As I understand it, the JavaScript library lodash was inspired by underscore.js and implements an similar API. According to Wikipedia it's a fork of underscore.js.
In my application, I use the latest version of Lodash (4.17.21). Some security software I use has flagged that this version of Lodash bundle an older version of underscore.js which contains security issues.
In GitHub, I can find the older version of Underscore.js in the following sub folder in the Lodash repo: https://github.com/lodash/lodash/tree/4.17/vendor/underscore
I have grep'ed the source code, and I get the impression that Lodash bundles underscore.js only as a reference and for some kind of testing. When I look at specific functions implemented by both Lodash/Underscore, the implementation seeps completely separate.
Does anyone know why the Lodash github account also include a copy of Underscore?
Full disclosure: I am currently maintaining Underscore.
You correctly inferred that Lodash does not depend on Underscore, at least not in production. Rather, it is a fork of Underscore that has diverged from the original to a very large degree over time, to the point that you don't recognize the original library anymore. If you look at the early commit history of Lodash, you can see that the author was still merging in changes from Underscore. This stopped after Underscore 1.3.3.
One of the ways in which Lodash diverged from Underscore is that its source code inflated dramatically (compare unminified Lodash (531 kB) to unminified Underscore (66.8 kB)). I think this partly explains why Lodash is nowadays only releasing rare security updates; the maintenance surface has become too large. Reading the Lodash code, you will also find that it is very difficult to trace how any given function works.
The vendor directory was supposed to be used in the tests and the performance comparisons. You can still see traces of this here and here. Underscore 1.8.3 is seven years old, so that is a clear sign that the performance tests have not been updated in a very long time.
In any case, your security scanning software is being over-cautious. Lodash was originally based on Underscore, but it does not depend on it.