Dependabot reports 3 open alerts in saas-metering-webhook/package-lock.json, all for lodash (1 high, 2 medium; all patched by lodash 4.18.0).
Proposed fix
cd saas-metering-webhook && npm update lodash && npm audit fix
Then commit the regenerated package-lock.json. If lodash is only pulled in transitively, add a resolution/override or update the direct dependency that brings it in.
Priority
Low — single package, straightforward bump.
Dependabot reports 3 open alerts in
saas-metering-webhook/package-lock.json, all forlodash(1 high, 2 medium; all patched bylodash4.18.0).Proposed fix
Then commit the regenerated
package-lock.json. Iflodashis only pulled in transitively, add a resolution/override or update the direct dependency that brings it in.Priority
Low — single package, straightforward bump.