Transitive deps audit: lodash duplicate + react-is@16 coexisting with React 19

[stephane-rault-orbic]

Summary

We are using @ant-design/pro-components@^2.7.0 in our React 19 + Vite project. After auditing our package-lock.json, we found two transitive dependency issues that cause unnecessary bundle weight and potential React 19 compatibility warnings.

Issue 1 — lodash + lodash-es duplicate (two versions)

Running npm ls lodash and npm ls lodash-es shows two versions of each:

Package	Version	Source
lodash	4.18.1	@ant-design/pro-components → @ant-design/pro-field, @ant-design/pro-form, @ant-design/pro-layout, @ant-design/pro-table, @ant-design/pro-utils
lodash	4.17.23	@refinedev/core → same @ant-design/pro-layout sub-package
lodash-es	4.18.1	Same pro-components sub-packages
lodash-es	4.17.23	@refinedev/antd → @ant-design/pro-layout

@ant-design/pro-components sub-packages depend on both lodash (CJS) and lodash-es (ESM), and two minor versions of each end up in the tree. This means Rollup/Vite cannot deduplicate them, adding ~140 KB to the bundle unnecessarily.

Request: migrate all @ant-design/pro-* sub-packages to use lodash-es exclusively (as the ESM project standard), removing the lodash CJS dependency. This would also reduce tree-shaking friction.

Issue 2 — react-is@16 transitive with React 19

@ant-design/pro-components
└─┬ @ant-design/pro-list
  └─┬ rc-util@4.21.1
    └── react-is@16.13.1

react-is@16.13.1 (from rc-util@4.21.1) coexists with React 19 in our project. While this is not always a hard break, React 19 deprecated several lifecycle methods that react-lifecycles-compat and react-is@16 rely on. This can trigger runtime warnings and is flagged by React 19's strict mode.

Request: bump rc-util to a version that depends on react-is@17 or later (which @ant-design/icons already does via rc-util@5.44.4 → react-is@18.3.1).

Evidence

From package-lock.json in our project (Donna, a React 19 internal tool):

# npm ls lodash (excerpt)
└─┬ @ant-design/pro-components@2.8.10
  ├─┬ @ant-design/pro-field@3.1.0
  │ └── lodash@4.18.1
  └─┬ @ant-design/pro-utils@2.18.0
    └── lodash@4.17.23 (via @refinedev/core sub-tree)

# npm ls react-is (excerpt)
└─┬ @ant-design/pro-components@2.8.10
  └─┬ @ant-design/pro-list@2.6.10
    └─┬ rc-util@4.21.1
      └── react-is@16.13.1   ← old

Questions

1. Is there a plan to migrate @ant-design/pro-* to lodash-es-only? (This is a known issue in the React ecosystem with ant-design packages.)
2. Is rc-util planned to be bumped to 5.x in @ant-design/pro-list to get react-is@18?
3. If upstream cannot address these soon, we will evaluate patch-package as a local workaround — would you accept a PR for the lodash migration?

Thank you for maintaining this excellent library.

---

Reported from project Donna (internal tool). lodash audit: 2 versions × 2 variants (CJS+ESM) = ~140 KB extra bundle. react-is: strict mode warnings on React 19.

[zzjiaxiang]

2.x seems to be no longer maintained, try upgrading to a newer version