Replace per-method packages with the main lodash package.

[garg3133]

As this page states, use of the per-method lodash packages is discouraged: https://lodash.com/per-method-packages and these packages are no longer updated. So, we should replace all the per-method lodash packages with just the main lodash package.

This PR does so for the lodash.pick package only for now to fix the security vulnerability in that package, so that we can put the fix in the next planned Nightwatch release.

For the other similar per-method packages, we can replace them with lodash afterwards, as these upgrades may require some more attention to ensure we don't end up breaking anything.

Fixes: #4003

[github-actions]

Status

• ❌ No modified files found in the types directory.
  Please make sure to include types for any changes you have made. Thank you!.

[garg3133]

Opened #4006 to track updates for other per-method packages.

[beatfactor]

@garg3133 isn't it possible to just upgrade the lodash.pick? if we opt for adding the entire lodash as a dependency than we should also remove the other lodash.something packages and have just the main one.

[garg3133]

@beatfactor lodash.pick is no longer updated (it was last updated 7 years ago, while lodash was last updated 3 years ago).

Okay, I'll try to replace other per-method packages as well.

[garg3133]

@beatfactor I had to revert lodash.clone change because since that commit most of our tests in CI are timing out across all the platforms and node versions, and even after 20 mins the CI is still running.

(Tests are passing within usual time after reverting that change.)

[garg3133]

The issue with lodash.clone seems to be that we are currently using the v3 of lodash.clone but replacing it with the lodash package will result in us using the v4, which might be having some breaking changes and hence the tests are timing out/failing.

Even if we upgrade lodash.clone to v4 instead of replacing it with lodash directly, tests still fail. So, we'd need to first migrate our usage of lodash.clone to v4 and then replace it with lodash.

[garg3133]

Starting with v4, clone can no longer be used for deep copy, so had to use cloneDeep instead.

[BeniRupp]

Can we backport this to version 2.6?

That would be very helpful to get rid of the vulnerability in lodash.pick.