Remove lodash.pick from @useoptic/rulesets-base usage due to security issues and deprecations #2889

Activity

1. azen1k5

   added

   bugSomething isn't workingSomething isn't working

   on Oct 1, 2025
2. paras-verma7454 commented on Jan 7, 2026

   

   paras-verma7454

   on Jan 7, 2026

   More actions

   we can write a function to replace lodash.pick

   export function pick<T extends object, K extends keyof T>( obj: T, ...keys: K[] ): Pick<T, K> {
     const result = {} as Pick<T, K>;
   
     for (const key of keys) {
       if (Object.prototype.hasOwnProperty.call(obj, key)) {
         result[key] = obj[key];
       }
     }
   
     return result;
   }

   usage

   // before
   // import pick from 'lodash.pick';
   
   // after
   import { pick } from './utils/pick';
   
   const sanitizeFact = (fact: IFact): IFact =>
     pick(fact, 'value', 'location') as IFact;
   
   const sanitizeChange = (change: IChange): IChange =>
     pick(change, 'changeType', 'added', 'removed', 'changed', 'location') as IChange;

   I can create a PR for this
3. roli-lpci

   added a commit that references this issue on Feb 26, 2026

   chore: replace lodash.pick with native implementation

   ...

   This issue will close once commit fb31909 is merged into the 'main' branch.

   fb31909