VYPR
High severityNVD Advisory· Published Jul 30, 2024· Updated Aug 2, 2024

CVE-2024-38986

CVE-2024-38986

Description

A prototype pollution vulnerability in the 75lb/deep-merge NPM package (≤1.1.1) allows arbitrary code execution or denial of service through unsafe merging of untrusted objects.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

A prototype pollution vulnerability in the 75lb/deep-merge NPM package (≤1.1.1) allows arbitrary code execution or denial of service through unsafe merging of untrusted objects.

Vulnerability

Analysis

The vulnerability resides in the @75lb/deep-merge NPM package, versions up to and including 1.1.1. The package relies on vulnerable methods from lodash, such as merge, to combine objects [2]. This exposes a classic prototype pollution weakness: an attacker can supply a crafted object containing __proto__ or constructor.prototype properties. During the merge process, these special properties are traversed and assigned, allowing the pollution of the global Object.prototype [3].

Exploitation

Vector

Exploitation requires the attacker to supply a malicious JSON object to the merge function, as demonstrated in the public proof-of-concept (PoC) [3, 4]. No authentication or special privileges are needed if the application merges unsanitized user input. By simply including a key like "__proto__": {"polluted": true}, the attacker causes all subsequently created objects to inherit the polluted property. The PoC shows that after the merge, even a new empty object (victim) has the polluted attribute set to true [3, 4].

Impact

Successful prototype pollution can lead to severe consequences: denial of service (by breaking normal object behavior), remote code execution, or cross-site scripting, depending on how the application uses the polluted properties [2, 3, 4]. Since Object.prototype is shared across all objects, a single polluted property can alter the application's logic globally, potentially bypassing security checks or enabling arbitrary code execution.

Mitigation

Status

As of the latest disclosure, the maintainer has not released a security patch for this vulnerability [3]. Users are advised to sanitize and validate all JSON input, blocking keys such as __proto__ and constructor.prototype. Additional mitigations include freezing the root prototype with Object.freeze, performing schema validation of JSON input, avoiding unsafe recursive merge functions, using objects without prototypes (e.g., Object.create(null)), or using Map instead of Object [4].

AI Insight generated on May 20, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
@75lb/deep-mergenpm
< 1.1.21.1.2

Affected products

2

Patches

1
a68541fac3c2

Replace lodash.assignwith package with lodash/assignWith.js. Fixes #1

https://github.com/75lb/deep-mergeLloyd BrookesJul 31, 2024via ghsa
8 files changed · +2234 3299
  • dist/index.mjs+1156 370 modified
    @@ -1,22 +1,509 @@
    +var commonjsGlobal = typeof globalThis !== 'undefined' ? globalThis : typeof window !== 'undefined' ? window : typeof global !== 'undefined' ? global : typeof self !== 'undefined' ? self : {};
    +
    +function getDefaultExportFromCjs (x) {
    +	return x && x.__esModule && Object.prototype.hasOwnProperty.call(x, 'default') ? x['default'] : x;
    +}
    +
    +/** Detect free variable `global` from Node.js. */
    +
    +var freeGlobal$1 = typeof commonjsGlobal == 'object' && commonjsGlobal && commonjsGlobal.Object === Object && commonjsGlobal;
    +
    +var _freeGlobal = freeGlobal$1;
    +
    +var freeGlobal = _freeGlobal;
    +
    +/** Detect free variable `self`. */
    +var freeSelf = typeof self == 'object' && self && self.Object === Object && self;
    +
    +/** Used as a reference to the global object. */
    +var root$2 = freeGlobal || freeSelf || Function('return this')();
    +
    +var _root = root$2;
    +
    +var root$1 = _root;
    +
    +/** Built-in value references. */
    +var Symbol$2 = root$1.Symbol;
    +
    +var _Symbol = Symbol$2;
    +
    +var Symbol$1 = _Symbol;
    +
    +/** Used for built-in method references. */
    +var objectProto$7 = Object.prototype;
    +
    +/** Used to check objects for own properties. */
    +var hasOwnProperty$5 = objectProto$7.hasOwnProperty;
    +
     /**
    - * lodash (Custom Build) <https://lodash.com/>
    - * Build: `lodash modularize exports="npm" -o ./`
    - * Copyright jQuery Foundation and other contributors <https://jquery.org/>
    - * Released under MIT license <https://lodash.com/license>
    - * Based on Underscore.js 1.8.3 <http://underscorejs.org/LICENSE>
    - * Copyright Jeremy Ashkenas, DocumentCloud and Investigative Reporters & Editors
    + * Used to resolve the
    + * [`toStringTag`](http://ecma-international.org/ecma-262/7.0/#sec-object.prototype.tostring)
    + * of values.
      */
    +var nativeObjectToString$1 = objectProto$7.toString;
     
    -/** Used as references for various `Number` constants. */
    -var MAX_SAFE_INTEGER = 9007199254740991;
    +/** Built-in value references. */
    +var symToStringTag$1 = Symbol$1 ? Symbol$1.toStringTag : undefined;
    +
    +/**
    + * A specialized version of `baseGetTag` which ignores `Symbol.toStringTag` values.
    + *
    + * @private
    + * @param {*} value The value to query.
    + * @returns {string} Returns the raw `toStringTag`.
    + */
    +function getRawTag$1(value) {
    +  var isOwn = hasOwnProperty$5.call(value, symToStringTag$1),
    +      tag = value[symToStringTag$1];
    +
    +  try {
    +    value[symToStringTag$1] = undefined;
    +    var unmasked = true;
    +  } catch (e) {}
    +
    +  var result = nativeObjectToString$1.call(value);
    +  if (unmasked) {
    +    if (isOwn) {
    +      value[symToStringTag$1] = tag;
    +    } else {
    +      delete value[symToStringTag$1];
    +    }
    +  }
    +  return result;
    +}
    +
    +var _getRawTag = getRawTag$1;
    +
    +/** Used for built-in method references. */
    +
    +var objectProto$6 = Object.prototype;
    +
    +/**
    + * Used to resolve the
    + * [`toStringTag`](http://ecma-international.org/ecma-262/7.0/#sec-object.prototype.tostring)
    + * of values.
    + */
    +var nativeObjectToString = objectProto$6.toString;
    +
    +/**
    + * Converts `value` to a string using `Object.prototype.toString`.
    + *
    + * @private
    + * @param {*} value The value to convert.
    + * @returns {string} Returns the converted string.
    + */
    +function objectToString$1(value) {
    +  return nativeObjectToString.call(value);
    +}
    +
    +var _objectToString = objectToString$1;
    +
    +var Symbol = _Symbol,
    +    getRawTag = _getRawTag,
    +    objectToString = _objectToString;
     
     /** `Object#toString` result references. */
    -var argsTag = '[object Arguments]',
    -    funcTag = '[object Function]',
    -    genTag = '[object GeneratorFunction]';
    +var nullTag = '[object Null]',
    +    undefinedTag = '[object Undefined]';
     
    -/** Used to detect unsigned integer values. */
    -var reIsUint = /^(?:0|[1-9]\d*)$/;
    +/** Built-in value references. */
    +var symToStringTag = Symbol ? Symbol.toStringTag : undefined;
    +
    +/**
    + * The base implementation of `getTag` without fallbacks for buggy environments.
    + *
    + * @private
    + * @param {*} value The value to query.
    + * @returns {string} Returns the `toStringTag`.
    + */
    +function baseGetTag$3(value) {
    +  if (value == null) {
    +    return value === undefined ? undefinedTag : nullTag;
    +  }
    +  return (symToStringTag && symToStringTag in Object(value))
    +    ? getRawTag(value)
    +    : objectToString(value);
    +}
    +
    +var _baseGetTag = baseGetTag$3;
    +
    +/**
    + * Checks if `value` is the
    + * [language type](http://www.ecma-international.org/ecma-262/7.0/#sec-ecmascript-language-types)
    + * of `Object`. (e.g. arrays, functions, objects, regexes, `new Number(0)`, and `new String('')`)
    + *
    + * @static
    + * @memberOf _
    + * @since 0.1.0
    + * @category Lang
    + * @param {*} value The value to check.
    + * @returns {boolean} Returns `true` if `value` is an object, else `false`.
    + * @example
    + *
    + * _.isObject({});
    + * // => true
    + *
    + * _.isObject([1, 2, 3]);
    + * // => true
    + *
    + * _.isObject(_.noop);
    + * // => true
    + *
    + * _.isObject(null);
    + * // => false
    + */
    +
    +function isObject$3(value) {
    +  var type = typeof value;
    +  return value != null && (type == 'object' || type == 'function');
    +}
    +
    +var isObject_1 = isObject$3;
    +
    +var baseGetTag$2 = _baseGetTag,
    +    isObject$2 = isObject_1;
    +
    +/** `Object#toString` result references. */
    +var asyncTag = '[object AsyncFunction]',
    +    funcTag$1 = '[object Function]',
    +    genTag = '[object GeneratorFunction]',
    +    proxyTag = '[object Proxy]';
    +
    +/**
    + * Checks if `value` is classified as a `Function` object.
    + *
    + * @static
    + * @memberOf _
    + * @since 0.1.0
    + * @category Lang
    + * @param {*} value The value to check.
    + * @returns {boolean} Returns `true` if `value` is a function, else `false`.
    + * @example
    + *
    + * _.isFunction(_);
    + * // => true
    + *
    + * _.isFunction(/abc/);
    + * // => false
    + */
    +function isFunction$2(value) {
    +  if (!isObject$2(value)) {
    +    return false;
    +  }
    +  // The use of `Object#toString` avoids issues with the `typeof` operator
    +  // in Safari 9 which returns 'object' for typed arrays and other constructors.
    +  var tag = baseGetTag$2(value);
    +  return tag == funcTag$1 || tag == genTag || tag == asyncTag || tag == proxyTag;
    +}
    +
    +var isFunction_1 = isFunction$2;
    +
    +var root = _root;
    +
    +/** Used to detect overreaching core-js shims. */
    +var coreJsData$1 = root['__core-js_shared__'];
    +
    +var _coreJsData = coreJsData$1;
    +
    +var coreJsData = _coreJsData;
    +
    +/** Used to detect methods masquerading as native. */
    +var maskSrcKey = (function() {
    +  var uid = /[^.]+$/.exec(coreJsData && coreJsData.keys && coreJsData.keys.IE_PROTO || '');
    +  return uid ? ('Symbol(src)_1.' + uid) : '';
    +}());
    +
    +/**
    + * Checks if `func` has its source masked.
    + *
    + * @private
    + * @param {Function} func The function to check.
    + * @returns {boolean} Returns `true` if `func` is masked, else `false`.
    + */
    +function isMasked$1(func) {
    +  return !!maskSrcKey && (maskSrcKey in func);
    +}
    +
    +var _isMasked = isMasked$1;
    +
    +/** Used for built-in method references. */
    +
    +var funcProto$1 = Function.prototype;
    +
    +/** Used to resolve the decompiled source of functions. */
    +var funcToString$1 = funcProto$1.toString;
    +
    +/**
    + * Converts `func` to its source code.
    + *
    + * @private
    + * @param {Function} func The function to convert.
    + * @returns {string} Returns the source code.
    + */
    +function toSource$1(func) {
    +  if (func != null) {
    +    try {
    +      return funcToString$1.call(func);
    +    } catch (e) {}
    +    try {
    +      return (func + '');
    +    } catch (e) {}
    +  }
    +  return '';
    +}
    +
    +var _toSource = toSource$1;
    +
    +var isFunction$1 = isFunction_1,
    +    isMasked = _isMasked,
    +    isObject$1 = isObject_1,
    +    toSource = _toSource;
    +
    +/**
    + * Used to match `RegExp`
    + * [syntax characters](http://ecma-international.org/ecma-262/7.0/#sec-patterns).
    + */
    +var reRegExpChar = /[\\^$.*+?()[\]{}|]/g;
    +
    +/** Used to detect host constructors (Safari). */
    +var reIsHostCtor = /^\[object .+?Constructor\]$/;
    +
    +/** Used for built-in method references. */
    +var funcProto = Function.prototype,
    +    objectProto$5 = Object.prototype;
    +
    +/** Used to resolve the decompiled source of functions. */
    +var funcToString = funcProto.toString;
    +
    +/** Used to check objects for own properties. */
    +var hasOwnProperty$4 = objectProto$5.hasOwnProperty;
    +
    +/** Used to detect if a method is native. */
    +var reIsNative = RegExp('^' +
    +  funcToString.call(hasOwnProperty$4).replace(reRegExpChar, '\\$&')
    +  .replace(/hasOwnProperty|(function).*?(?=\\\()| for .+?(?=\\\])/g, '$1.*?') + '$'
    +);
    +
    +/**
    + * The base implementation of `_.isNative` without bad shim checks.
    + *
    + * @private
    + * @param {*} value The value to check.
    + * @returns {boolean} Returns `true` if `value` is a native function,
    + *  else `false`.
    + */
    +function baseIsNative$1(value) {
    +  if (!isObject$1(value) || isMasked(value)) {
    +    return false;
    +  }
    +  var pattern = isFunction$1(value) ? reIsNative : reIsHostCtor;
    +  return pattern.test(toSource(value));
    +}
    +
    +var _baseIsNative = baseIsNative$1;
    +
    +/**
    + * Gets the value at `key` of `object`.
    + *
    + * @private
    + * @param {Object} [object] The object to query.
    + * @param {string} key The key of the property to get.
    + * @returns {*} Returns the property value.
    + */
    +
    +function getValue$1(object, key) {
    +  return object == null ? undefined : object[key];
    +}
    +
    +var _getValue = getValue$1;
    +
    +var baseIsNative = _baseIsNative,
    +    getValue = _getValue;
    +
    +/**
    + * Gets the native function at `key` of `object`.
    + *
    + * @private
    + * @param {Object} object The object to query.
    + * @param {string} key The key of the method to get.
    + * @returns {*} Returns the function if it's native, else `undefined`.
    + */
    +function getNative$1(object, key) {
    +  var value = getValue(object, key);
    +  return baseIsNative(value) ? value : undefined;
    +}
    +
    +var _getNative = getNative$1;
    +
    +var getNative = _getNative;
    +
    +var defineProperty$2 = (function() {
    +  try {
    +    var func = getNative(Object, 'defineProperty');
    +    func({}, '', {});
    +    return func;
    +  } catch (e) {}
    +}());
    +
    +var _defineProperty = defineProperty$2;
    +
    +var defineProperty$1 = _defineProperty;
    +
    +/**
    + * The base implementation of `assignValue` and `assignMergeValue` without
    + * value checks.
    + *
    + * @private
    + * @param {Object} object The object to modify.
    + * @param {string} key The key of the property to assign.
    + * @param {*} value The value to assign.
    + */
    +function baseAssignValue$2(object, key, value) {
    +  if (key == '__proto__' && defineProperty$1) {
    +    defineProperty$1(object, key, {
    +      'configurable': true,
    +      'enumerable': true,
    +      'value': value,
    +      'writable': true
    +    });
    +  } else {
    +    object[key] = value;
    +  }
    +}
    +
    +var _baseAssignValue = baseAssignValue$2;
    +
    +/**
    + * Performs a
    + * [`SameValueZero`](http://ecma-international.org/ecma-262/7.0/#sec-samevaluezero)
    + * comparison between two values to determine if they are equivalent.
    + *
    + * @static
    + * @memberOf _
    + * @since 4.0.0
    + * @category Lang
    + * @param {*} value The value to compare.
    + * @param {*} other The other value to compare.
    + * @returns {boolean} Returns `true` if the values are equivalent, else `false`.
    + * @example
    + *
    + * var object = { 'a': 1 };
    + * var other = { 'a': 1 };
    + *
    + * _.eq(object, object);
    + * // => true
    + *
    + * _.eq(object, other);
    + * // => false
    + *
    + * _.eq('a', 'a');
    + * // => true
    + *
    + * _.eq('a', Object('a'));
    + * // => false
    + *
    + * _.eq(NaN, NaN);
    + * // => true
    + */
    +
    +function eq$2(value, other) {
    +  return value === other || (value !== value && other !== other);
    +}
    +
    +var eq_1 = eq$2;
    +
    +var baseAssignValue$1 = _baseAssignValue,
    +    eq$1 = eq_1;
    +
    +/** Used for built-in method references. */
    +var objectProto$4 = Object.prototype;
    +
    +/** Used to check objects for own properties. */
    +var hasOwnProperty$3 = objectProto$4.hasOwnProperty;
    +
    +/**
    + * Assigns `value` to `key` of `object` if the existing value is not equivalent
    + * using [`SameValueZero`](http://ecma-international.org/ecma-262/7.0/#sec-samevaluezero)
    + * for equality comparisons.
    + *
    + * @private
    + * @param {Object} object The object to modify.
    + * @param {string} key The key of the property to assign.
    + * @param {*} value The value to assign.
    + */
    +function assignValue$1(object, key, value) {
    +  var objValue = object[key];
    +  if (!(hasOwnProperty$3.call(object, key) && eq$1(objValue, value)) ||
    +      (value === undefined && !(key in object))) {
    +    baseAssignValue$1(object, key, value);
    +  }
    +}
    +
    +var _assignValue = assignValue$1;
    +
    +var assignValue = _assignValue,
    +    baseAssignValue = _baseAssignValue;
    +
    +/**
    + * Copies properties of `source` to `object`.
    + *
    + * @private
    + * @param {Object} source The object to copy properties from.
    + * @param {Array} props The property identifiers to copy.
    + * @param {Object} [object={}] The object to copy properties to.
    + * @param {Function} [customizer] The function to customize copied values.
    + * @returns {Object} Returns `object`.
    + */
    +function copyObject$1(source, props, object, customizer) {
    +  var isNew = !object;
    +  object || (object = {});
    +
    +  var index = -1,
    +      length = props.length;
    +
    +  while (++index < length) {
    +    var key = props[index];
    +
    +    var newValue = customizer
    +      ? customizer(object[key], source[key], key, object, source)
    +      : undefined;
    +
    +    if (newValue === undefined) {
    +      newValue = source[key];
    +    }
    +    if (isNew) {
    +      baseAssignValue(object, key, newValue);
    +    } else {
    +      assignValue(object, key, newValue);
    +    }
    +  }
    +  return object;
    +}
    +
    +var _copyObject = copyObject$1;
    +
    +/**
    + * This method returns the first argument it receives.
    + *
    + * @static
    + * @since 0.1.0
    + * @memberOf _
    + * @category Util
    + * @param {*} value Any value.
    + * @returns {*} Returns `value`.
    + * @example
    + *
    + * var object = { 'a': 1 };
    + *
    + * console.log(_.identity(object) === object);
    + * // => true
    + */
    +
    +function identity$2(value) {
    +  return value;
    +}
    +
    +var identity_1 = identity$2;
     
     /**
      * A faster alternative to `Function#apply`, this function invokes `func`
    @@ -28,7 +515,8 @@ var reIsUint = /^(?:0|[1-9]\d*)$/;
      * @param {Array} args The arguments to invoke `func` with.
      * @returns {*} Returns the result of `func`.
      */
    -function apply(func, thisArg, args) {
    +
    +function apply$1(func, thisArg, args) {
       switch (args.length) {
         case 0: return func.call(thisArg);
         case 1: return func.call(thisArg, args[0]);
    @@ -38,189 +526,308 @@ function apply(func, thisArg, args) {
       return func.apply(thisArg, args);
     }
     
    +var _apply = apply$1;
    +
    +var apply = _apply;
    +
    +/* Built-in method references for those with the same name as other `lodash` methods. */
    +var nativeMax = Math.max;
    +
     /**
    - * The base implementation of `_.times` without support for iteratee shorthands
    - * or max array length checks.
    + * A specialized version of `baseRest` which transforms the rest array.
      *
      * @private
    - * @param {number} n The number of times to invoke `iteratee`.
    - * @param {Function} iteratee The function invoked per iteration.
    - * @returns {Array} Returns the array of results.
    + * @param {Function} func The function to apply a rest parameter to.
    + * @param {number} [start=func.length-1] The start position of the rest parameter.
    + * @param {Function} transform The rest array transform.
    + * @returns {Function} Returns the new function.
      */
    -function baseTimes(n, iteratee) {
    -  var index = -1,
    -      result = Array(n);
    +function overRest$1(func, start, transform) {
    +  start = nativeMax(start === undefined ? (func.length - 1) : start, 0);
    +  return function() {
    +    var args = arguments,
    +        index = -1,
    +        length = nativeMax(args.length - start, 0),
    +        array = Array(length);
     
    -  while (++index < n) {
    -    result[index] = iteratee(index);
    -  }
    -  return result;
    +    while (++index < length) {
    +      array[index] = args[start + index];
    +    }
    +    index = -1;
    +    var otherArgs = Array(start + 1);
    +    while (++index < start) {
    +      otherArgs[index] = args[index];
    +    }
    +    otherArgs[start] = transform(array);
    +    return apply(func, this, otherArgs);
    +  };
     }
     
    +var _overRest = overRest$1;
    +
     /**
    - * Creates a unary function that invokes `func` with its argument transformed.
    + * Creates a function that returns `value`.
      *
    - * @private
    - * @param {Function} func The function to wrap.
    - * @param {Function} transform The argument transform.
    - * @returns {Function} Returns the new function.
    + * @static
    + * @memberOf _
    + * @since 2.4.0
    + * @category Util
    + * @param {*} value The value to return from the new function.
    + * @returns {Function} Returns the new constant function.
    + * @example
    + *
    + * var objects = _.times(2, _.constant({ 'a': 1 }));
    + *
    + * console.log(objects);
    + * // => [{ 'a': 1 }, { 'a': 1 }]
    + *
    + * console.log(objects[0] === objects[1]);
    + * // => true
      */
    -function overArg(func, transform) {
    -  return function(arg) {
    -    return func(transform(arg));
    +
    +function constant$1(value) {
    +  return function() {
    +    return value;
       };
     }
     
    -/** Used for built-in method references. */
    -var objectProto = Object.prototype;
    +var constant_1 = constant$1;
     
    -/** Used to check objects for own properties. */
    -var hasOwnProperty = objectProto.hasOwnProperty;
    +var constant = constant_1,
    +    defineProperty = _defineProperty,
    +    identity$1 = identity_1;
     
     /**
    - * Used to resolve the
    - * [`toStringTag`](http://ecma-international.org/ecma-262/7.0/#sec-object.prototype.tostring)
    - * of values.
    + * The base implementation of `setToString` without support for hot loop shorting.
    + *
    + * @private
    + * @param {Function} func The function to modify.
    + * @param {Function} string The `toString` result.
    + * @returns {Function} Returns `func`.
      */
    -var objectToString = objectProto.toString;
    +var baseSetToString$1 = !defineProperty ? identity$1 : function(func, string) {
    +  return defineProperty(func, 'toString', {
    +    'configurable': true,
    +    'enumerable': false,
    +    'value': constant(string),
    +    'writable': true
    +  });
    +};
     
    -/** Built-in value references. */
    -var propertyIsEnumerable = objectProto.propertyIsEnumerable;
    +var _baseSetToString = baseSetToString$1;
    +
    +/** Used to detect hot functions by number of calls within a span of milliseconds. */
    +
    +var HOT_COUNT = 800,
    +    HOT_SPAN = 16;
     
     /* Built-in method references for those with the same name as other `lodash` methods. */
    -var nativeKeys = overArg(Object.keys, Object),
    -    nativeMax = Math.max;
    +var nativeNow = Date.now;
     
     /**
    - * Creates an array of the enumerable property names of the array-like `value`.
    + * Creates a function that'll short out and invoke `identity` instead
    + * of `func` when it's called `HOT_COUNT` or more times in `HOT_SPAN`
    + * milliseconds.
      *
      * @private
    - * @param {*} value The value to query.
    - * @param {boolean} inherited Specify returning inherited property names.
    - * @returns {Array} Returns the array of property names.
    + * @param {Function} func The function to restrict.
    + * @returns {Function} Returns the new shortable function.
      */
    -function arrayLikeKeys(value, inherited) {
    -  // Safari 8.1 makes `arguments.callee` enumerable in strict mode.
    -  // Safari 9 makes `arguments.length` enumerable in strict mode.
    -  var result = (isArray(value) || isArguments(value))
    -    ? baseTimes(value.length, String)
    -    : [];
    +function shortOut$1(func) {
    +  var count = 0,
    +      lastCalled = 0;
     
    -  var length = result.length,
    -      skipIndexes = !!length;
    +  return function() {
    +    var stamp = nativeNow(),
    +        remaining = HOT_SPAN - (stamp - lastCalled);
     
    -  for (var key in value) {
    -    if ((inherited || hasOwnProperty.call(value, key)) &&
    -        !(skipIndexes && (key == 'length' || isIndex(key, length)))) {
    -      result.push(key);
    +    lastCalled = stamp;
    +    if (remaining > 0) {
    +      if (++count >= HOT_COUNT) {
    +        return arguments[0];
    +      }
    +    } else {
    +      count = 0;
         }
    -  }
    -  return result;
    +    return func.apply(undefined, arguments);
    +  };
     }
     
    +var _shortOut = shortOut$1;
    +
    +var baseSetToString = _baseSetToString,
    +    shortOut = _shortOut;
    +
     /**
    - * Assigns `value` to `key` of `object` if the existing value is not equivalent
    - * using [`SameValueZero`](http://ecma-international.org/ecma-262/7.0/#sec-samevaluezero)
    - * for equality comparisons.
    + * Sets the `toString` method of `func` to return `string`.
      *
      * @private
    - * @param {Object} object The object to modify.
    - * @param {string} key The key of the property to assign.
    - * @param {*} value The value to assign.
    + * @param {Function} func The function to modify.
    + * @param {Function} string The `toString` result.
    + * @returns {Function} Returns `func`.
      */
    -function assignValue(object, key, value) {
    -  var objValue = object[key];
    -  if (!(hasOwnProperty.call(object, key) && eq(objValue, value)) ||
    -      (value === undefined && !(key in object))) {
    -    object[key] = value;
    -  }
    +var setToString$1 = shortOut(baseSetToString);
    +
    +var _setToString = setToString$1;
    +
    +var identity = identity_1,
    +    overRest = _overRest,
    +    setToString = _setToString;
    +
    +/**
    + * The base implementation of `_.rest` which doesn't validate or coerce arguments.
    + *
    + * @private
    + * @param {Function} func The function to apply a rest parameter to.
    + * @param {number} [start=func.length-1] The start position of the rest parameter.
    + * @returns {Function} Returns the new function.
    + */
    +function baseRest$1(func, start) {
    +  return setToString(overRest(func, start, identity), func + '');
    +}
    +
    +var _baseRest = baseRest$1;
    +
    +/** Used as references for various `Number` constants. */
    +
    +var MAX_SAFE_INTEGER$1 = 9007199254740991;
    +
    +/**
    + * Checks if `value` is a valid array-like length.
    + *
    + * **Note:** This method is loosely based on
    + * [`ToLength`](http://ecma-international.org/ecma-262/7.0/#sec-tolength).
    + *
    + * @static
    + * @memberOf _
    + * @since 4.0.0
    + * @category Lang
    + * @param {*} value The value to check.
    + * @returns {boolean} Returns `true` if `value` is a valid length, else `false`.
    + * @example
    + *
    + * _.isLength(3);
    + * // => true
    + *
    + * _.isLength(Number.MIN_VALUE);
    + * // => false
    + *
    + * _.isLength(Infinity);
    + * // => false
    + *
    + * _.isLength('3');
    + * // => false
    + */
    +function isLength$2(value) {
    +  return typeof value == 'number' &&
    +    value > -1 && value % 1 == 0 && value <= MAX_SAFE_INTEGER$1;
     }
     
    +var isLength_1 = isLength$2;
    +
    +var isFunction = isFunction_1,
    +    isLength$1 = isLength_1;
    +
     /**
    - * The base implementation of `_.keys` which doesn't treat sparse arrays as dense.
    + * Checks if `value` is array-like. A value is considered array-like if it's
    + * not a function and has a `value.length` that's an integer greater than or
    + * equal to `0` and less than or equal to `Number.MAX_SAFE_INTEGER`.
      *
    - * @private
    - * @param {Object} object The object to query.
    - * @returns {Array} Returns the array of property names.
    + * @static
    + * @memberOf _
    + * @since 4.0.0
    + * @category Lang
    + * @param {*} value The value to check.
    + * @returns {boolean} Returns `true` if `value` is array-like, else `false`.
    + * @example
    + *
    + * _.isArrayLike([1, 2, 3]);
    + * // => true
    + *
    + * _.isArrayLike(document.body.children);
    + * // => true
    + *
    + * _.isArrayLike('abc');
    + * // => true
    + *
    + * _.isArrayLike(_.noop);
    + * // => false
      */
    -function baseKeys(object) {
    -  if (!isPrototype(object)) {
    -    return nativeKeys(object);
    -  }
    -  var result = [];
    -  for (var key in Object(object)) {
    -    if (hasOwnProperty.call(object, key) && key != 'constructor') {
    -      result.push(key);
    -    }
    -  }
    -  return result;
    +function isArrayLike$2(value) {
    +  return value != null && isLength$1(value.length) && !isFunction(value);
     }
     
    +var isArrayLike_1 = isArrayLike$2;
    +
    +/** Used as references for various `Number` constants. */
    +
    +var MAX_SAFE_INTEGER = 9007199254740991;
    +
    +/** Used to detect unsigned integer values. */
    +var reIsUint = /^(?:0|[1-9]\d*)$/;
    +
     /**
    - * The base implementation of `_.rest` which doesn't validate or coerce arguments.
    + * Checks if `value` is a valid array-like index.
      *
      * @private
    - * @param {Function} func The function to apply a rest parameter to.
    - * @param {number} [start=func.length-1] The start position of the rest parameter.
    - * @returns {Function} Returns the new function.
    + * @param {*} value The value to check.
    + * @param {number} [length=MAX_SAFE_INTEGER] The upper bounds of a valid index.
    + * @returns {boolean} Returns `true` if `value` is a valid index, else `false`.
      */
    -function baseRest(func, start) {
    -  start = nativeMax(start === undefined ? (func.length - 1) : start, 0);
    -  return function() {
    -    var args = arguments,
    -        index = -1,
    -        length = nativeMax(args.length - start, 0),
    -        array = Array(length);
    +function isIndex$2(value, length) {
    +  var type = typeof value;
    +  length = length == null ? MAX_SAFE_INTEGER : length;
     
    -    while (++index < length) {
    -      array[index] = args[start + index];
    -    }
    -    index = -1;
    -    var otherArgs = Array(start + 1);
    -    while (++index < start) {
    -      otherArgs[index] = args[index];
    -    }
    -    otherArgs[start] = array;
    -    return apply(func, this, otherArgs);
    -  };
    +  return !!length &&
    +    (type == 'number' ||
    +      (type != 'symbol' && reIsUint.test(value))) &&
    +        (value > -1 && value % 1 == 0 && value < length);
     }
     
    +var _isIndex = isIndex$2;
    +
    +var eq = eq_1,
    +    isArrayLike$1 = isArrayLike_1,
    +    isIndex$1 = _isIndex,
    +    isObject = isObject_1;
    +
     /**
    - * Copies properties of `source` to `object`.
    + * Checks if the given arguments are from an iteratee call.
      *
      * @private
    - * @param {Object} source The object to copy properties from.
    - * @param {Array} props The property identifiers to copy.
    - * @param {Object} [object={}] The object to copy properties to.
    - * @param {Function} [customizer] The function to customize copied values.
    - * @returns {Object} Returns `object`.
    + * @param {*} value The potential iteratee value argument.
    + * @param {*} index The potential iteratee index or key argument.
    + * @param {*} object The potential iteratee object argument.
    + * @returns {boolean} Returns `true` if the arguments are from an iteratee call,
    + *  else `false`.
      */
    -function copyObject(source, props, object, customizer) {
    -  object || (object = {});
    -
    -  var index = -1,
    -      length = props.length;
    -
    -  while (++index < length) {
    -    var key = props[index];
    -
    -    var newValue = customizer
    -      ? customizer(object[key], source[key], key, object, source)
    -      : undefined;
    -
    -    assignValue(object, key, newValue === undefined ? source[key] : newValue);
    +function isIterateeCall$1(value, index, object) {
    +  if (!isObject(object)) {
    +    return false;
       }
    -  return object;
    +  var type = typeof index;
    +  if (type == 'number'
    +        ? (isArrayLike$1(object) && isIndex$1(index, object.length))
    +        : (type == 'string' && index in object)
    +      ) {
    +    return eq(object[index], value);
    +  }
    +  return false;
     }
     
    +var _isIterateeCall = isIterateeCall$1;
    +
    +var baseRest = _baseRest,
    +    isIterateeCall = _isIterateeCall;
    +
     /**
      * Creates a function like `_.assign`.
      *
      * @private
      * @param {Function} assigner The function to assign values.
      * @returns {Function} Returns the new assigner function.
      */
    -function createAssigner(assigner) {
    +function createAssigner$1(assigner) {
       return baseRest(function(object, sources) {
         var index = -1,
             length = sources.length,
    @@ -246,315 +853,523 @@ function createAssigner(assigner) {
       });
     }
     
    -/**
    - * Checks if `value` is a valid array-like index.
    - *
    - * @private
    - * @param {*} value The value to check.
    - * @param {number} [length=MAX_SAFE_INTEGER] The upper bounds of a valid index.
    - * @returns {boolean} Returns `true` if `value` is a valid index, else `false`.
    - */
    -function isIndex(value, length) {
    -  length = length == null ? MAX_SAFE_INTEGER : length;
    -  return !!length &&
    -    (typeof value == 'number' || reIsUint.test(value)) &&
    -    (value > -1 && value % 1 == 0 && value < length);
    -}
    +var _createAssigner = createAssigner$1;
     
     /**
    - * Checks if the given arguments are from an iteratee call.
    + * The base implementation of `_.times` without support for iteratee shorthands
    + * or max array length checks.
      *
      * @private
    - * @param {*} value The potential iteratee value argument.
    - * @param {*} index The potential iteratee index or key argument.
    - * @param {*} object The potential iteratee object argument.
    - * @returns {boolean} Returns `true` if the arguments are from an iteratee call,
    - *  else `false`.
    + * @param {number} n The number of times to invoke `iteratee`.
    + * @param {Function} iteratee The function invoked per iteration.
    + * @returns {Array} Returns the array of results.
      */
    -function isIterateeCall(value, index, object) {
    -  if (!isObject(object)) {
    -    return false;
    -  }
    -  var type = typeof index;
    -  if (type == 'number'
    -        ? (isArrayLike(object) && isIndex(index, object.length))
    -        : (type == 'string' && index in object)
    -      ) {
    -    return eq(object[index], value);
    -  }
    -  return false;
    -}
     
    -/**
    - * Checks if `value` is likely a prototype object.
    - *
    - * @private
    - * @param {*} value The value to check.
    - * @returns {boolean} Returns `true` if `value` is a prototype, else `false`.
    - */
    -function isPrototype(value) {
    -  var Ctor = value && value.constructor,
    -      proto = (typeof Ctor == 'function' && Ctor.prototype) || objectProto;
    +function baseTimes$1(n, iteratee) {
    +  var index = -1,
    +      result = Array(n);
     
    -  return value === proto;
    +  while (++index < n) {
    +    result[index] = iteratee(index);
    +  }
    +  return result;
     }
     
    +var _baseTimes = baseTimes$1;
    +
     /**
    - * Performs a
    - * [`SameValueZero`](http://ecma-international.org/ecma-262/7.0/#sec-samevaluezero)
    - * comparison between two values to determine if they are equivalent.
    + * Checks if `value` is object-like. A value is object-like if it's not `null`
    + * and has a `typeof` result of "object".
      *
      * @static
      * @memberOf _
      * @since 4.0.0
      * @category Lang
    - * @param {*} value The value to compare.
    - * @param {*} other The other value to compare.
    - * @returns {boolean} Returns `true` if the values are equivalent, else `false`.
    + * @param {*} value The value to check.
    + * @returns {boolean} Returns `true` if `value` is object-like, else `false`.
      * @example
      *
    - * var object = { 'a': 1 };
    - * var other = { 'a': 1 };
    - *
    - * _.eq(object, object);
    + * _.isObjectLike({});
      * // => true
      *
    - * _.eq(object, other);
    - * // => false
    - *
    - * _.eq('a', 'a');
    + * _.isObjectLike([1, 2, 3]);
      * // => true
      *
    - * _.eq('a', Object('a'));
    + * _.isObjectLike(_.noop);
      * // => false
      *
    - * _.eq(NaN, NaN);
    - * // => true
    + * _.isObjectLike(null);
    + * // => false
      */
    -function eq(value, other) {
    -  return value === other || (value !== value && other !== other);
    +
    +function isObjectLike$3(value) {
    +  return value != null && typeof value == 'object';
     }
     
    +var isObjectLike_1 = isObjectLike$3;
    +
    +var baseGetTag$1 = _baseGetTag,
    +    isObjectLike$2 = isObjectLike_1;
    +
    +/** `Object#toString` result references. */
    +var argsTag$1 = '[object Arguments]';
    +
     /**
    - * Checks if `value` is likely an `arguments` object.
    + * The base implementation of `_.isArguments`.
      *
    - * @static
    - * @memberOf _
    - * @since 0.1.0
    - * @category Lang
    + * @private
      * @param {*} value The value to check.
      * @returns {boolean} Returns `true` if `value` is an `arguments` object,
    - *  else `false`.
    - * @example
    - *
    - * _.isArguments(function() { return arguments; }());
    - * // => true
    - *
    - * _.isArguments([1, 2, 3]);
    - * // => false
      */
    -function isArguments(value) {
    -  // Safari 8.1 makes `arguments.callee` enumerable in strict mode.
    -  return isArrayLikeObject(value) && hasOwnProperty.call(value, 'callee') &&
    -    (!propertyIsEnumerable.call(value, 'callee') || objectToString.call(value) == argsTag);
    +function baseIsArguments$1(value) {
    +  return isObjectLike$2(value) && baseGetTag$1(value) == argsTag$1;
     }
     
    -/**
    - * Checks if `value` is classified as an `Array` object.
    - *
    - * @static
    - * @memberOf _
    - * @since 0.1.0
    - * @category Lang
    - * @param {*} value The value to check.
    - * @returns {boolean} Returns `true` if `value` is an array, else `false`.
    - * @example
    - *
    - * _.isArray([1, 2, 3]);
    - * // => true
    - *
    - * _.isArray(document.body.children);
    - * // => false
    - *
    - * _.isArray('abc');
    - * // => false
    - *
    - * _.isArray(_.noop);
    - * // => false
    - */
    -var isArray = Array.isArray;
    +var _baseIsArguments = baseIsArguments$1;
    +
    +var baseIsArguments = _baseIsArguments,
    +    isObjectLike$1 = isObjectLike_1;
    +
    +/** Used for built-in method references. */
    +var objectProto$3 = Object.prototype;
    +
    +/** Used to check objects for own properties. */
    +var hasOwnProperty$2 = objectProto$3.hasOwnProperty;
    +
    +/** Built-in value references. */
    +var propertyIsEnumerable = objectProto$3.propertyIsEnumerable;
     
     /**
    - * Checks if `value` is array-like. A value is considered array-like if it's
    - * not a function and has a `value.length` that's an integer greater than or
    - * equal to `0` and less than or equal to `Number.MAX_SAFE_INTEGER`.
    + * Checks if `value` is likely an `arguments` object.
      *
      * @static
      * @memberOf _
    - * @since 4.0.0
    + * @since 0.1.0
      * @category Lang
      * @param {*} value The value to check.
    - * @returns {boolean} Returns `true` if `value` is array-like, else `false`.
    - * @example
    - *
    - * _.isArrayLike([1, 2, 3]);
    - * // => true
    - *
    - * _.isArrayLike(document.body.children);
    - * // => true
    + * @returns {boolean} Returns `true` if `value` is an `arguments` object,
    + *  else `false`.
    + * @example
      *
    - * _.isArrayLike('abc');
    + * _.isArguments(function() { return arguments; }());
      * // => true
      *
    - * _.isArrayLike(_.noop);
    + * _.isArguments([1, 2, 3]);
      * // => false
      */
    -function isArrayLike(value) {
    -  return value != null && isLength(value.length) && !isFunction(value);
    -}
    +var isArguments$1 = baseIsArguments(function() { return arguments; }()) ? baseIsArguments : function(value) {
    +  return isObjectLike$1(value) && hasOwnProperty$2.call(value, 'callee') &&
    +    !propertyIsEnumerable.call(value, 'callee');
    +};
    +
    +var isArguments_1 = isArguments$1;
     
     /**
    - * This method is like `_.isArrayLike` except that it also checks if `value`
    - * is an object.
    + * Checks if `value` is classified as an `Array` object.
      *
      * @static
      * @memberOf _
    - * @since 4.0.0
    + * @since 0.1.0
      * @category Lang
      * @param {*} value The value to check.
    - * @returns {boolean} Returns `true` if `value` is an array-like object,
    - *  else `false`.
    + * @returns {boolean} Returns `true` if `value` is an array, else `false`.
      * @example
      *
    - * _.isArrayLikeObject([1, 2, 3]);
    + * _.isArray([1, 2, 3]);
      * // => true
      *
    - * _.isArrayLikeObject(document.body.children);
    - * // => true
    + * _.isArray(document.body.children);
    + * // => false
      *
    - * _.isArrayLikeObject('abc');
    + * _.isArray('abc');
      * // => false
      *
    - * _.isArrayLikeObject(_.noop);
    + * _.isArray(_.noop);
      * // => false
      */
    -function isArrayLikeObject(value) {
    -  return isObjectLike(value) && isArrayLike(value);
    -}
    +
    +var isArray$1 = Array.isArray;
    +
    +var isArray_1 = isArray$1;
    +
    +var isBuffer$1 = {exports: {}};
     
     /**
    - * Checks if `value` is classified as a `Function` object.
    + * This method returns `false`.
      *
      * @static
      * @memberOf _
    - * @since 0.1.0
    - * @category Lang
    - * @param {*} value The value to check.
    - * @returns {boolean} Returns `true` if `value` is a function, else `false`.
    + * @since 4.13.0
    + * @category Util
    + * @returns {boolean} Returns `false`.
      * @example
      *
    - * _.isFunction(_);
    - * // => true
    + * _.times(2, _.stubFalse);
    + * // => [false, false]
    + */
    +
    +function stubFalse() {
    +  return false;
    +}
    +
    +var stubFalse_1 = stubFalse;
    +
    +isBuffer$1.exports;
    +
    +(function (module, exports) {
    +	var root = _root,
    +	    stubFalse = stubFalse_1;
    +
    +	/** Detect free variable `exports`. */
    +	var freeExports = exports && !exports.nodeType && exports;
    +
    +	/** Detect free variable `module`. */
    +	var freeModule = freeExports && 'object' == 'object' && module && !module.nodeType && module;
    +
    +	/** Detect the popular CommonJS extension `module.exports`. */
    +	var moduleExports = freeModule && freeModule.exports === freeExports;
    +
    +	/** Built-in value references. */
    +	var Buffer = moduleExports ? root.Buffer : undefined;
    +
    +	/* Built-in method references for those with the same name as other `lodash` methods. */
    +	var nativeIsBuffer = Buffer ? Buffer.isBuffer : undefined;
    +
    +	/**
    +	 * Checks if `value` is a buffer.
    +	 *
    +	 * @static
    +	 * @memberOf _
    +	 * @since 4.3.0
    +	 * @category Lang
    +	 * @param {*} value The value to check.
    +	 * @returns {boolean} Returns `true` if `value` is a buffer, else `false`.
    +	 * @example
    +	 *
    +	 * _.isBuffer(new Buffer(2));
    +	 * // => true
    +	 *
    +	 * _.isBuffer(new Uint8Array(2));
    +	 * // => false
    +	 */
    +	var isBuffer = nativeIsBuffer || stubFalse;
    +
    +	module.exports = isBuffer; 
    +} (isBuffer$1, isBuffer$1.exports));
    +
    +var isBufferExports = isBuffer$1.exports;
    +
    +var baseGetTag = _baseGetTag,
    +    isLength = isLength_1,
    +    isObjectLike = isObjectLike_1;
    +
    +/** `Object#toString` result references. */
    +var argsTag = '[object Arguments]',
    +    arrayTag = '[object Array]',
    +    boolTag = '[object Boolean]',
    +    dateTag = '[object Date]',
    +    errorTag = '[object Error]',
    +    funcTag = '[object Function]',
    +    mapTag = '[object Map]',
    +    numberTag = '[object Number]',
    +    objectTag = '[object Object]',
    +    regexpTag = '[object RegExp]',
    +    setTag = '[object Set]',
    +    stringTag = '[object String]',
    +    weakMapTag = '[object WeakMap]';
    +
    +var arrayBufferTag = '[object ArrayBuffer]',
    +    dataViewTag = '[object DataView]',
    +    float32Tag = '[object Float32Array]',
    +    float64Tag = '[object Float64Array]',
    +    int8Tag = '[object Int8Array]',
    +    int16Tag = '[object Int16Array]',
    +    int32Tag = '[object Int32Array]',
    +    uint8Tag = '[object Uint8Array]',
    +    uint8ClampedTag = '[object Uint8ClampedArray]',
    +    uint16Tag = '[object Uint16Array]',
    +    uint32Tag = '[object Uint32Array]';
    +
    +/** Used to identify `toStringTag` values of typed arrays. */
    +var typedArrayTags = {};
    +typedArrayTags[float32Tag] = typedArrayTags[float64Tag] =
    +typedArrayTags[int8Tag] = typedArrayTags[int16Tag] =
    +typedArrayTags[int32Tag] = typedArrayTags[uint8Tag] =
    +typedArrayTags[uint8ClampedTag] = typedArrayTags[uint16Tag] =
    +typedArrayTags[uint32Tag] = true;
    +typedArrayTags[argsTag] = typedArrayTags[arrayTag] =
    +typedArrayTags[arrayBufferTag] = typedArrayTags[boolTag] =
    +typedArrayTags[dataViewTag] = typedArrayTags[dateTag] =
    +typedArrayTags[errorTag] = typedArrayTags[funcTag] =
    +typedArrayTags[mapTag] = typedArrayTags[numberTag] =
    +typedArrayTags[objectTag] = typedArrayTags[regexpTag] =
    +typedArrayTags[setTag] = typedArrayTags[stringTag] =
    +typedArrayTags[weakMapTag] = false;
    +
    +/**
    + * The base implementation of `_.isTypedArray` without Node.js optimizations.
      *
    - * _.isFunction(/abc/);
    - * // => false
    + * @private
    + * @param {*} value The value to check.
    + * @returns {boolean} Returns `true` if `value` is a typed array, else `false`.
      */
    -function isFunction(value) {
    -  // The use of `Object#toString` avoids issues with the `typeof` operator
    -  // in Safari 8-9 which returns 'object' for typed array and other constructors.
    -  var tag = isObject(value) ? objectToString.call(value) : '';
    -  return tag == funcTag || tag == genTag;
    +function baseIsTypedArray$1(value) {
    +  return isObjectLike(value) &&
    +    isLength(value.length) && !!typedArrayTags[baseGetTag(value)];
     }
     
    +var _baseIsTypedArray = baseIsTypedArray$1;
    +
     /**
    - * Checks if `value` is a valid array-like length.
    + * The base implementation of `_.unary` without support for storing metadata.
      *
    - * **Note:** This method is loosely based on
    - * [`ToLength`](http://ecma-international.org/ecma-262/7.0/#sec-tolength).
    + * @private
    + * @param {Function} func The function to cap arguments for.
    + * @returns {Function} Returns the new capped function.
    + */
    +
    +function baseUnary$1(func) {
    +  return function(value) {
    +    return func(value);
    +  };
    +}
    +
    +var _baseUnary = baseUnary$1;
    +
    +var _nodeUtil = {exports: {}};
    +
    +_nodeUtil.exports;
    +
    +(function (module, exports) {
    +	var freeGlobal = _freeGlobal;
    +
    +	/** Detect free variable `exports`. */
    +	var freeExports = exports && !exports.nodeType && exports;
    +
    +	/** Detect free variable `module`. */
    +	var freeModule = freeExports && 'object' == 'object' && module && !module.nodeType && module;
    +
    +	/** Detect the popular CommonJS extension `module.exports`. */
    +	var moduleExports = freeModule && freeModule.exports === freeExports;
    +
    +	/** Detect free variable `process` from Node.js. */
    +	var freeProcess = moduleExports && freeGlobal.process;
    +
    +	/** Used to access faster Node.js helpers. */
    +	var nodeUtil = (function() {
    +	  try {
    +	    // Use `util.types` for Node.js 10+.
    +	    var types = freeModule && freeModule.require && freeModule.require('util').types;
    +
    +	    if (types) {
    +	      return types;
    +	    }
    +
    +	    // Legacy `process.binding('util')` for Node.js < 10.
    +	    return freeProcess && freeProcess.binding && freeProcess.binding('util');
    +	  } catch (e) {}
    +	}());
    +
    +	module.exports = nodeUtil; 
    +} (_nodeUtil, _nodeUtil.exports));
    +
    +var _nodeUtilExports = _nodeUtil.exports;
    +
    +var baseIsTypedArray = _baseIsTypedArray,
    +    baseUnary = _baseUnary,
    +    nodeUtil = _nodeUtilExports;
    +
    +/* Node.js helper references. */
    +var nodeIsTypedArray = nodeUtil && nodeUtil.isTypedArray;
    +
    +/**
    + * Checks if `value` is classified as a typed array.
      *
      * @static
      * @memberOf _
    - * @since 4.0.0
    + * @since 3.0.0
      * @category Lang
      * @param {*} value The value to check.
    - * @returns {boolean} Returns `true` if `value` is a valid length, else `false`.
    + * @returns {boolean} Returns `true` if `value` is a typed array, else `false`.
      * @example
      *
    - * _.isLength(3);
    + * _.isTypedArray(new Uint8Array);
      * // => true
      *
    - * _.isLength(Number.MIN_VALUE);
    - * // => false
    - *
    - * _.isLength(Infinity);
    + * _.isTypedArray([]);
      * // => false
    + */
    +var isTypedArray$1 = nodeIsTypedArray ? baseUnary(nodeIsTypedArray) : baseIsTypedArray;
    +
    +var isTypedArray_1 = isTypedArray$1;
    +
    +var baseTimes = _baseTimes,
    +    isArguments = isArguments_1,
    +    isArray = isArray_1,
    +    isBuffer = isBufferExports,
    +    isIndex = _isIndex,
    +    isTypedArray = isTypedArray_1;
    +
    +/** Used for built-in method references. */
    +var objectProto$2 = Object.prototype;
    +
    +/** Used to check objects for own properties. */
    +var hasOwnProperty$1 = objectProto$2.hasOwnProperty;
    +
    +/**
    + * Creates an array of the enumerable property names of the array-like `value`.
      *
    - * _.isLength('3');
    - * // => false
    + * @private
    + * @param {*} value The value to query.
    + * @param {boolean} inherited Specify returning inherited property names.
    + * @returns {Array} Returns the array of property names.
      */
    -function isLength(value) {
    -  return typeof value == 'number' &&
    -    value > -1 && value % 1 == 0 && value <= MAX_SAFE_INTEGER;
    +function arrayLikeKeys$1(value, inherited) {
    +  var isArr = isArray(value),
    +      isArg = !isArr && isArguments(value),
    +      isBuff = !isArr && !isArg && isBuffer(value),
    +      isType = !isArr && !isArg && !isBuff && isTypedArray(value),
    +      skipIndexes = isArr || isArg || isBuff || isType,
    +      result = skipIndexes ? baseTimes(value.length, String) : [],
    +      length = result.length;
    +
    +  for (var key in value) {
    +    if ((inherited || hasOwnProperty$1.call(value, key)) &&
    +        !(skipIndexes && (
    +           // Safari 9 has enumerable `arguments.length` in strict mode.
    +           key == 'length' ||
    +           // Node.js 0.10 has enumerable non-index properties on buffers.
    +           (isBuff && (key == 'offset' || key == 'parent')) ||
    +           // PhantomJS 2 has enumerable non-index properties on typed arrays.
    +           (isType && (key == 'buffer' || key == 'byteLength' || key == 'byteOffset')) ||
    +           // Skip index properties.
    +           isIndex(key, length)
    +        ))) {
    +      result.push(key);
    +    }
    +  }
    +  return result;
     }
     
    +var _arrayLikeKeys = arrayLikeKeys$1;
    +
    +/** Used for built-in method references. */
    +
    +var objectProto$1 = Object.prototype;
    +
     /**
    - * Checks if `value` is the
    - * [language type](http://www.ecma-international.org/ecma-262/7.0/#sec-ecmascript-language-types)
    - * of `Object`. (e.g. arrays, functions, objects, regexes, `new Number(0)`, and `new String('')`)
    + * Checks if `value` is likely a prototype object.
      *
    - * @static
    - * @memberOf _
    - * @since 0.1.0
    - * @category Lang
    + * @private
      * @param {*} value The value to check.
    - * @returns {boolean} Returns `true` if `value` is an object, else `false`.
    - * @example
    - *
    - * _.isObject({});
    - * // => true
    - *
    - * _.isObject([1, 2, 3]);
    - * // => true
    + * @returns {boolean} Returns `true` if `value` is a prototype, else `false`.
    + */
    +function isPrototype$1(value) {
    +  var Ctor = value && value.constructor,
    +      proto = (typeof Ctor == 'function' && Ctor.prototype) || objectProto$1;
    +
    +  return value === proto;
    +}
    +
    +var _isPrototype = isPrototype$1;
    +
    +/**
    + * Creates a unary function that invokes `func` with its argument transformed.
      *
    - * _.isObject(_.noop);
    - * // => true
    + * @private
    + * @param {Function} func The function to wrap.
    + * @param {Function} transform The argument transform.
    + * @returns {Function} Returns the new function.
    + */
    +
    +function overArg$1(func, transform) {
    +  return function(arg) {
    +    return func(transform(arg));
    +  };
    +}
    +
    +var _overArg = overArg$1;
    +
    +var overArg = _overArg;
    +
    +/* Built-in method references for those with the same name as other `lodash` methods. */
    +var nativeKeys$1 = overArg(Object.keys, Object);
    +
    +var _nativeKeys = nativeKeys$1;
    +
    +var isPrototype = _isPrototype,
    +    nativeKeys = _nativeKeys;
    +
    +/** Used for built-in method references. */
    +var objectProto = Object.prototype;
    +
    +/** Used to check objects for own properties. */
    +var hasOwnProperty = objectProto.hasOwnProperty;
    +
    +/**
    + * The base implementation of `_.keys` which doesn't treat sparse arrays as dense.
      *
    - * _.isObject(null);
    - * // => false
    + * @private
    + * @param {Object} object The object to query.
    + * @returns {Array} Returns the array of property names.
      */
    -function isObject(value) {
    -  var type = typeof value;
    -  return !!value && (type == 'object' || type == 'function');
    +function baseKeys$1(object) {
    +  if (!isPrototype(object)) {
    +    return nativeKeys(object);
    +  }
    +  var result = [];
    +  for (var key in Object(object)) {
    +    if (hasOwnProperty.call(object, key) && key != 'constructor') {
    +      result.push(key);
    +    }
    +  }
    +  return result;
     }
     
    +var _baseKeys = baseKeys$1;
    +
    +var arrayLikeKeys = _arrayLikeKeys,
    +    baseKeys = _baseKeys,
    +    isArrayLike = isArrayLike_1;
    +
     /**
    - * Checks if `value` is object-like. A value is object-like if it's not `null`
    - * and has a `typeof` result of "object".
    + * Creates an array of the own enumerable property names of `object`.
    + *
    + * **Note:** Non-object values are coerced to objects. See the
    + * [ES spec](http://ecma-international.org/ecma-262/7.0/#sec-object.keys)
    + * for more details.
      *
      * @static
    + * @since 0.1.0
      * @memberOf _
    - * @since 4.0.0
    - * @category Lang
    - * @param {*} value The value to check.
    - * @returns {boolean} Returns `true` if `value` is object-like, else `false`.
    + * @category Object
    + * @param {Object} object The object to query.
    + * @returns {Array} Returns the array of property names.
      * @example
      *
    - * _.isObjectLike({});
    - * // => true
    + * function Foo() {
    + *   this.a = 1;
    + *   this.b = 2;
    + * }
      *
    - * _.isObjectLike([1, 2, 3]);
    - * // => true
    + * Foo.prototype.c = 3;
      *
    - * _.isObjectLike(_.noop);
    - * // => false
    + * _.keys(new Foo);
    + * // => ['a', 'b'] (iteration order is not guaranteed)
      *
    - * _.isObjectLike(null);
    - * // => false
    + * _.keys('hi');
    + * // => ['0', '1']
      */
    -function isObjectLike(value) {
    -  return !!value && typeof value == 'object';
    +function keys$1(object) {
    +  return isArrayLike(object) ? arrayLikeKeys(object) : baseKeys(object);
     }
     
    +var keys_1 = keys$1;
    +
    +var copyObject = _copyObject,
    +    createAssigner = _createAssigner,
    +    keys = keys_1;
    +
     /**
      * This method is like `_.assign` except that it accepts `customizer`
      * which is invoked to produce the assigned values. If `customizer` returns
    @@ -587,39 +1402,9 @@ var assignWith = createAssigner(function(object, source, srcIndex, customizer) {
       copyObject(source, keys(source), object, customizer);
     });
     
    -/**
    - * Creates an array of the own enumerable property names of `object`.
    - *
    - * **Note:** Non-object values are coerced to objects. See the
    - * [ES spec](http://ecma-international.org/ecma-262/7.0/#sec-object.keys)
    - * for more details.
    - *
    - * @static
    - * @since 0.1.0
    - * @memberOf _
    - * @category Object
    - * @param {Object} object The object to query.
    - * @returns {Array} Returns the array of property names.
    - * @example
    - *
    - * function Foo() {
    - *   this.a = 1;
    - *   this.b = 2;
    - * }
    - *
    - * Foo.prototype.c = 3;
    - *
    - * _.keys(new Foo);
    - * // => ['a', 'b'] (iteration order is not guaranteed)
    - *
    - * _.keys('hi');
    - * // => ['0', '1']
    - */
    -function keys(object) {
    -  return isArrayLike(object) ? arrayLikeKeys(object) : baseKeys(object);
    -}
    +var assignWith_1 = assignWith;
     
    -var lodash_assignwith = assignWith;
    +var assignWith$1 = /*@__PURE__*/getDefaultExportFromCjs(assignWith_1);
     
     /**
      * Isomorphic, functional type-checking for Javascript.
    @@ -630,6 +1415,7 @@ var lodash_assignwith = assignWith;
      * const allDefined = array.every(t.isDefined)
      */
     
    +
     /**
      * A plain object is a simple object literal, it is not an instance of a class. Returns true if the input `typeof` is `object` and directly decends from `Object`.
      *
    @@ -673,7 +1459,7 @@ function isDefined (input) {
     function customiser (previousValue, newValue, key, object, source) {
       /* deep merge plain objects */
       if (isPlainObject(previousValue) && isPlainObject(newValue)) {
    -    return lodash_assignwith(previousValue, newValue, customiser)
    +    return assignWith$1(previousValue, newValue, customiser)
         /* overwrite arrays if the new array has items */
       } else if (Array.isArray(previousValue) && Array.isArray(newValue) && newValue.length) {
         return newValue
    @@ -686,7 +1472,7 @@ function customiser (previousValue, newValue, key, object, source) {
     }
     
     function deepMerge (...args) {
    -  return lodash_assignwith(...args, customiser)
    +  return assignWith$1(...args, customiser)
     }
     
     export { deepMerge as default };
    
  • .github/workflows/node.js.yml+3 3 modified
    @@ -15,12 +15,12 @@ jobs:
     
         strategy:
           matrix:
    -        node-version: [12, 14, 16]
    +        node-version: [12, 14, 16, 18, 20, 22]
     
         steps:
    -    - uses: actions/checkout@v2
    +    - uses: actions/checkout@v4
         - name: Use Node.js ${{ matrix.node-version }}
    -      uses: actions/setup-node@v2
    +      uses: actions/setup-node@v4
           with:
             node-version: ${{ matrix.node-version }}
             cache: 'npm'
    
  • index.js+1 1 modified
    @@ -1,4 +1,4 @@
    -import assignWith from 'lodash.assignwith'
    +import assignWith from 'lodash/assignWith.js'
     import { isPlainObject, isDefined } from 'typical'
     
     function customiser (previousValue, newValue, key, object, source) {
    
  • LICENSE+22 0 added
    @@ -0,0 +1,22 @@
    +The MIT License (MIT)
    +
    +Copyright (c) 2018-24 Lloyd Brookes <75pound@gmail.com>
    +
    +Permission is hereby granted, free of charge, to any person obtaining a copy
    +of this software and associated documentation files (the "Software"), to deal
    +in the Software without restriction, including without limitation the rights
    +to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
    +copies of the Software, and to permit persons to whom the Software is
    +furnished to do so, subject to the following conditions:
    +
    +The above copyright notice and this permission notice shall be included in all
    +copies or substantial portions of the Software.
    +
    +THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
    +IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
    +FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
    +AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
    +LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
    +OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
    +SOFTWARE.
    +
    
  • package.json+13 9 modified
    @@ -21,23 +21,27 @@
       "scripts": {
         "test": "npm run dist && npm run test:ci",
         "test:ci": "test-runner test.js",
    -    "dist": "rollup -c",
    -    "cover": "c8 npm test && c8 report --reporter=text-lcov | coveralls"
    +    "dist": "rollup -c"
       },
       "files": [
         "index.js",
         "dist"
       ],
       "dependencies": {
    -    "lodash.assignwith": "^4.2.0",
    +    "lodash": "^4.17.21",
         "typical": "^7.1.1"
       },
       "devDependencies": {
    -    "@rollup/plugin-commonjs": "^20.0.0",
    -    "@rollup/plugin-node-resolve": "^13.0.4",
    -    "c8": "^7.8.0",
    -    "coveralls": "^3.1.1",
    -    "rollup": "^2.56.3",
    -    "test-runner": "^0.9.8"
    +    "@rollup/plugin-commonjs": "^26.0.1",
    +    "@rollup/plugin-node-resolve": "^15.2.3",
    +    "rollup": "^4.19.1",
    +    "test-runner": "^0.11.0"
    +  },
    +  "standard": {
    +    "ignore": [
    +      "tmp",
    +      "dist"
    +    ],
    +    "envs": []
       }
     }
    
  • package-lock.json+1037 2913 modified
  • README.md+1 2 modified
    @@ -3,7 +3,6 @@
     [![Gihub repo dependents](https://badgen.net/github/dependents-repo/75lb/deep-merge)](https://github.com/75lb/deep-merge/network/dependents?dependent_type=REPOSITORY)
     [![Gihub package dependents](https://badgen.net/github/dependents-pkg/75lb/deep-merge)](https://github.com/75lb/deep-merge/network/dependents?dependent_type=PACKAGE)
     [![Node.js CI](https://github.com/75lb/deep-merge/actions/workflows/node.js.yml/badge.svg)](https://github.com/75lb/deep-merge/actions/workflows/node.js.yml)
    -[![Coverage Status](https://coveralls.io/repos/github/75lb/deep-merge/badge.svg)](https://coveralls.io/github/75lb/deep-merge)
     [![js-standard-style](https://img.shields.io/badge/code%20style-standard-brightgreen.svg)](https://github.com/feross/standard)
     
     # @75lb/deep-merge
    @@ -92,6 +91,6 @@ import deepMerge from './node_modules/@75lb/deep-merge/dist/index.mjs'
     
     * * *
     
    -&copy; 2021 [Lloyd Brookes](https://github.com/75lb) \<75pound@gmail.com\>.
    +&copy; 2018-24 [Lloyd Brookes](https://github.com/75lb) \<75pound@gmail.com\>.
     
     Tested by [test-runner](https://github.com/test-runner-js/test-runner). Documented by [jsdoc-to-markdown](https://github.com/jsdoc2md/jsdoc-to-markdown).
    
  • rollup.config.js+1 1 modified
    @@ -1,5 +1,5 @@
     import { nodeResolve } from '@rollup/plugin-node-resolve'
    -import commonjs from '@rollup/plugin-commonjs';
    +import commonjs from '@rollup/plugin-commonjs'
     
     export default [
       {
    

Vulnerability mechanics

Synthesis attempt was rejected by the grounding validator. Re-run pending.

References

5

News mentions

0

No linked articles in our index yet.