Rebuild lodash and docs.

lodash · Jul 9, 2019 · e77d681 · e77d681
1 parent 629d186
commit e77d681
Show file tree

Hide file tree

Showing 8 changed files with 468 additions and 463 deletions.
diff --git a/dist/lodash.core.js b/dist/lodash.core.js
@@ -2,7 +2,7 @@
  * @license
  * Lodash (Custom Build) <https://lodash.com/>
  * Build: `lodash core -o ./dist/lodash.core.js`
- * Copyright JS Foundation and other contributors <https://js.foundation/>
+ * Copyright OpenJS Foundation and other contributors <https://openjsf.org/>
  * Released under MIT license <https://lodash.com/license>
  * Based on Underscore.js 1.8.3 <http:https://underscorejs.org/LICENSE>
  * Copyright Jeremy Ashkenas, DocumentCloud and Investigative Reporters & Editors
@@ -13,7 +13,7 @@
  var undefined;
 
  /** Used as the semantic version number. */
- var VERSION = '4.17.11';
+ var VERSION = '4.17.12';
 
  /** Error message constants. */
  var FUNC_ERROR_TEXT = 'Expected a function';

diff --git a/dist/lodash.core.min.js b/dist/lodash.core.min.js
diff --git a/dist/lodash.js b/dist/lodash.js
@@ -1,7 +1,7 @@
 /**
  * @license
  * Lodash <https://lodash.com/>
- * Copyright JS Foundation and other contributors <https://js.foundation/>
+ * Copyright OpenJS Foundation and other contributors <https://openjsf.org/>
  * Released under MIT license <https://lodash.com/license>
  * Based on Underscore.js 1.8.3 <http:https://underscorejs.org/LICENSE>
  * Copyright Jeremy Ashkenas, DocumentCloud and Investigative Reporters & Editors
@@ -12,7 +12,7 @@
  var undefined;
 
  /** Used as the semantic version number. */
- var VERSION = '4.17.11';
+ var VERSION = '4.17.12';
 
  /** Used as the size to enable large array optimizations. */
  var LARGE_ARRAY_SIZE = 200;
@@ -2671,16 +2671,10 @@
  value.forEach(function(subValue) {
  result.add(baseClone(subValue, bitmask, customizer, subValue, value, stack));
  });
-
- return result;
- }
-
- if (isMap(value)) {
+ } else if (isMap(value)) {
  value.forEach(function(subValue, key) {
  result.set(key, baseClone(subValue, bitmask, customizer, key, value, stack));
  });
-
- return result;
  }
 
  var keysFunc = isFull
@@ -3604,8 +3598,8 @@
  return;
  }
  baseFor(source, function(srcValue, key) {
+ stack || (stack = new Stack);
  if (isObject(srcValue)) {
- stack || (stack = new Stack);
  baseMergeDeep(object, source, key, srcIndex, baseMerge, customizer, stack);
  }
  else {
@@ -5422,7 +5416,7 @@
  return function(number, precision) {
  number = toNumber(number);
  precision = precision == null ? 0 : nativeMin(toInteger(precision), 292);
- if (precision) {
+ if (precision && nativeIsFinite(number)) {
  // Shift with exponential notation to avoid floating-point issues.
  // See [MDN](https://mdn.io/round#Examples) for more details.
  var pair = (toString(number) + 'e').split('e'),
@@ -6605,14 +6599,18 @@
  }
 
  /**
- * Gets the value at `key`, unless `key` is "__proto__".
+ * Gets the value at `key`, unless `key` is "__proto__" or "constructor".
  *
  * @private
  * @param {Object} object The object to query.
  * @param {string} key The key of the property to get.
  * @returns {*} Returns the property value.
  */
  function safeGet(object, key) {
+ if (key === 'constructor' && typeof object[key] === 'function') {
+ return;
+ }
+
  if (key == '__proto__') {
  return;
  }
@@ -10413,6 +10411,7 @@
  }
  if (maxing) {
  // Handle invocations in a tight loop.
+ clearTimeout(timerId);
  timerId = setTimeout(timerExpired, wait);
  return invokeFunc(lastCallTime);
  }
@@ -14799,9 +14798,12 @@
  , 'g');
 
  // Use a sourceURL for easier debugging.
+ // The sourceURL gets injected into the source that's eval-ed, so be careful
+ // with lookup (in case of e.g. prototype pollution), and strip newlines if any.
+ // A newline wouldn't be a valid sourceURL anyway, and it'd enable code injection.
  var sourceURL = '//# sourceURL=' +
- ('sourceURL' in options
- ? options.sourceURL
+ (hasOwnProperty.call(options, 'sourceURL')
+ ? (options.sourceURL + '').replace(/[\r\n]/g, ' ')
  : ('lodash.templateSources[' + (++templateCounter) + ']')
  ) + '\n';
 
@@ -14834,7 +14836,9 @@
 
  // If `variable` is not specified wrap a with-statement around the generated
  // code to add the data object to the top of the scope chain.
- var variable = options.variable;
+ // Like with sourceURL, we take care to not check the option's prototype,
+ // as this configuration is a code injection vector.
+ var variable = hasOwnProperty.call(options, 'variable') && options.variable;
  if (!variable) {
  source = 'with (obj) {\n' + source + '\n}\n';
  }
@@ -17039,10 +17043,11 @@
  baseForOwn(LazyWrapper.prototype, function(func, methodName) {
  var lodashFunc = lodash[methodName];
  if (lodashFunc) {
- var key = (lodashFunc.name + ''),
- names = realNames[key] || (realNames[key] = []);
-
- names.push({ 'name': methodName, 'func': lodashFunc });
+ var key = lodashFunc.name + '';
+ if (!hasOwnProperty.call(realNames, key)) {
+ realNames[key] = [];
+ }
+ realNames[key].push({ 'name': methodName, 'func': lodashFunc });
  }
  });