build(deps): Replace lodash with just-camel-case just-kebab-case just-split#399
build(deps): Replace lodash with just-camel-case just-kebab-case just-split#399honey32 wants to merge 1 commit into
lodash with just-camel-case just-kebab-case just-split#399Conversation
|
hi @honey32, thanks for your suggestion. Is there any vulnerability report for the 4.18.1 version of |
|
@islobodiuk-figma No, I'm just concerned about possibile discover of vulerability in the future |
|
Let me update, I'm losing confidence of using Now I think es-toolkit is OK. If you like this "cleaning-up"track, I would continue with postscript: I'm inspired by "e18e" docs: https://e18e.dev/learn/cleanup.html https://github.com/e18e/module-replacements/blob/main/docs/modules/lodash-underscore.md
|
lodashoften get reported as vulnerable for some of its functions, even if this package doesn't internally use the reported function. This vulnerability "propagation" feeds us up. 😫Then, I think this package has better have alternative and seperated dependencies (for each functions like camelcase, kebabCas, chunk).
(2026-05-25: I'm inspired by "e18e" movement. https://e18e.dev/learn/cleanup.html)
I found
justfamily seems to be nice in terms of compatibility(not 100% though), maintenance activeness, and good seperation.https://github.com/angus-c/just
preliminary investigation by AI Agent
Survey: Case-Conversion Libraries Compatible with lodash
Survey date: 2026-05-22
A survey of libraries that claim compatibility with lodash’s
-Casehelpers (camelCase,snakeCase, etc.) and packages focused on case conversion. From a supply chain security perspective, narrow-scope options (fewer dependencies, smaller attack surface) are preferred.Related: change-case Issue #351 (change-case is intentionally incompatible with lodash)
Summary
-Casehelpers” in their README.lodash.camelcase, etc., orimportfromlodash/camelCase)_separators at ambiguous boundaries)1. Full compatibility (the lodash implementation itself)
lodash.*case(per-method packages)Packages that export only case-conversion methods, discoverable via the
lodash-modularizedkeyword on npm.lodash.camelcase_.camelCaselodash.snakecase_.snakeCaselodash.kebabcase_.kebabCaselodash.startcase_.startCasenode_modules)import camelCase from 'lodash/camelCase'or named imports fromlodash-esSupply chain: Same implementation as core lodash. Per-method packages are effectively unmaintained (last published 8–10 years ago), so for new projects,
lodash/lodash-es+ path imports are more practical.2. Case-conversion focused, with “lodash-aligned” claims or mentions
tiny-case
camelCase,snakeCase,kebabCase,pascalCase,titleCase,sentenceCase,words,upperFirstin one packagepackage.jsonNarrow scope is good for supply chain, but it is closer to “a small implementation modeled on lodash” than “advertised lodash compatibility”.
camelcase (sindresorhus)
camelCaseonly (related:decamelize,camelcase-keys)capitalizeAfterNumber: true(default), docs state it aligns with many utilities such as Lodash-Casesuite; no drop-in guaranteeSupply chain: Good as a single-purpose, popular, low-dependency package, but not suitable when you need the full set of
-Casehelpers.just-camel-case / just-snake-case, etc. (angus-c/just)
just-camel-case,just-snake-case, etc.Supply chain: Single-purpose, zero-dependency, proven just family fits requirements well. Multiple
-Casehelpers mean more packages, but each tarball stays small.3. Explicit lodash compatibility, but broad scope
es-toolkit
es-toolkit/compatcamelCase,snakeCase,kebabCase,startCase,lowerCase,upperCase,capitalize, etc.es-toolkit/stringoffers a “modern, faster” API whose behavior can differ from compatSupply chain: Strong lodash alignment, but the compat layer is a wide lodash substitute, so the attack surface is larger than “string case only” unless you import only what you need.
4. Not lodash-compatible / does not claim to be
change-case vs lodash (from Issue #351)
Around numbers, change-case inserts
_by default (mergeAmbiguousCharacters: false).too legit 2 quittooLegit2QuittooLegit_2Quitwalk 500 mileswalk500Mileswalk_500Milesenable 6h formatenable6HFormatenable_6hFormatReason: Round-trip conversion (e.g.
xhr2Request→xhr2 request). SettingmergeAmbiguousCharacters: truemoves some cases closer to lodash.Comparison table
lodash/camelCase, etc. (lodash-es)lodash.camelcase, etc.Practical recommendations
lodash compatibility is the top priority
Use
lodash-es:Or:
Avoid adopting per-method
lodash.camelcasepackages for new work.Minimize dependency count (supply chain focus)
Use just
just-camel-case/just-snake-case, etc. (0 deps, single responsibility). Multiple case helpers mean more packages, but each tarball stays small.Bundle multiple case helpers in one package
tiny-case is a candidate, but it is safer if you pin lodash’s official test vectors in your own CI (because it only “mimics most” behavior).
Case-only libraries that say “lodash compatible” in the README
Within this survey, almost none exist. Options are mainly lodash per-method extractions, lodash-aligned reimplementations, or es-toolkit/compat.
Supply chain operations notes
pnpm-lock.yaml, runnpm audit; zero-dependency single-purpose packages (just family) often reduce attack surface versus one large utility libraryReferences
camelCasefunction appears incorrect