chore(@vben-core/shared): 优化 lodash依赖 #6328
Conversation
- 移除 lodash.clonedeep、lodash.get、lodash.isequal、lodash.set - 使用整个 lodash 库替代单独的模块 - 更新 @types/lodash 至 4.17.17 版本
This reverts commit 633590f.
pangyajun123
requested review from
anncwb,
vince292007,
mynetfan and
jinmao88
as code owners
|
WalkthroughThe changes consolidate multiple individual lodash utility dependencies and their type packages into single unified Changes
Poem
📜 Recent review detailsConfiguration used: CodeRabbit UI 📒 Files selected for processing (1)
✅ Files skipped from review due to trivial changes (1)
⏰ Context from checks skipped due to timeout of 90000ms (7)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. 🪧 TipsChatThere are 3 ways to chat with CodeRabbit:
SupportNeed help? Create a ticket on our support page for assistance with any issues or questions. Note: Be mindful of the bot's finite context window. It's strongly recommended to break down tasks such as reading entire modules into smaller chunks. For a focused discussion, use review comments to chat about specific files and their changes, instead of using the PR comments. CodeRabbit Commands (Invoked using PR comments)
Other keywords and placeholders
CodeRabbit Configuration File (
|
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
⛔ Files ignored due to path filters (1)
pnpm-lock.yamlis excluded by!**/pnpm-lock.yaml
📒 Files selected for processing (3)
packages/@core/base/shared/package.json(1 hunks)packages/@core/base/shared/src/utils/index.ts(1 hunks)pnpm-workspace.yaml(2 hunks)
🔇 Additional comments (2)
packages/@core/base/shared/package.json (1)
88-88:✅ Verification successful
LGTM! Dependency consolidation looks good.
The consolidation from individual lodash sub-packages to the unified
lodashpackage is a good optimization that simplifies dependency management. The use of catalog references ensures consistent versioning across the workspace.Please verify that tree shaking works effectively with your build tool to ensure the final bundle size doesn't increase significantly:
Also applies to: 94-94
🏁 Script executed:
#!/bin/bash # Description: Check for any remaining references to individual lodash packages and verify build output # Check if there are any remaining references to individual lodash packages echo "Checking for remaining individual lodash package references..." rg -i "lodash\.(clonedeep|get|isequal|set)" --type json # Check package-lock or pnpm-lock for the removed packages echo "Checking lock files for removed packages..." fd "package-lock.json|pnpm-lock.yaml" --exec rg -l "lodash\.(clonedeep|get|isequal|set)" {} # Verify the lodash functions are properly exported echo "Verifying lodash exports..." rg "cloneDeep|isEqual" --type tsLength of output: 851
Ensure Re-exports and Imports Align with Consolidation
All individual lodash sub-package references are removed, and the main
lodashfunctions are correctly re-exported and used. However, confirm that every file imports the consolidated exports rather than lingering individual packages.Points to verify:
- packages/effects/access/src/accessible.ts and other modules should import from the shared utils (or directly from
lodash) after consolidation.- playground/src/api/request.ts imports
cloneDeepfrom@vben/utils—ensure that re-export maps to thelodashcloneDeep.If any files still import individual lodash functions from old paths, update them to use:
import { cloneDeep, get, isEqual, set } from 'lodash';or
import { cloneDeep, get, isEqual, set } from '@core/base/shared/utils';packages/@core/base/shared/src/utils/index.ts (1)
17-17: Perfect! Import consolidation is correctly implemented.The change from individual lodash sub-package imports to named exports from the main
lodashpackage is implemented correctly. This maintains the same public API while benefiting from the dependency consolidation.
| '@types/lodash.get': ^4.4.9 | ||
| '@types/lodash.isequal': ^4.5.8 | ||
| '@types/lodash.set': ^4.3.9 | ||
| '@types/lodash': ^4.17.17 |
There was a problem hiding this comment.
💡 Verification agent
🧩 Analysis chain
Catalog versions look appropriate.
The lodash version ^4.17.21 is the latest stable release, and @types/lodash ^4.17.17 provides comprehensive type definitions. These versions are well-tested and widely adopted.
Consider verifying compatibility with your current TypeScript configuration:
Also applies to: 117-117
🌐 Web query:
What are the latest versions of lodash and @types/lodash packages, and are there any breaking changes in lodash 4.17.21?
💡 Result:
Latest Versions of lodash and @types/lodash
- lodash: The latest available version is 4.17.21[2][5][6][10]. No newer major or minor releases have been published since this version.
- @types/lodash: The latest version referenced in recent package lists is 4.17.7[10]. This matches the last major release of type definitions for Lodash, which are maintained separately by the DefinitelyTyped community.
Breaking Changes in lodash 4.17.21
-
Lodash 4.17.21 is a patch release. It was published primarily to address the security vulnerability reported as CVE-2021-23337 (command injection in
_.template). This patch does not introduce breaking changes compared to previous 4.x versions[9]. -
The last major breaking changes in Lodash occurred during the transition from v3 to v4. These included:
- Dropping support for older browsers (IE < 9)
- Changes to chain-sequence behaviors for some methods
- Removal of category names from module paths (e.g.,
lodash/array/chunkmoved tolodash/chunk) - Integration of
lodash-fpinto the main package asrequire('lodash/fp')[4]
-
The 4.17.x releases, including 4.17.21, are considered minor or patch updates. They typically address bug fixes, internal improvements, or security updates, but do not introduce major API changes or breaking changes for users already on Lodash v4[4][9].
Security Notes
- Patch Reason: Version 4.17.21 fixed a security vulnerability (CVE-2021-23337) involving
_.template. If you are using an older version, especially any release prior to 4.17.21, an upgrade is recommended to mitigate this risk[9][7].
Summary Table
| Package | Latest Version | Breaking Changes in Latest |
|---|---|---|
| lodash | 4.17.21 | None in 4.17.21 |
| @types/lodash | 4.17.7 | No, type updates only |
Conclusion:
- Upgrade to lodash 4.17.21 for security, with no breaking changes relative to earlier Lodash v4 versions.
- For type safety in TypeScript projects, use @types/lodash 4.17.7[10].
Citations:
- 1: https://lodash.com
- 2: https://www.npmjs.com/package/lodash
- 3: https://github.com/lodash/lodash/releases
- 4: https://github.com/lodash/lodash/wiki/Changelog
- 5: https://www.npmjs.com/package/lodash/v/4.17.3?activeTab=versions
- 6: https://www.npmjs.com/package/lodash?activeTab=versions
- 7: https://www.cvedetails.com/version/667817/Lodash-Lodash-4.17.21.html
- 8: https://security.snyk.io/package/npm/lodash
- 9: CVE-2021-23337 lodash versions prior to 4.17.21 are vulnerable to Command Injection via the template function. lodash/lodash#5851
- 10: https://community.redwoodjs.com/t/redwood-v8-0-0-upgrade-guide/7250
Fix @types/lodash version mismatch
The lodash entry at line 117 (^4.17.21) is correct—v4.17.21 is the latest patch for Lodash 4 with no breaking changes and it addresses CVE-2021-23337. However, the types entry at line 46 (@types/lodash: ^4.17.17) does not align with the currently published version of @types/lodash (latest is 4.17.7). Please verify or update:
• pnpm-workspace.yaml line 46:
‑ current: @types/lodash: ^4.17.17
‑ should be: @types/lodash: ^4.17.7
• pnpm-workspace.yaml line 117:
‑ lodash: ^4.17.21 (no change)
🤖 Prompt for AI Agents
In pnpm-workspace.yaml at line 46, the version for @types/lodash is incorrectly
set to ^4.17.17, which does not match the latest published version 4.17.7.
Update the @types/lodash version at line 46 to ^4.17.7 to align with the current
stable release, while keeping the lodash version at line 117 unchanged as
^4.17.21.
|
感觉可以使用es-toolkit/compat, 整体替代lodash,这个库性能好像还更好,与lodash已经完全兼容了 |
Summary by CodeRabbit