node-lodash - Debian Package Tracker

general

source: node-lodash (main)
version: 4.18.1+dfsg1-1
maintainer: Debian Javascript Maintainers (archive) (DMD)
uploaders: Pirate Praveen [DMD] – Matthew Pideil [DMD] – Valentin OVD [DMD]
arch: all
std-ver: 4.7.4
VCS: Git (Browse, QA)

versions [more versions can be listed by madison] [old versions available from snapshot.debian.org]

[pool directory]

o-o-stable: 4.17.21+dfsg+~cs8.31.173-1
o-o-sec: 4.17.21+dfsg+~cs8.31.173-1+deb11u1
oldstable: 4.17.21+dfsg+~cs8.31.198.20210220-9
stable: 4.17.21+dfsg+~cs8.31.198.20210220-9
stable-p-u: 4.17.21+dfsg+~cs8.31.198.20210220-9+deb13u1
testing: 4.18.1+dfsg-3
unstable: 4.18.1+dfsg1-1

versioned links

4.17.21+dfsg+~cs8.31.173-1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
4.17.21+dfsg+~cs8.31.173-1+deb11u1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
4.17.21+dfsg+~cs8.31.198.20210220-9: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
4.17.21+dfsg+~cs8.31.198.20210220-9+deb13u1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
4.18.1+dfsg-3: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
4.18.1+dfsg1-1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]

binaries

libjs-lodash
node-lodash (1 bugs: 0, 1, 0, 0)
node-lodash-packages

action needed

lintian reports 1 error and 20 warnings high

Lintian reports 1 error and 20 warnings about this package. You should make the package lintian clean getting rid of them.

Created: 2026-04-19 Last update: 2026-07-25 03:00

The package has not entered testing even though the delay is over normal

The package has not entered testing even though the 5-day delay is over. Check why.

Created: 2026-07-30 Last update: 2026-08-01 13:01

12 new commits since last upload, is it time to release? normal

vcswatch reports that this package seems to have new commits in its VCS but has not yet updated debian/changelog. You should consider updating the Debian changelog and uploading this new version into the archive.

Here are the relevant commit logs:

commit 6ba2804ab018d84c91996bb91d3f96d3106cc11b
Author: Bastien Roucariès <rouca@debian.org>
Date:   Thu Jul 23 10:45:19 2026 +0200

    Finalize

commit b1fbe0ce83e533554058e61643b72bb363d8242d
Author: Bastien Roucariès <rouca@debian.org>
Date:   Thu Jul 23 10:27:23 2026 +0200

    Install @types

commit 8d263148f73282fa12139509da340977c3001abc
Author: Bastien Roucariès <rouca@debian.org>
Date:   Wed Jul 22 10:53:07 2026 +0200

    Revert attempt to generate types
    
    Gbp-Dch: ignore

commit b7e04fb67970a684e43a844d9add74c0e475826c
Author: Xavier Guimard <yadd@debian.org>
Date:   Tue Jul 21 22:55:30 2026 +0200

    Commit changelog generated by gbp-dch

commit b4cba79fd3c29009340d74ca732a374660838761
Merge: ec69764 3e1bb47
Author: Xavier Guimard <yadd@debian.org>
Date:   Tue Jul 21 22:52:02 2026 +0200

    Update upstream source from tag 'upstream/4.18.1+dfsg1'
    
    Update to upstream version '4.18.1+dfsg1'
    with Debian dir c81eb2fbf3b982ba3ad20926b4434bd064451cac

commit 3e1bb479bb0466863dece6a8250b0975c07a419d
Author: Xavier Guimard <yadd@debian.org>
Date:   Tue Jul 21 22:51:19 2026 +0200

    New upstream version 4.18.1+dfsg1

commit ec6976425034c7d649589f25aca59b9d743713f9
Author: Xavier Guimard <yadd@debian.org>
Date:   Tue Jul 21 22:25:17 2026 +0200

    Clean debian/watch
    
    Gbp-Dch: ignore

commit 355d880fd75053301b55ca6a3b58ff3d92ec6a99
Author: Bastien Roucariès <rouca@debian.org>
Date:   Tue Jul 21 11:21:51 2026 +0200

    Correct a typo

commit 673abda21d1833d3fdf0f945ef5ddf3c7f740b92
Author: Bastien Roucariès <rouca@debian.org>
Date:   Mon Jul 20 23:36:51 2026 +0200

    Add types-es

commit 3a16d4a075a4af0b8350f595f1e6f96a185e8957
Author: Bastien Roucariès <rouca@debian.org>
Date:   Mon Jul 20 23:28:31 2026 +0200

    Use lodash instead of index for installed file

commit 04fd9abccd33675389999f5724dad74d73fa0e8f
Author: Bastien Roucariès <rouca@debian.org>
Date:   Mon Jul 20 23:18:43 2026 +0200

    Fix test

commit 81def60b3400c6e6e263bcdc1eda77180844a10b
Author: Bastien Roucariès <rouca@debian.org>
Date:   Mon Jul 20 22:57:43 2026 +0200

    Add types test

https://salsa.debian.org/api/v4/projects/js-team%2Fnode-lodash API request failed: 401 Unauthorized at /srv/qa.debian.org/data/vcswatch/vcswatch line 410.

Created: 2026-07-20 Last update: 2026-07-30 10:01

debian/patches: 3 patches to forward upstream low

Among the 5 debian patches available in version 4.18.1+dfsg1-1 of the package, we noticed the following issues:

3 patches where the metadata indicates that the patch has not yet been forwarded upstream. You should either forward the patch upstream or update the metadata to document its real status.

Created: 2023-02-26 Last update: 2026-07-25 10:30

3 low-priority security issues in trixie low

There are 3 open security issues in trixie.

3 issues left for the package maintainer to handle:

CVE-2026-2950: (needs triaging) Impact: Lodash versions 4.17.23 and earlier are vulnerable to prototype pollution in the _.unset and _.omit functions. The fix for (CVE-2025-13465: https://github.com/lodash/lodash/security/advisories/GHSA-xxjr-mmjv-4gpg) only guards against string key members, so an attacker can bypass the check by passing array-wrapped path segments. This allows deletion of properties from built-in prototypes such as Object.prototype, Number.prototype, and String.prototype. The issue permits deletion of prototype properties but does not allow overwriting their original behavior. Patches: This issue is patched in 4.18.0. Workarounds: None. Upgrade to the patched version.
CVE-2026-4800: (needs triaging) Impact: The fix for CVE-2021-23337 (https://github.com/advisories/GHSA-35jh-r3h4-6jhm) added validation for the variable option in _.template but did not apply the same validation to options.imports key names. Both paths flow into the same Function() constructor sink. When an application passes untrusted input as options.imports key names, an attacker can inject default-parameter expressions that execute arbitrary code at template compilation time. Additionally, _.template uses assignInWith to merge imports, which enumerates inherited properties via for..in. If Object.prototype has been polluted by any other vector, the polluted keys are copied into the imports object and passed to Function(). Patches: Users should upgrade to version 4.18.0. Workarounds: Do not pass untrusted input as key names in options.imports. Only use developer-controlled, static key names.
CVE-2025-13465: (needs triaging) Lodash versions 4.0.0 through 4.17.22 are vulnerable to prototype pollution in the _.unset and _.omit functions. An attacker can pass crafted paths which cause Lodash to delete methods from global prototypes. The issue permits deletion of properties but does not allow overwriting their original behavior. This issue is patched on 4.17.23

You can find information about how to handle these issues in the security team's documentation.

Created: 2026-01-21 Last update: 2026-07-24 21:30

testing migrations

excuses:
- Migration status for node-lodash (4.18.1+dfsg-3 to 4.18.1+dfsg1-1): BLOCKED: Rejected/violates migration policy/introduces a regression
- Issues preventing migration:
- ∙ ∙ Autopkgtest for jupyterlab/4.1.8+ds1+~2.0.1+~0.15.3+~cs1.4.4-8: loong64: Pass ♻ (reference ♻), s390x: Pass ♻ (reference ♻)
- ∙ ∙ Autopkgtest for jupyterlab/4.4.10+ds1+~3.1.0+~0.16.6+~cs1.4.4-3: amd64: Pass, arm64: Pass, armhf: Pass, i386: Regression ♻ (reference ♻), ppc64el: Pass, riscv64: Regression ♻ (reference ♻)
- ∙ ∙ Autopkgtest for node-lodash/4.18.1+dfsg1-1: amd64: Regression ♻ (reference ♻), arm64: Regression ♻ (reference ♻), armhf: Regression ♻ (reference ♻), i386: Regression ♻ (reference ♻), loong64: Regression ♻ (reference ♻), ppc64el: Regression ♻ (reference ♻), riscv64: Regression ♻ (reference ♻), s390x: Regression ♻ (reference ♻)
- Additional info (not blocking):
- ∙ ∙ Piuparts tested OK - https://piuparts.debian.org/sid/source/n/node-lodash.html
- ∙ ∙ Reproduced on amd64 - info
- ∙ ∙ Reproduced on arm64 - info
- ∙ ∙ Reproduced on armhf - info
- ∙ ∙ Reproduced on i386 - info
- ∙ ∙ 7 days old (needed 5 days)
- Not considered

news

[rss feed]

[2026-07-25] Accepted node-lodash 4.17.21+dfsg+~cs8.31.198.20210220-9+deb13u1 (source) into proposed-updates (Debian FTP Masters) (signed by: Utkarsh Gupta)
[2026-07-24] Accepted node-lodash 4.18.1+dfsg1-1 (source) into unstable (Bastien Roucariès) (signed by: Bastien ROUCARIÈS)
[2026-07-01] Accepted node-lodash 4.17.21+dfsg+~cs8.31.173-1+deb11u1 (source) into oldoldstable-security (Utkarsh Gupta)
[2026-04-24] node-lodash 4.18.1+dfsg-3 MIGRATED to testing (Debian testing watch)
[2026-04-19] Accepted node-lodash 4.18.1+dfsg-3 (source) into unstable (Xavier Guimard)
[2026-04-17] node-lodash 4.18.1+dfsg-2 MIGRATED to testing (Debian testing watch)
[2026-04-11] Accepted node-lodash 4.18.1+dfsg-2 (source) into unstable (Xavier Guimard)
[2026-04-07] node-lodash 4.18.1+dfsg-1 MIGRATED to testing (Debian testing watch)
[2026-04-02] Accepted node-lodash 4.18.1+dfsg-1 (source) into unstable (Yadd) (signed by: Xavier Guimard)
[2026-02-12] node-lodash 4.17.23+dfsg-1 MIGRATED to testing (Debian testing watch)
[2026-02-06] Accepted node-lodash 4.17.23+dfsg-1 (source) into unstable (Yadd) (signed by: Xavier Guimard)
[2026-02-01] Accepted node-lodash 4.17.21+dfsg+~cs8.31.198.20210220-10 (source) into unstable (Utkarsh Gupta)
[2022-05-29] node-lodash 4.17.21+dfsg+~cs8.31.198.20210220-9 MIGRATED to testing (Debian testing watch)
[2022-05-23] Accepted node-lodash 4.17.21+dfsg+~cs8.31.198.20210220-9 (source) into unstable (Yadd) (signed by: Xavier Guimard)
[2022-04-15] node-lodash 4.17.21+dfsg+~cs8.31.198.20210220-8 MIGRATED to testing (Debian testing watch)
[2022-04-07] Accepted node-lodash 4.17.21+dfsg+~cs8.31.198.20210220-8 (source) into unstable (Jérémy Lal)
[2022-04-06] Accepted node-lodash 4.17.21+dfsg+~cs8.31.198.20210220-7 (source) into unstable (Yadd) (signed by: Xavier Guimard)
[2022-03-19] Accepted node-lodash 4.17.21+dfsg+~cs8.31.198.20210220-6 (source) into experimental (Yadd) (signed by: Xavier Guimard)
[2021-12-15] node-lodash 4.17.21+dfsg+~cs8.31.198.20210220-5 MIGRATED to testing (Debian testing watch)
[2021-12-10] Accepted node-lodash 4.17.21+dfsg+~cs8.31.198.20210220-5 (source) into unstable (Yadd) (signed by: Xavier Guimard)
[2021-12-08] Accepted node-lodash 4.17.21+dfsg+~cs8.31.198.20210220-4 (source) into unstable (Yadd) (signed by: Xavier Guimard)
[2021-12-08] Accepted node-lodash 4.17.21+dfsg+~cs8.31.198.20210220-3 (source) into experimental (Yadd) (signed by: Xavier Guimard)
[2021-11-28] Accepted node-lodash 4.17.21+dfsg+~cs8.31.198.20210220-2 (source) into experimental (Yadd) (signed by: Xavier Guimard)
[2021-11-28] Accepted node-lodash 4.17.21+dfsg+~cs8.31.198.20210220-1 (source) into experimental (Yadd) (signed by: Xavier Guimard)
[2021-10-12] node-lodash 4.17.21+dfsg+~cs8.31.196.20210220-2 MIGRATED to testing (Debian testing watch)
[2021-10-06] Accepted node-lodash 4.17.21+dfsg+~cs8.31.196.20210220-2 (source) into unstable (Yadd) (signed by: Xavier Guimard)
[2021-10-06] Accepted node-lodash 4.17.21+dfsg+~cs8.31.196.20210220-1 (source) into unstable (Yadd) (signed by: Xavier Guimard)
[2021-10-04] Accepted node-lodash 4.17.21+dfsg+~cs8.31.189.20210220-3 (source) into unstable (Bastien Roucariès) (signed by: Bastien ROUCARIÈS)
[2021-10-02] Accepted node-lodash 4.17.21+dfsg+~cs8.31.189.20210220-2~bpo11+1 (source all) into bullseye-backports, bullseye-backports (Debian FTP Masters) (signed by: Praveen Arimbrathodiyil)
[2021-08-21] node-lodash 4.17.21+dfsg+~cs8.31.189.20210220-2 MIGRATED to testing (Debian testing watch)

bugs [bug history graph]

all: 1
RC: 0
I&N: 1
M&W: 0
F&P: 0
patch: 0

links

homepage
lintian (1, 20)
buildd: logs, reproducibility
popcon
browse source code
other distros
security tracker
debian patches
debci

ubuntu

[Information about Ubuntu for Debian Developers]

version: 4.18.1+dfsg-3