chore(security): change to lodash sub-packages to suppress lodash 4.17.15 security vulnerability

[hardyscc]

PR Checklist

Please check if your PR fulfills the following requirements:

• The commit message follows our guidelines: https://github.com/nestjs/nest/blob/master/CONTRIBUTING.md
• Tests for the changes have been added (for bug fixes / features)
• Docs have been added / updated (for bug fixes / features)

PR Type

What kind of change does this PR introduce?

[ ] Bugfix
[ ] Feature
[ ] Code style update (formatting, local variables)
[ ] Refactoring (no functional changes, no api changes)
[ ] Build related changes
[ ] CI related changes
[x] Other... Please describe:  suppress the lodash 4.17.15 security vulnerability

What is the current behavior?

Change to lodash sub-packages to suppress the lodash 4.17.15 security vulnerability

lodash : 4.17.15
sonatype-2019-0467
EXPLANATION
The lodash package is vulnerable to Prototype Pollution. The template function in lodash.js, template.js, and lodash.min.js does not account for unicode newline characters when filtering the sourceURL property of the options object. Because of how the options object is used, an attacker who can control the source URL can leverage this to alter properties on the prototype chain, which can cause other sections of code to behave in an arbitrary and malicious way.
Please note that this vulnerability is due to an incomplete fix in sonatype-2019-0500.

sonatype-2020-0292
EXPLANATION
The lodash package is vulnerable to Prototype Pollution. The baseSet function in lodash.js fails to restrict the addition or modification of properties of Object prototypes. A remote attacker can exploit this behavior to modify Object prototype properties which, depending on the behavior of the object within the application, can result in a Denial of Service (DoS) or potentially Remote Code Execution (RCE).

Issue Number: N/A

What is the new behavior?

suppress lodash 4.17.15 security vulnerability

Does this PR introduce a breaking change?

[ ] Yes
[x] No

Other information

please try this PR by install directly from npm install --save hardyscc/graphql

[andreialecu]

Just a heads-up here, the lodash sub packages are deprecated and will be removed:

https://lodash.com/per-method-packages

[hardyscc]

@andreialecu Thanks for your information, I strongly suggest that remove the lodash dependency. if this is ok i can try make a PR.

[andreialecu]

The vulnerability is in zipObjectDeep which is not used in this package, so in reality there should be no issue other than the audit warning.

Refs:
lodash/lodash#4759
https://hackerone.com/reports/712065