Lodash has anopen security vuln and showssigns of being borderline unmaintained.

Repro

1. Install typescript-eslint/eslint-plugin
2. Check your Snyk report (e.g.https://snyk.io/test/github/danielnixon/eslint-plugin-total-functions?targetFile=package.json)
3. Or run yarn audit / npm audit

Expected Result

No security vuln reported

Actual Result

Lodash security vuln reported

Additional Info

It looks like typescript-estree only uses lodash once, forunescape.unescape happens to be tiny and unlikely to evolve over time:https://github.com/lodash/lodash/blob/4.17.11/lodash.js#L15145

I'd be happy to raise a PR to inlineunescape (or maybe replace it withhttps://www.npmjs.com/package/he or something) and remove the lodash dependency.

Versions

Latest