Debian Patches
Status for node-lodash/4.17.21+dfsg+~cs8.31.198.20210220-9+deb13u1
| Patch | Description | Author | Forwarded | Bugs | Origin | Last update |
|---|---|---|---|---|---|---|
| support-globalThis.diff | Add support for globalThis when detecting global object Inspired from https://github.com/lodash/lodash/pull/4347/files | Xavier Guimard <yadd@debian.org> | not-needed | debian | 2020-01-30 | |
| webpack-4-compat.patch | Adapt for webpack version 4 | no | ||||
| fp_no_min.patch | disable (broken) internal minification | Jérémy Lal <kapouer@melix.org> | not-needed | 2022-04-07 | ||
| fix-for-webpack5.patch | drop unexistent plugin in webpack5 | Yadd <yadd@debian.org> | no | debian | 2022-05-23 | |
| CVE-2025-13465.patch | Prevent prototype pollution on baseUnset function * test: add tests to prevent security regressions * sec: prevent prototype pollution on `baseUnset` function * chore: improve security patch - Expand both `_.omit` & `_.unset` security tests to loop over `__proto__`, `constructor`, `prototype` - Only block `__proto__` if not an own property |
Ulises Gascón <ulisesgascongonzalez@gmail.com> | no | 2025-12-05 | ||
| CVE-2026-2950.patch | fix: block prototype pollution in baseUnset via constructor/prototype traversal Block `constructor` and `prototype` unconditionally as non-terminal traversal keys in baseUnset, matching the approach already used by baseSet. The previous guard only blocked the specific two-key sequence `constructor` → `prototype`, allowing attackers to: - Delete static methods from built-in constructors (Object.keys, Array.isArray, String.fromCharCode) via paths like `['constructor', 'keys']` - Delete built-in prototype methods (toFixed, toLowerCase, valueOf) via primitive roots like `_.unset(0, 'constructor.prototype.toFixed')` - Bypass checks entirely using array-wrapped path segments like `[['constructor'], ['keys']]` which evaded the string-only key check The primitive root exception that previously allowed constructor.prototype traversal from primitives (e.g., `_.unset(0, 'constructor.prototype.a')`) is removed as it enabled deletion of properties on shared built-in prototypes. Path segments are now normalized with toKey() before validation. |
Ulises Gascón <ulisesgascongonzalez@gmail.com> | not-needed | upstream | upstream, https://github.com/lodash/lodash/commit/fe8d32eda854377349a4f922ab7655c8e5df9a0b | 2026-03-30 |
| CVE-2026-4800.patch | fix: validate imports keys in _.template Fixes an incomplete patch for CVE-2021-23337. The `variable` option was validated against `reForbiddenIdentifierChars` but `importsKeys` was left unguarded, allowing code injection via the same `Function()` constructor sink. This patch: 1. Validates `importsKeys` against `reForbiddenIdentifierChars` 2. Replaces `assignInWith` with `assignWith` when merging imports |
Ulises Gascón <ulisesgascongonzalez@gmail.com> | not-needed | upstream | upstream, https://github.com/lodash/lodash/commit/879aaa93132d78c2f8d20c60279da9f8b21576d6 | 2026-03-30 |
| CVE-2026-4800-modular-template-deps.patch | fix lodash-cli dependency map for modular _.template build. The CVE-2026-4800 fix makes _.template use assignWith and arrayEach (and drop assignInWith). The Debian build regenerates the standalone lodash.template module via `lodash-cli modularize`, whose require() list is derived from this dependency map. Without updating the map, the generated lodash.template module fails at runtime with "ReferenceError: assignWith is not defined" (seen in the node-gulp-util autopkgtest). This mirrors upstream's regeneration in commit bbcb8a03deb54e2cd19f2f53e618e1fe194091bb, applied here to the CLI mapping since Debian rebuilds the modules from source rather than shipping upstream's pre-generated files. |
not-needed | upstream | vendor, Debian; corresponds to upstream https://github.com/lodash/lodash/commit/bbcb8a03deb54e2cd19f2f53e618e1fe194091bb | 2026-06-19 |
All known versions for source package 'node-lodash'
- 4.18.1+dfsg1-1 (sid)
- 4.18.1+dfsg-3 (forky)
- 4.17.21+dfsg+~cs8.31.198.20210220-9+deb13u1 (trixie-proposed-updates)
- 4.17.21+dfsg+~cs8.31.198.20210220-9 (bookworm, trixie)