lodash - npm Package Compare versions

Comparing version 4.17.11 to 4.17.12

_baseClone.js

@@ -143,12 +143,6 @@ var Stack = require('./_Stack'),
     });
-
-    return result;
-  }
-
-  if (isMap(value)) {
+  } else if (isMap(value)) {
     value.forEach(function(subValue, key) {
       result.set(key, baseClone(subValue, bitmask, customizer, key, value, stack));
     });
-
-    return result;
   }
@@ -155,0 +149,0 @@

_baseMerge.js

@@ -25,4 +25,4 @@ var Stack = require('./_Stack'),
   baseFor(source, function(srcValue, key) {
+    stack || (stack = new Stack);
     if (isObject(srcValue)) {
-      stack || (stack = new Stack);
       baseMergeDeep(object, source, key, srcIndex, baseMerge, customizer, stack);
@@ -29,0 +29,0 @@ }

_createRound.js

@@ -6,3 +6,4 @@ var toInteger = require('./toInteger'),
 /* Built-in method references for those with the same name as other `lodash` methods. */
-var nativeMin = Math.min;
+var nativeIsFinite = root.isFinite,
+    nativeMin = Math.min;
 
@@ -21,3 +22,3 @@ /**
     precision = precision == null ? 0 : nativeMin(toInteger(precision), 292);
-    if (precision) {
+    if (precision && nativeIsFinite(number)) {
       // Shift with exponential notation to avoid floating-point issues.
@@ -24,0 +25,0 @@ // See [MDN](https://mdn.io/round#Examples) for more details.

_safeGet.js

 /**
- * Gets the value at `key`, unless `key` is "__proto__".
+ * Gets the value at `key`, unless `key` is "__proto__" or "constructor".
  *
@@ -10,2 +10,6 @@ * @private
 function safeGet(object, key) {
+  if (key === 'constructor' && typeof object[key] === 'function') {
+    return;
+  }
+
   if (key == '__proto__') {
@@ -12,0 +16,0 @@ return;

core.min.js

@@ -28,3 +28,3 @@ /**
 var t=null==n?0:n.length;return t?n[t-1]:Z},o.max=function(n){return n&&n.length?a(n,X,v):Z},o.min=function(n){return n&&n.length?a(n,X,_):Z},o.noConflict=function(){return on._===this&&(on._=vn),this},o.noop=function(){},o.reduce=C,o.result=function(n,t,r){return t=null==n?Z:n[t],t===Z&&(t=r),U(t)?t.call(n):t},o.size=function(n){return null==n?0:(n=M(n)?n:_n(n),n.length)},o.some=function(n,t,r){return t=r?Z:t,E(n,g(t))},o.uniqueId=function(n){var t=++sn;return Q(n)+t},o.each=z,o.first=q,Y(o,function(){
-var n={};return s(o,function(t,r){pn.call(o.prototype,r)||(n[r]=t)}),n}(),{chain:false}),o.VERSION="4.17.11",mn("pop join replace reverse split push shift sort splice unshift".split(" "),function(n){var t=(/^(?:replace|split)$/.test(n)?String.prototype:an)[n],r=/^(?:push|sort|unshift)$/.test(n)?"tap":"thru",e=/^(?:pop|join|replace|shift)$/.test(n);o.prototype[n]=function(){var n=arguments;if(e&&!this.__chain__){var u=this.value();return t.apply(Nn(u)?u:[],n)}return this[r](function(r){return t.apply(Nn(r)?r:[],n);
+var n={};return s(o,function(t,r){pn.call(o.prototype,r)||(n[r]=t)}),n}(),{chain:false}),o.VERSION="4.17.12",mn("pop join replace reverse split push shift sort splice unshift".split(" "),function(n){var t=(/^(?:replace|split)$/.test(n)?String.prototype:an)[n],r=/^(?:push|sort|unshift)$/.test(n)?"tap":"thru",e=/^(?:pop|join|replace|shift)$/.test(n);o.prototype[n]=function(){var n=arguments;if(e&&!this.__chain__){var u=this.value();return t.apply(Nn(u)?u:[],n)}return this[r](function(r){return t.apply(Nn(r)?r:[],n);
 })}}),o.prototype.toJSON=o.prototype.valueOf=o.prototype.value=function(){return w(this.__wrapped__,this.__actions__)},typeof define=="function"&&typeof define.amd=="object"&&define.amd?(on._=o, define(function(){return o})):cn?((cn.exports=o)._=o,un._=o):on._=o}).call(this);

debounce.js

@@ -176,2 +176,3 @@ var isObject = require('./isObject'),
         // Handle invocations in a tight loop.
+        clearTimeout(timerId);
         timerId = setTimeout(timerExpired, wait);
@@ -178,0 +179,0 @@ return invokeFunc(lastCallTime);

package.json

 {
   "name": "lodash",
-  "version": "4.17.11",
+  "version": "4.17.12",
   "description": "Lodash modular utilities.",
@@ -11,8 +11,8 @@ "keywords": "modules, stdlib, util",
   "main": "lodash.js",
-  "author": "John-David Dalton <[e-mail]> (http://allyoucanleet.com/)",
+  "author": "John-David Dalton <[e-mail]>",
   "contributors": [
-    "John-David Dalton <[e-mail]> (http://allyoucanleet.com/)",
-    "Mathias Bynens <[e-mail]> (https://mathiasbynens.be/)"
+    "John-David Dalton <[e-mail]>",
+    "Mathias Bynens <[e-mail]>"
   ],
   "scripts": { "test": "echo \"See https://travis-ci.org/lodash-archive/lodash-cli for testing details.\"" }
 }

README.md

@@ -1,2 +0,2 @@
-# lodash v4.17.11
+# lodash v4.17.12
 
@@ -31,3 +31,3 @@ The [Lodash](https://lodash.com/) library exported as [Node.js](https://nodejs.org/) modules.
 
-See the [package source](https://github.com/lodash/lodash/tree/4.17.11-npm) for more details.
+See the [package source](https://github.com/lodash/lodash/tree/4.17.12-npm) for more details.
 
@@ -39,3 +39,3 @@ **Note:**<br>
 
-Tested in Chrome 68-69, Firefox 61-62, IE 11, Edge 17, Safari 10-11, Node.js 6-10, & PhantomJS 2.1.1.<br>
+Tested in Chrome 74-75, Firefox 66-67, IE 11, Edge 18, Safari 11-12, & Node.js 8-12.<br>
 Automated [browser](https://saucelabs.com/u/lodash) & [CI](https://travis-ci.org/lodash/lodash/) test runs are available.

template.js

@@ -30,2 +30,8 @@ var assignInWith = require('./assignInWith'),
 
+/** Used for built-in method references. */
+var objectProto = Object.prototype;
+
+/** Used to check objects for own properties. */
+var hasOwnProperty = objectProto.hasOwnProperty;
+
 /**
@@ -166,3 +172,10 @@ * Creates a compiled template function that can interpolate data properties
   // Use a sourceURL for easier debugging.
-  var sourceURL = 'sourceURL' in options ? '//# sourceURL=' + options.sourceURL + '\n' : '';
+  // The sourceURL gets injected into the source that's eval-ed, so be careful
+  // with lookup (in case of e.g. prototype pollution), and strip newlines if any.
+  // A newline wouldn't be a valid sourceURL anyway, and it'd enable code injection.
+  var sourceURL = hasOwnProperty.call(options, 'sourceURL')
+    ? ('//# sourceURL=' +
+       (options.sourceURL + '').replace(/[\r\n]/g, ' ') +
+       '\n')
+    : '';
 
@@ -198,3 +211,5 @@ string.replace(reDelimiters, function(match, escapeValue, interpolateValue, esTemplateValue, evaluateValue, offset) {
   // code to add the data object to the top of the scope chain.
-  var variable = options.variable;
+  // Like with sourceURL, we take care to not check the option's prototype,
+  // as this configuration is a code injection vector.
+  var variable = hasOwnProperty.call(options, 'variable') && options.variable;
   if (!variable) {
@@ -201,0 +216,0 @@ source = 'with (obj) {\n' + source + '\n}\n';

New alerts

Dynamic require

Supply chain risk

Dynamic require can indicate the package is performing dangerous or unsafe dynamic code execution.

Found 1 instance in 1 package

Filesystem access

Supply chain risk

Accesses the file system, and could potentially read sensitive data.

Found 1 instance in 1 package

Improved metrics

Total package byte prevSize

1402075

increased by0.18%

Number of package files

1050

increased by0.1%

Lines of code

40664

increased by0.13%

Worsened metrics

Number of low supply chain risk alerts

2

increased byInfinity%

No dependency changes