Version of **Lodash** before `4.17.12` seems to have vulnerabilities. From NVD - https://nvd.nist.gov/vuln/detail/cve-2019-10744 So you can consider merging https://github.com/schester44/react-access-control/pull/19 which has security patches.