Maintenance: Replace `lodash.merge` with a custom deep merge utility function

[sdangol]

Summary

We're using a third party dependency, lodash.merge on our Logger utility. We would want to replace the dependency on this library and implement our own deep merge utility function.

Why is this needed?

We would ideally want minimal dependency on other third party libraries

Which area does this relate to?

Logger

Solution

No response

Acknowledgment

• This request meets Powertools for AWS Lambda (TypeScript) Tenets
• Should this be considered in other Powertools for AWS Lambda languages? i.e. Python, Java, and .NET

Future readers

Please react with 👍 and your use case to help us understand customer demand.

[dreamorosi]

Good idea, this will also remove the last CJS only dependency from Logger, as well as the last 3P one.

[jaimellamasi]

happy to help with this, any clue on implementation details?

[sdangol]

Sure @jaimellamasi, thanks for the offer. I'll assign it to you.

Regarding the implementation details, I'd assume, for primitives, merging would just be an override from the source to the destination. For arrays/objects, we'd need to merge them recursively preventing circular reference. Our common utilities functions reside in the commons package, which we then use to replace the current lodash.merge implementations on the Logger utility.

[svozza]

Let's make sure we add defences against prototype pollution in this function. In addition to the checks listed here, we should explicitly check for __proto__ and constructor keys and ignore them.

[rcaughtlaf]

IMO, you're better off implementing with something modern like https://remedajs.com/docs/#mergeDeep