2nd source of lodash 4.17.14 vulnerability #128
Description
The problem is at:
cz-conventional-changelog -> @commitlint/load@>6.1.1 -> [email protected]
Theoretically the > operator you folks have put onto @commitlint/load should fetch the newest version of @commitlint/load (that would in turn use a newer lodash), but it's not happening for me. It will only install up to @commitlint/[email protected] rather than @commitlint/[email protected] which would fix my problem. And running npm update @commitlint/load --depth 10 doesn't solve it either.
Could @commitlint/load be set to a newer version in your package.json dependencies?
Thanks!