Skip to content

Maintenance: Replace full lodash monolith with targeted import #410

Description

@pratikchaskar

Severity: Low

Summary

The full lodash package (~600KB unpacked) is listed as a production dependency, but only a single function (omit) is used anywhere in the source code. This unnecessarily increases the dependency footprint for all downstream consumers and the surface area for future vulnerabilities.

Location

File: package.json, line 74

"lodash": "^4.17.21",

Only usage in source code: src/components/search/search.tsx, line 12

import { omit } from 'lodash'; // or define your own omit function

The source code comment itself acknowledges this could be replaced.

Why Low Severity

  • lodash@4.17.21 (resolved to 4.17.23 in lockfile) has no known unpatched CVEs
  • Modern bundlers with tree-shaking can eliminate unused code (though lodash's CJS build does not tree-shake well)
  • This is a forward-looking risk — the next lodash vulnerability would affect every consumer of force-ui

Recommended Fix

Choose one of these approaches:

Option 1 — Inline the function (zero dependencies):

const omit = <T extends Record<string, unknown>>(obj: T, keys: string[]): Partial<T> =>
  Object.fromEntries(Object.entries(obj).filter(([k]) => !keys.includes(k))) as Partial<T>;

Option 2 — Cherry-pick import (reduces bundle for CJS consumers):

import omit from 'lodash/omit';

Option 3 — Switch to lodash-es (proper tree-shaking):

npm uninstall lodash && npm install lodash-es
import { omit } from 'lodash-es';

Then remove lodash from dependencies in package.json.


Found by automated security audit — VULN-10

Activity

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions