fix price and modular

.output/server/node_modules/lodash-es/_baseUnset.js

@@ -3,6 +3,12 @@ import last from './last.js';
 import parent from './_parent.js';
 import toKey from './_toKey.js';
 
+/** Used for built-in method references. */
+var objectProto = Object.prototype;
+
+/** Used to check objects for own properties. */
+var hasOwnProperty = objectProto.hasOwnProperty;
+
 /**
  * The base implementation of `_.unset`.
  *
@@ -13,8 +19,47 @@ import toKey from './_toKey.js';
  */
 function baseUnset(object, path) {
   path = castPath(path, object);
-  object = parent(object, path);
-  return object == null || delete object[toKey(last(path))];
+
+  // Prevent prototype pollution, see: https://github.com/lodash/lodash/security/advisories/GHSA-xxjr-mmjv-4gpg
+  var index = -1,
+      length = path.length;
+
+  if (!length) {
+    return true;
+  }
+
+  var isRootPrimitive = object == null || (typeof object !== 'object' && typeof object !== 'function');
+
+  while (++index < length) {
+    var key = path[index];
+
+    // skip non-string keys (e.g., Symbols, numbers)
+    if (typeof key !== 'string') {
+      continue;
+    }
+
+    // Always block "__proto__" anywhere in the path if it's not expected
+    if (key === '__proto__' && !hasOwnProperty.call(object, '__proto__')) {
+      return false;
+    }
+
+    // Block "constructor.prototype" chains
+    if (key === 'constructor' &&
+        (index + 1) < length &&
+        typeof path[index + 1] === 'string' &&
+        path[index + 1] === 'prototype') {
+
+      // Allow ONLY when the path starts at a primitive root, e.g., _.unset(0, 'constructor.prototype.a')
+      if (isRootPrimitive && index === 0) {
+        continue;
+      }
+
+      return false;
+    }
+  }
+
+  var obj = parent(object, path);
+  return obj == null || delete obj[toKey(last(path))];
 }
 
 export default baseUnset;

.output/server/node_modules/lodash-es/lodash.default.js

@@ -45,7 +45,7 @@ import toInteger from './toInteger.js';
 import lodash from './wrapperLodash.js';
 
 /** Used as the semantic version number. */
-var VERSION = '4.17.21';
+var VERSION = '4.17.23';
 
 /** Used to compose bitmasks for function metadata. */
 var WRAP_BIND_KEY_FLAG = 2;

.output/server/node_modules/lodash-es/package.json

@@ -1,6 +1,6 @@
 {
   "name": "lodash-es",
-  "version": "4.17.21",
+  "version": "4.17.23",
   "description": "Lodash exported as ES modules.",
   "keywords": "es6, modules, stdlib, util",
   "homepage": "https://lodash.com/custom-builds",