Security issue with lodash.once

[slavede]

xvfb is using lodash.once which is pretty outdated (once extracted from lodash repo, never got maintained).

https://nvd.nist.gov/vuln/detail/CVE-2019-10744

Update it to use lodash as dependency, and then just import once from lodash bundle

[MikeMcC399]

This critical vulnerability was fixed in #190 in 2021, however the latest release of this module is v1.2.4 in 2018.

[slavede]

So the problem is that xvfb just needs new release?

[MikeMcC399]

@slavede

So the problem is that xvfb just needs new release?

Basically yes, however when repos like this haven't been released for many years it can take significant effort to cut a new release. It would need some focus from the Cypress.io team to do it. I went through an exercise a few months ago with them on another repo that hadn't been maintained for a long time. I'm external, so I can't do anything on my own!