Skip to content

Upgrading lodash 3 to 4

Breaking3.10.1 → 4.18.1Breaking3Security10New5Changed2Fixed1Other3

Full comparisonBack to lodash
BreakingUpgrade verdict

3 breaking changes and 10 security fixes.

In plain terms
  • Lodash 4 no longer works in very old browsers such as Internet Explorer 8 and earlier.
  • You can now import a single method without knowing its category folder.
  • Upgrading may require code changes; a migration tool is available.
  • A crafted path could delete properties from built-in JavaScript prototypes; that is now blocked.
Must act Top 5 of 13 that need code or config changes

lodash publishes an official migration guide for version 4. It covers more than the release notes do.

Lodash-migrate ↗

What you must change

Breaking3
Drops support for old environments, including IE versions below 9.
4.0.0GitHub ReleaseSummarizedView source
Simplifies module paths so methods load directly, e.g. require('lodash/bindAll').
bindAllrequire('lodash/bindAll')
4.0.0GitHub ReleaseSummarizedView source
Introduces more breaking changes than any prior release; see the changelog and lodash-migrate for migration help.
lodash-migrate
4.0.0GitHub ReleaseSummarizedView source
Security10
Fixes prototype pollution in _.unset and _.omit via constructor/prototype path traversal.
_.unset_.omitconstructorprototypebaseSetModerate · CVSS 6.5
4.18.0GitHub ReleaseSummarizedView source
Fixes code injection via _.template imports keys, completing the CVE-2021-23337 patch.
_.templateimportsvariablereForbiddenIdentifierCharsimportsKeysFunction()High · CVSS 8.1
4.18.0GitHub ReleaseSummarizedView source
Lodash has Prototype Pollution Vulnerability in _.unset and _.omit functions
Moderate · CVSS 6.5
4.17.23GitHub AdvisoryOriginalView source
Command Injection in lodash
High · CVSS 7.2
4.17.21GitHub AdvisoryOriginalView source
Regular Expression Denial of Service (ReDoS) in lodash
Moderate · CVSS 5.3
4.17.21GitHub AdvisoryOriginalView source
Prototype Pollution in lodash
High · CVSS 7.4
4.17.19GitHub AdvisoryOriginalView source
Prototype Pollution in lodash
Critical · CVSS 9.1
4.17.12GitHub AdvisoryOriginalView source
Prototype Pollution in lodash
High
4.17.11GitHub AdvisoryOriginalView source
Regular Expression Denial of Service (ReDoS) in lodash
Moderate · CVSS 6.5
4.17.11GitHub AdvisoryOriginalView source
Prototype Pollution in lodash
Moderate · CVSS 6.5
4.17.5GitHub AdvisoryOriginalView source