[fix] 9.0.0 release : increased library size due to complete lodash import

[saurabhshri]

By submitting a PR to this repository, you agree to the terms within the Auth0 Code of Conduct. Please see the contributing guidelines for how to create and submit a high-quality PR for this repo.

Description

Release 9.0.0 breached our threshold for size for cloud function deployments. Looking at commits, this PR changed the way lodash functions were imported from per-function import to complete lodash import : #852 which has resulted in significant increase in library size.

This PR reverts the imports back to modular imports.

"cost-of-modules" with modular imports :

"cost-of-modules" with complete import :

References

• fixes Version 9.0.0 Increased bundle size, probably due to lodash import #878
• PR that introduced this: fix!: Prevent accidental use of insecure key sizes & misconfiguration of secrets #852

Checklist

• I have added documentation for new/changed functionality in this PR or in auth0.com/docs
• All active GitHub checks for tests, formatting, and security are passing
• The correct base branch is being used, if not the default branch

[saurabhshri]

Closes #878.

[joshdotblack]

This is really killing us too for the same reasons its causing issues for others - cloudfront viewer-request handlers are capped at 1mb. We're trying to update to latest jwt to clear a CVE from an earlier version, but the increase in package size the full lodash import has caused stops us doing this.

@panva @ArturKlajnerok @jakelacey2012 et al, is the approach in this PR acceptable? Looks low-risk to me but I'm not a maintainer - do you think you'd merge/release this?

[mfernandes-alcumus]

Same issue as @joshdotblack trying to do a cloudfront viewer-request which fails as it is capped for 1mb. This PR seems to reduce the bulk on this package, please @panva @ArturKlajnerok @jakelacey2012 can this be reviewed and merged?

[dj-chadlahn]

Same issue as others described, @david-renaud-okta 's update last November bringing in the full lodash package without a reason to has caused jsonwebtoken to be unusable in Lambda@Edge on Cloudfront. @CharlesRea , as you were the approver of that PR, can you approve this so we can resolve this issue?

[jakelacey2012]

The fix has been merged in #933 and released as part of the 9.0.2 release.