unstale

npm / lodash

lodash

What changed in lodash 4, from its official release notes, upgrade guides and advisories. Sources checked 2026-10-17.

2 breaking10 security2 fixes and other

See which of these apply to your code, ranked, in your agent:

npx @unstale/cli init

@unstale/cli 0.1.0 on npm

lodash 414 changes

Breaking changes 2

  • Rejects imports keys containing forbidden identifier characters, preventing code injection through the Function constructor sink.

    4.18.0release notessecurity advisory

  • Blocks constructor and prototype path traversal, returning false and leaving the target untouched instead of deleting built-in prototype properties.

    4.18.0release notessecurity advisory

Security 10

  • The modular package was regenerated and published to parity with the latest lodash release because it previously had CVEs.

    4.18.0release notes

  • The modular package was regenerated and published to parity with the latest lodash release because it previously had CVEs.

    4.18.0release notes

  • The modular package was regenerated and published to parity with the latest lodash release because it previously had CVEs.

    4.18.0release notes

  • The modular package was regenerated and published to parity with the latest lodash release because it previously had CVEs.

    4.18.0release notes

  • The modular package was regenerated and published to parity with the latest lodash release because it previously had CVEs.

    4.18.0release notes

  • The modular package was regenerated and published to parity with the latest lodash release because it previously had CVEs.

    4.18.0release notes

  • The modular package was regenerated and published to parity with the latest lodash release because it previously had CVEs.

    4.18.0release notes

  • The modular package was regenerated and published to parity with the latest lodash release because it previously had CVEs.

    4.18.0release notes

  • The modular package was regenerated and published to parity with the latest lodash release because it previously had CVEs.

    4.18.0release notes

  • Blocks constructor and prototype path traversal, preventing deletion of properties from built-in prototypes.

    4.18.0release notessecurity advisory

Fixes and other changes 2

  • Fixed a ReferenceError when using fromPairs from modular builds.

    4.18.1release notes

  • Fixed a ReferenceError when using template from modular builds.

    4.18.1release notes