# What changed in lodash

> 14 changes in lodash 4 from its official release notes, upgrade guides and advisories: 2 breaking, 10 security. Each one cited. Sources checked 2026-10-17. HTML: https://unstale.sh/npm/lodash/

To see which of these apply to a repository, run `npx @unstale/cli init` in it.

## lodash 4

### Breaking changes

- Rejects imports keys containing forbidden identifier characters, preventing code injection through the Function constructor sink. (4.18.0) — [release notes](https://github.com/lodash/lodash/releases/tag/4.18.0), [security advisory](https://github.com/advisories/GHSA-R5FR-RJXR-66JC)
- Blocks constructor and prototype path traversal, returning false and leaving the target untouched instead of deleting built-in prototype properties. (4.18.0) — [release notes](https://github.com/lodash/lodash/releases/tag/4.18.0), [security advisory](https://github.com/advisories/GHSA-F23M-R3PF-42RH)

### Security

- The modular package was regenerated and published to parity with the latest lodash release because it previously had CVEs. (4.18.0) — [release notes](https://github.com/lodash/lodash/releases/tag/4.18.0)
- The modular package was regenerated and published to parity with the latest lodash release because it previously had CVEs. (4.18.0) — [release notes](https://github.com/lodash/lodash/releases/tag/4.18.0)
- The modular package was regenerated and published to parity with the latest lodash release because it previously had CVEs. (4.18.0) — [release notes](https://github.com/lodash/lodash/releases/tag/4.18.0)
- The modular package was regenerated and published to parity with the latest lodash release because it previously had CVEs. (4.18.0) — [release notes](https://github.com/lodash/lodash/releases/tag/4.18.0)
- The modular package was regenerated and published to parity with the latest lodash release because it previously had CVEs. (4.18.0) — [release notes](https://github.com/lodash/lodash/releases/tag/4.18.0)
- The modular package was regenerated and published to parity with the latest lodash release because it previously had CVEs. (4.18.0) — [release notes](https://github.com/lodash/lodash/releases/tag/4.18.0)
- The modular package was regenerated and published to parity with the latest lodash release because it previously had CVEs. (4.18.0) — [release notes](https://github.com/lodash/lodash/releases/tag/4.18.0)
- The modular package was regenerated and published to parity with the latest lodash release because it previously had CVEs. (4.18.0) — [release notes](https://github.com/lodash/lodash/releases/tag/4.18.0)
- The modular package was regenerated and published to parity with the latest lodash release because it previously had CVEs. (4.18.0) — [release notes](https://github.com/lodash/lodash/releases/tag/4.18.0)
- Blocks constructor and prototype path traversal, preventing deletion of properties from built-in prototypes. (4.18.0) — [release notes](https://github.com/lodash/lodash/releases/tag/4.18.0), [security advisory](https://github.com/advisories/GHSA-F23M-R3PF-42RH)

### Fixes and other changes

- Fixed a ReferenceError when using fromPairs from modular builds. (4.18.1) — [release notes](https://github.com/lodash/lodash/releases/tag/4.18.1)
- Fixed a ReferenceError when using template from modular builds. (4.18.1) — [release notes](https://github.com/lodash/lodash/releases/tag/4.18.1)