lodash-es - npm Package Compare versions

Comparing version 4.17.15 to 4.17.20

_baseClone.js

@@ -22,2 +22,3 @@ import Stack from './_Stack.js';
 import keys from './keys.js';
+import keysIn from './keysIn.js';
 
@@ -24,0 +25,0 @@ /** Used to compose bitmasks for cloning. */

_baseOrderBy.js

 import arrayMap from './_arrayMap.js';
+import baseGet from './_baseGet.js';
 import baseIteratee from './_baseIteratee.js';
@@ -8,2 +9,3 @@ import baseMap from './_baseMap.js';
 import identity from './identity.js';
+import isArray from './isArray.js';
 
@@ -20,4 +22,17 @@ /**
 function baseOrderBy(collection, iteratees, orders) {
+  if (iteratees.length) {
+    iteratees = arrayMap(iteratees, function(iteratee) {
+      if (isArray(iteratee)) {
+        return function(value) {
+          return baseGet(value, iteratee.length === 1 ? iteratee[0] : iteratee);
+        }
+      }
+      return iteratee;
+    });
+  } else {
+    iteratees = [identity];
+  }
+
   var index = -1;
-  iteratees = arrayMap(iteratees.length ? iteratees : [identity], baseUnary(baseIteratee));
+  iteratees = arrayMap(iteratees, baseUnary(baseIteratee));
 
@@ -24,0 +39,0 @@ var result = baseMap(collection, function(value, key, collection) {

_baseSet.js

@@ -32,2 +32,6 @@ import assignValue from './_assignValue.js';
 
+    if (key === '__proto__' || key === 'constructor' || key === 'prototype') {
+      return object;
+    }
+
     if (index != lastIndex) {
@@ -34,0 +38,0 @@ var objValue = nested[key];

_baseSortedIndexBy.js

@@ -25,7 +25,10 @@ import isSymbol from './isSymbol.js';
 function baseSortedIndexBy(array, value, iteratee, retHighest) {
+  var low = 0,
+      high = array == null ? 0 : array.length;
+  if (high === 0) {
+    return 0;
+  }
+
   value = iteratee(value);
-
-  var low = 0,
-      high = array == null ? 0 : array.length,
-      valIsNaN = value !== value,
+  var valIsNaN = value !== value,
       valIsNull = value === null,
@@ -32,0 +35,0 @@ valIsSymbol = isSymbol(value),

_equalArrays.js

@@ -30,6 +30,7 @@ import SetCache from './_SetCache.js';
   }
-  // Assume cyclic values are equal.
-  var stacked = stack.get(array);
-  if (stacked && stack.get(other)) {
-    return stacked == other;
+  // Check that cyclic values are equal.
+  var arrStacked = stack.get(array);
+  var othStacked = stack.get(other);
+  if (arrStacked && othStacked) {
+    return arrStacked == other && othStacked == array;
   }
@@ -36,0 +37,0 @@ var index = -1,

_equalObjects.js

@@ -42,6 +42,7 @@ import getAllKeys from './_getAllKeys.js';
   }
-  // Assume cyclic values are equal.
-  var stacked = stack.get(object);
-  if (stacked && stack.get(other)) {
-    return stacked == other;
+  // Check that cyclic values are equal.
+  var objStacked = stack.get(object);
+  var othStacked = stack.get(other);
+  if (objStacked && othStacked) {
+    return objStacked == other && othStacked == object;
   }
@@ -48,0 +49,0 @@ var result = true;

filter.js

@@ -42,2 +42,6 @@ import arrayFilter from './_arrayFilter.js';
  * // => objects for ['barney']
+ *
+ * // Combining several predicates using `_.overEvery` or `_.overSome`.
+ * _.filter(users, _.overSome([{ 'age': 36 }, ['age', 40]]));
+ * // => objects for ['fred', 'barney']
  */
@@ -44,0 +48,0 @@ function filter(collection, predicate) {

lodash.default.js

@@ -48,3 +48,3 @@ /**
 /** Used as the semantic version number. */
-var VERSION = '4.17.15';
+var VERSION = '4.17.20';
 
@@ -51,0 +51,0 @@ /** Used to compose bitmasks for function metadata. */

matches.js

@@ -19,2 +19,5 @@ import baseClone from './_baseClone.js';
  *
+ * **Note:** Multiple values can be checked by combining several matchers
+ * using `_.overSome`
+ *
  * @static
@@ -35,2 +38,6 @@ * @memberOf _
  * // => [{ 'a': 4, 'b': 5, 'c': 6 }]
+ *
+ * // Checking for several possible values
+ * _.filter(objects, _.overSome([_.matches({ 'a': 1 }), _.matches({ 'a': 4 })]));
+ * // => [{ 'a': 1, 'b': 2, 'c': 3 }, { 'a': 4, 'b': 5, 'c': 6 }]
  */
@@ -37,0 +44,0 @@ function matches(source) {

matchesProperty.js

@@ -16,2 +16,5 @@ import baseClone from './_baseClone.js';
  *
+ * **Note:** Multiple values can be checked by combining several matchers
+ * using `_.overSome`
+ *
  * @static
@@ -33,2 +36,6 @@ * @memberOf _
  * // => { 'a': 4, 'b': 5, 'c': 6 }
+ *
+ * // Checking for several possible values
+ * _.filter(objects, _.overSome([_.matchesProperty('a', 1), _.matchesProperty('a', 4)]));
+ * // => [{ 'a': 1, 'b': 2, 'c': 3 }, { 'a': 4, 'b': 5, 'c': 6 }]
  */
@@ -35,0 +42,0 @@ function matchesProperty(path, srcValue) {

overEvery.js

@@ -8,2 +8,6 @@ import arrayEvery from './_arrayEvery.js';
  *
+ * Following shorthands are possible for providing predicates.
+ * Pass an `Object` and it will be used as an parameter for `_.matches` to create the predicate.
+ * Pass an `Array` of parameters for `_.matchesProperty` and the predicate will be created using them.
+ *
  * @static
@@ -10,0 +14,0 @@ * @memberOf _

overSome.js

@@ -8,2 +8,6 @@ import arraySome from './_arraySome.js';
  *
+ * Following shorthands are possible for providing predicates.
+ * Pass an `Object` and it will be used as an parameter for `_.matches` to create the predicate.
+ * Pass an `Array` of parameters for `_.matchesProperty` and the predicate will be created using them.
+ *
  * @static
@@ -28,2 +32,5 @@ * @memberOf _
  * // => false
+ *
+ * var matchesFunc = _.overSome([{ 'a': 1 }, { 'a': 2 }])
+ * var matchesPropertyFunc = _.overSome([['a', 1], ['a', 2]])
  */
@@ -30,0 +37,0 @@ var overSome = createOver(arraySome);

package.json

 {
   "name": "lodash-es",
-  "version": "4.17.15",
+  "version": "4.17.20",
   "description": "Lodash exported as ES modules.",
@@ -10,2 +10,3 @@ "keywords": "es6, modules, stdlib, util",
   "license": "MIT",
+  "type": "module",
   "jsnext:main": "lodash.js",
@@ -12,0 +13,0 @@ "main": "lodash.js",

README.md

@@ -1,2 +0,2 @@
-# lodash-es v4.17.15
+# lodash-es v4.17.20
 
@@ -10,2 +10,2 @@ The [Lodash](https://lodash.com/) library exported as [ES](http://www.ecma-international.org/ecma-262/6.0/) modules.
 
-See the [package source](https://github.com/lodash/lodash/tree/4.17.15-es) for more details.
+See the [package source](https://github.com/lodash/lodash/tree/4.17.20-es) for more details.

sortBy.js

@@ -25,3 +25,3 @@ import baseFlatten from './_baseFlatten.js';
  *   { 'user': 'barney', 'age': 36 },
- *   { 'user': 'fred',   'age': 40 },
+ *   { 'user': 'fred',   'age': 30 },
  *   { 'user': 'barney', 'age': 34 }
@@ -31,6 +31,6 @@ * ];
  * _.sortBy(users, [function(o) { return o.user; }]);
- * // => objects for [['barney', 36], ['barney', 34], ['fred', 48], ['fred', 40]]
+ * // => objects for [['barney', 36], ['barney', 34], ['fred', 48], ['fred', 30]]
  *
  * _.sortBy(users, ['user', 'age']);
- * // => objects for [['barney', 34], ['barney', 36], ['fred', 40], ['fred', 48]]
+ * // => objects for [['barney', 34], ['barney', 36], ['fred', 30], ['fred', 48]]
  */
@@ -37,0 +37,0 @@ var sortBy = baseRest(function(collection, iteratees) {

template.js

@@ -172,7 +172,7 @@ import assignInWith from './assignInWith.js';
   // The sourceURL gets injected into the source that's eval-ed, so be careful
-  // with lookup (in case of e.g. prototype pollution), and strip newlines if any.
-  // A newline wouldn't be a valid sourceURL anyway, and it'd enable code injection.
+  // to normalize all kinds of whitespace, so e.g. newlines (and unicode versions of it) can't sneak in
+  // and escape the comment, thus injecting code that gets evaled.
   var sourceURL = hasOwnProperty.call(options, 'sourceURL')
     ? ('//# sourceURL=' +
-       (options.sourceURL + '').replace(/[\r\n]/g, ' ') +
+       (options.sourceURL + '').replace(/\s/g, ' ') +
        '\n')
@@ -210,4 +210,2 @@ : '';
   // code to add the data object to the top of the scope chain.
-  // Like with sourceURL, we take care to not check the option's prototype,
-  // as this configuration is a code injection vector.
   var variable = hasOwnProperty.call(options, 'variable') && options.variable;
@@ -214,0 +212,0 @@ if (!variable) {

New alerts

License Policy Violation

License

This package is not allowed per your license policy. Review the package's license to ensure compliance.

Found 1 instance in 1 package

New author

Supply chain risk

A new npm collaborator published a version of the package for the first time. New collaborators are usually benign additions to a project, but do indicate a change to the security surface area of a package.

Found 1 instance in 1 package

Fixed alerts

License Policy Violation

License

This package is not allowed per your license policy. Review the package's license to ensure compliance.

Found 1 instance in 1 package

Improved metrics

Total package byte prevSize

631044

increased by0.32%

Lines of code

19653

increased by0.26%

Is type module

Yes

Worsened metrics

Number of medium supply chain risk alerts

3

increased by50%

No dependency changes