity vulnerability that affects lodash, lodash-es, lodash-amd, lodash.template, lodash.merge, lodash.mergewith, and lodash.defaultsdeep

Affected versions of lodash are vulnerable to Prototype Pollution.
The function defaultsDeep could be tricked into adding or modifying properties of Object.prototype using a constructor payload.

🚨 We recommend to merge and deploy this update as soon as possible! 🚨

---

Here is everything you need to know about this update. Please take a good look at what changed and the test results before merging this pull request.

What changed?

✳️ lodash (4.17.11 → 4.17.15) · Repo · Changelog

Commits

See the full diff on Github. The new version differs by 29 commits:

• Bump to v4.17.15.
• Rebuild lodash and docs.
• Bump to v4.17.14.
• Rebuild lodash and docs.
• Bump to v4.17.13.
• Rebuild lodash and docs.
• Bump to v4.17.12.
• Rebuild lodash and docs.
• Update OpenJS references.
• Fix minified build.
• Fix test bootstrap for core build.
• Fix tests in older browsers.
• Fix style:test lint nits.
• Update deps.
• Format nit.
• Use nativeIsFinite() instead of Number.isFinite().
• Whitespace nit.
• Revert "perf(toNumber): use +value to convert binary/octal/hexadecimal string (#4230)"
• Prevent prototype pollution chaining to code execution via _.template (#4355)
• fix: prototype pollution in _.defaultsDeep (#4336)
• Fixes issue with Object prototype and the chaining syntax. [closes #4247]
• Round Infinity with a precision argument returns Infinity (#4272)
• mergeWith: stack passed to customizer should always be defined (#4244)
• perf(toNumber): use +value to convert binary/octal/hexadecimal string (#4230)
• cancel old timer (#4139)
• Update wording of fp wiki template for method spread rule exceptions.
• Revert "Ensure _.pick paths aren't interpolated twice. [closes #3952]"
• Ensure _.pick paths aren't interpolated twice. [closes #3952]
• Ensure map and set clones contain custom properties of source values. [closes #3951]

---

Depfu will automatically keep this PR conflict-free, as long as you don't add any commits to this branch yourself. You can also trigger a rebase manually by commenting with @depfu rebase.

All Depfu comment commands

@​depfu rebase

Rebases against your default branch and redoes this update

@​depfu merge

Merges this PR once your tests are passing and conflicts are resolved

@​depfu close

Closes this PR and deletes the branch

@​depfu reopen

Restores the branch and reopens this PR (if it's closed)

@​depfu pause

Ignores all future updates for this dependency and closes this PR

@​depfu pause [minor|major]

Ignores all future minor/major updates for this dependency and closes this PR

@​depfu resume

Future versions of this dependency will create PRs again (leaves this PR as is)

[codecov]

Codecov Report

Merging #33 into electron-rewrite will not change coverage.
The diff coverage is n/a.

@@                Coverage Diff                @@
##           electron-rewrite      #33   +/-   ##
=================================================
  Coverage             92.89%   92.89%           
=================================================
  Files                    14       14           
  Lines                   366      366           
  Branches                 66       66           
=================================================
  Hits                    340      340           
  Misses                   26       26

---

Continue to review full report at Codecov.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update ec13aa6...8a5a335. Read the comment docs.

[depfu]

Closed in favor of #75.

[depfu]

Closed in favor of #75.