Regression from #2697

Upstream at https://github.com/lodash/lodash/issues/5499

https://security.snyk.io/package/npm/lodash.set

I do wonder if that particular vulnerability will also just exist on the upstream library too? It looks like the code hasn’t changed since 2017: https://github.com/lodash/lodash/blame/master/set.js It may be a larger issue with how (and when) lodash issues these single function packages!