Version 9.0.0 Increased bundle size, probably due to lodash import

[ahedenholm-bonn]

Description

When trying to update to 9.0.0 we noticed that the bundle size of jsonwebtoken had increased quite a lot, making a small app of ours exceed a max size limit at a cloud platform.

It seems to us at least that it might be due to importing the whole lodash package in package.json instead of just the functions used, introduced in this commit: ecdf6cc

I realise this doesn't necessarily fit all that well under "bug", sorry in that case.

Reproduction

Here's two screenshots from bundlephobia comparing 8.5.1 vs 9.0.0

8.5.1:

9.0.0:

Environment

• Version of this library used: 9.0.0

[mulfyx]

const {includes, isBoolean, isInteger, isNumber, isPlainObject, isString, once} = require('lodash')

the guys really need lodash for Array#includes and typeof 💀💀💀

[Uzlopak]

Created a PR #879 which removes lodash with equivalent.

[Uzlopak]

Also created a PR for removing semver

So I guesstimate, that when those two PRs get merged the bundle size shrinks t 20kb?

[BeenaCelin]

When can we expect this fix? As our app is impacted in bundled size due to this new version (9.0.0)[our app(edgelambda) is associated with cloudfront viewe request , and the viewer request quota limit is 1 MB for cloudfront. Kindly let us know the ETC for this fix and release

[Uzlopak]

@BeenaCelin
When I see when the last release before v9 was, I assume that this project is basically unmaintained. Maybe it is worth to switch to fast-jwt?

[rajeev5rhyme]

@Uzlopak :Are going to release new version of jsonwebtoken with shrinked loadash size? Is jsonwebtoken and fast-jwt has same feature?

[Uzlopak]

I am not a maintainer of jsonwebtoke and i dont want to fork and release a patched version.