Merge pull request #279905 in DEC/fineui from master to feature/x

* commit 'b74eba39f0a817f6024895e6fb7aa5772c965f8e':
  REPORT-122294 lodash 低版本安全漏洞

packages/fineui/src/core/1.lodash.js

@@ -14,7 +14,7 @@
     var undefined;
 
     /** Used as the semantic version number. */
-    var VERSION = '4.17.5';
+    var VERSION = '4.17.21';
 
     /** Used as the size to enable large array optimizations. */
     var LARGE_ARRAY_SIZE = 200;
@@ -899,7 +899,7 @@
     }
 
     /**
-     * Gets the value at `key`, unless `key` is "__proto__".
+     * Gets the value at `key`, unless `key` is "__proto__" or "constructor".
      *
      * @private
      * @param {Object} object The object to query.
@@ -907,6 +907,10 @@
      * @returns {*} Returns the property value.
      */
     function safeGet(object, key) {
+        if (key === 'constructor' && typeof object[key] === 'function') {
+            return;
+        }
+
         return key == '__proto__'
             ? undefined
             : object[key];