lodash.pick

Registry deprecationdanger

The package is explicitly deprecated at package scope, with npm directing users to destructuring assignment syntax and no replacement package specified. This is a decisive adoption risk even though the source project remains active.

Release historydanger

The latest release was published in August 2016, with zero releases in the last 12 months despite a long history of 17 releases. The absence of recent package releases materially raises the risk that this dependency is no longer maintained as a standalone package.

Repo package mentioncaution

The repository name does not match lodash.pick and its README does not mention the package, which creates some uncertainty about the link. The mismatch is consistent with a monorepo sub-package, so this is only a caution.

Workflow auditcaution

All 8 workflows were analyzed with no untrusted checkouts, script injection, or top-level write permissions, and all 20 action references are pinned. Three high-confidence low-severity adhoc-package findings are a minor workflow hygiene concern only.