Lodash has an open security vuln and shows signs of being borderline unmaintained.

Repro

1. Install typescript-eslint/eslint-plugin
2. Check your Snyk report (e.g. https://snyk.io/test/github/danielnixon/eslint-plugin-total-functions?targetFile=package.json)
3. Or run yarn audit / npm audit

Expected Result

No security vuln reported

Actual Result

Lodash security vuln reported

Additional Info

It looks like typescript-estree only uses lodash once, for unescape. unescape happens to be tiny and unlikely to evolve over time: https://github.com/lodash/lodash/blob/4.17.11/lodash.js#L15145

I'd be happy to raise a PR to inline unescape (or maybe replace it with https://www.npmjs.com/package/he or something) and remove the lodash dependency.

Versions

Latest