NewYour coding agent can read the release notes before it upgrades.Set up the MCP server →
npm · #101 most downloaded on npm
Lodash modular utilities.
Last release 6 months ago
01 Apr 2026
Ships unpredictably
gaps range from 9 days to 4.9 years
Rarely documented
notes for 2 of the last 60 stable releases
1 version withdrawn
withdrawn after publishing
14 years old
117 releases · first in 2012
Fixes a ReferenceError issue in lodash lodash-es lodash-amd and lodash.template when using the template and fromPairs functions from the modular build
Fixes a ReferenceError issue in lodash lodash-es lodash-amd and lodash.template when using the template and fromPairs functions from the modular builds. See #6167 (comment)
These defects were related to how lodash distributions are built from the main branch using https://github.com/lodash-archive/lodash-cli. When internal dependencies change inside lodash functions, equivalent updates need to be made to a mapping in the lodash-cli. (hey, it was ahead of its time once upon a time!). We know this, but we missed it in the last release. It's the kind of thing that passes in CI, but fails bc the build is not the same thing you tested.
There is no diff on main for this, but you can see the diffs for each of the npm packages on their respective branches:
lodash: 4.18.0-npm...4.18.1-npmlodash-es: 4.18.0-es...4.18.1-eslodash-amd: 4.18.0-amd...4.18.1-amdlodash.template4.18.0-npm-packages...4.18.1-npm-packagesOne column per quarter.
_.template : Fixed code injection via imports keys ( GHSA-r5fr-rjxr-66jc , CVE-2026-4800 , 879aaa9 ). Fixes an incomplete patch for CVE-2021-23337 . T…
Full Changelog: 4.17.23...4.18.0
_.unset / _.omit: Fixed prototype pollution via constructor/prototype path traversal (GHSA-f23m-r3pf-42rh, fe8d32e). Previously, array-wrapped path segments and primitive roots could bypass the existing guards, allowing deletion of properties from built-in prototypes. Now constructor and prototype are blocked unconditionally as non-terminal path keys, matching baseSet. Calls that previously returned true and deleted the property now return false and leave the target untouched.
_.template: Fixed code injection via imports keys (GHSA-r5fr-rjxr-66jc, CVE-2026-4800, 879aaa9). Fixes an incomplete patch for CVE-2021-23337. The variable option was validated against reForbiddenIdentifierChars but importsKeys was left unguarded, allowing code injection via the same Function() constructor sink. imports keys containing forbidden identifier characters now throw "Invalid imports option passed into _.template".
_.template in threat model and API docs (#6099)lower > upper behavior in _.random (#6115)_.compact jsdoc (#6090)lodash.* modular packagesWe have also regenerated and published a select number of the lodash.* modular packages.
These modular packages had fallen out of sync significantly from the minor/patch updates to lodash. Specifically, we have brought the following packages up to parity w/ the latest lodash release because they have had CVEs on them in the past:
Nothing published for this version
Nothing published for this version
Nothing published for this version
Nothing published for this version
Nothing published for this version
Nothing published for this version
Nothing published for this version
Nothing published for this version
Nothing published for this version
Nothing published for this version
Nothing published for this version
Nothing published for this version
Nothing published for this version
Nothing published for this version
Nothing published for this version
Nothing published for this version
Nothing published for this version
Nothing published for this version
Nothing published for this version
Nothing published for this version
Nothing published for this version
Nothing published for this version
Nothing published for this version
Nothing published for this version
Nothing published for this version
Nothing published for this version
Nothing published for this version
Nothing published for this version
Nothing published for this version
Nothing published for this version
Nothing published for this version
Nothing published for this version
Nothing published for this version
Nothing published for this version
Nothing published for this version
Nothing published for this version
Nothing published for this version
Nothing published for this version
Nothing published for this version
Nothing published for this version
Nothing published for this version
Nothing published for this version
Nothing published for this version
Nothing published for this version
Nothing published for this version
Nothing published for this version
Nothing published for this version
Nothing published for this version
Nothing published for this version
Nothing published for this version
Nothing published for this version
Nothing published for this version
Nothing published for this version
We’ve introduced more breaking changes in this release than any other so be sure to check out the changelog for a full rundown of changes & give lodas…
2015 was big year! Lodash became the most depended on npm package, passed 1 billion downloads, & its v3 release saw massive adoption!
The year was also one of collaboration, as discussions began on merging Lodash & Underscore. Much of Lodash v4 is proofing out the ideas from those discussions. Lodash v4 would not be possible without the collaboration & contributions of the Underscore core team. In the spirit of merging our teams have blended with several members contributing to both libraries.
For 2016 & lodash v4.0.0 we wanted to cut loose, push forward, & take things up a notch!
With v4 we’re breaking free from old projects, old environments, & dropping old IE < 9 support!
Lodash’s kitchen-sink size will continue to grow as new methods & functionality are added. However, we now offer a 4 kB (gzipped) core build that’s compatible with Backbone v1.2.4 for folks who want Lodash without lugging around the kitchen sink.
We’ve continued to embrace ES6 with methods like _.isSymbol, added support for cloning & comparing array buffers, maps, sets, & symbols, converting iterators to arrays, & iterable _(…).
In addition, we’ve published an es-build & pulled babel-plugin-lodash into core to make tree-shaking a breeze.
Pop quiz! 📣
What category path does the bindAll method belong to? Is it
A) require('lodash/function/bindAll')
B) require('lodash/utility/bindAll')
C) require('lodash/util/bindAll')
Don’t know? Well, with v4 it doesn’t matter because now module paths are as simple as
var bindAll = require('lodash/bindAll');
We’ve also reduced module complexity making it easier to create smaller bundles. This has helped Lodash adoption with libraries like Async & Redux!
With v3 we introduced lodash-fp. We learned a lot & with v4 we decided to pull it into core.
Now you can get immutable, auto-curried, iteratee-first, data-last methods as simply as
var _ = require('lodash/fp');
var object = { 'a': 1 };
var source = { 'b': 2 };
var newObject = _.assign(source)(object);
console.log(newObject);
// => { 'a': 1, 'b': 2 }
console.log(object);
// => { 'a': 1 }
var convert = require('lodash/fp/convert');
var assign = convert('assign', require('lodash.assign'));
// works too!
Well actually, while we’re excited about Chakra, Lodash is optimized for great performance across all engines. Unlike many libraries, we don’t favor a single engine so we can deliver solid performance & support regardless of engine.
With v4 we’ve continued our commitment to performance; expanding support for lazy evaluation & improving the performance of core functionality like circular reference detection.
Taking things up a notch Lodash v4 has added support for emojis! Includes things like astral symbols, unicode modifiers, variation selector characters, zero-width joiners, & regional indicator symbols.
<img src="https://cloud.githubusercontent.com/assets/4303/12280603/077c73ba-b944-11e5-900c-8463f8680612.png">
We’ve introduced more breaking changes in this release than any other so be sure to check out the changelog for a full rundown of changes & give lodash-migrate a spin to help migrate older Lodash code to the latest release.
If you dig Lodash don’t forget to star the repo or npm star lodash!
Nothing published for this version
Nothing published for this version
Nothing published for this version
Nothing published for this version
Your coding agent can read these notes before it upgrades. Set up the MCP server →