-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Format: 1.8
Date: Sun, 05 Jul 2026 02:41:49 +0530
Source: node-lodash
Binary: libjs-lodash node-lodash node-lodash-packages
Architecture: all
Version: 4.17.21+dfsg+~cs8.31.198.20210220-9+deb13u1
Distribution: trixie
Urgency: high
Maintainer: all Build Daemon (x86-csail-02) <buildd_all-x86-csail-02@buildd.debian.org>
Changed-By: Utkarsh Gupta <utkarsh@debian.org>
Description:
 libjs-lodash - Lo-dash is a Javascript utility library
 node-lodash - Lo-dash is a Node.js utility library
 node-lodash-packages - Lo-dash is a Node.js utility library (per method packages)
Closes: 1126265
Changes:
 node-lodash (4.17.21+dfsg+~cs8.31.198.20210220-9+deb13u1) trixie; urgency=high
 .
   * Non-maintainer upload by the LTS team.
   * Add patch to prevent prototype pollution on baseUnset function.
     (Fixes: CVE-2025-13465) (Closes: #1126265)
   * Add patch to block prototype pollution in baseUnset via
     constructor/prototype traversal (array-wrapped path bypass of the
     CVE-2025-13465 fix). (Fixes: CVE-2026-2950)
   * Add patch to validate imports keys in _.template, preventing code
     injection via the Function() sink. (Fixes: CVE-2026-4800)
   * Add patch to update lodash-cli dependency map so the regenerated
     lodash.template module requires assignWith/arrayEach; without it the
     module throws "assignWith is not defined" at runtime (caught by the
     node-gulp-util autopkgtest). (Related: CVE-2026-4800)
Checksums-Sha1:
 16f2a3eb5158da75f0ad5dbc57c94b4db9d29962 113916 libjs-lodash_4.17.21+dfsg+~cs8.31.198.20210220-9+deb13u1_all.deb
 83fc234a27d2332530971808a9130beea5b338ce 179116 node-lodash-packages_4.17.21+dfsg+~cs8.31.198.20210220-9+deb13u1_all.deb
 0e8ce294ac0a2219c26dbc44e9e06f5d22ddbaee 19133 node-lodash_4.17.21+dfsg+~cs8.31.198.20210220-9+deb13u1_all-buildd.buildinfo
 0dda81922a287a61ebfa8f1eabbf9b77f7d68837 462184 node-lodash_4.17.21+dfsg+~cs8.31.198.20210220-9+deb13u1_all.deb
Checksums-Sha256:
 3ab11001abf36a57765180205aa6ff69bfb11ee6229fb89e3b60ae3e97bfbbee 113916 libjs-lodash_4.17.21+dfsg+~cs8.31.198.20210220-9+deb13u1_all.deb
 4930724b4b0c519394c2e56b85fc9bad279efb3db59b4cd5347cb26fd213a8d2 179116 node-lodash-packages_4.17.21+dfsg+~cs8.31.198.20210220-9+deb13u1_all.deb
 81e6fda20bd7df3c9181ebba4af4fde3892e55607e1d801d4a06248ed66c87e0 19133 node-lodash_4.17.21+dfsg+~cs8.31.198.20210220-9+deb13u1_all-buildd.buildinfo
 7ccc3bacec8feea01f4b311d7bb000bd3e065e69c7697deece64dba85b7178f2 462184 node-lodash_4.17.21+dfsg+~cs8.31.198.20210220-9+deb13u1_all.deb
Files:
 4ce59303aa4e8dcdc0d91e5e83f85325 113916 javascript optional libjs-lodash_4.17.21+dfsg+~cs8.31.198.20210220-9+deb13u1_all.deb
 742774adcd5dee89519957b121042ae2 179116 javascript optional node-lodash-packages_4.17.21+dfsg+~cs8.31.198.20210220-9+deb13u1_all.deb
 284c06e3739782ed241d362b5c4a8d0d 19133 javascript optional node-lodash_4.17.21+dfsg+~cs8.31.198.20210220-9+deb13u1_all-buildd.buildinfo
 841854f219b5f1db6ca6c4079793877c 462184 javascript optional node-lodash_4.17.21+dfsg+~cs8.31.198.20210220-9+deb13u1_all.deb

-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEEXLxUpUHQBQBTDtd4aBVi67oXtfkFAmpkpu4ACgkQaBVi67oX
tfkJXhAAp7qA3YzQneVIBmqgzGYQNvqEUZGBo6wDjGRyelMbLP8i7kSwxXLH0E3S
eK9PCdwmTA6pljJnEX5qVd3m0TcbAUfaKFYbJXIfZFMLuK6cElEgEaSpWMXaEEhU
5gAcyOqAOAGaHGjwUC4LssZloqKLPrvdSJ3mPllPr4V6Jl9eg4DRDXuvQWyVde++
MQOItB2nAsgJOdGKXcJlGNXwigtV9YOXHjOY7xLSSfJ5E0/DhlPR1vwh7pfGvlau
JwTds0wASzuQFANiMQ1JqxEoL3fPGx2qyLOpB6H1yp0u4GInjoeTp9JEsWelOioU
nVPpuqvAFZIEQ0z/MVLUC0klrATqarlYYLZWq7EP8k2mZrRuMjiv6i+aF3lKOKOS
HzdztyqNOK0yVkSnVE17hu5B8ELzcU+5OIABWfIDpInwaavj7nAayfHliAum1MjG
PPgag2ayOSzocK9Q2BzgfTRXYxAFQnFOTXu8QEwG3j0A/yZZ5Jb07bGnUKjVZ8PT
nUa46MdABDTmgJYRhErKCQW6VBd+BynX9VuGGyT+ORfgVQKTha/lTnwLmioCT3n0
+1aeZ9cVNb0LV62Pfp6X3llIJ28thmmZOy41wyUAqOYE05UMt/uISwqRU0mSJdxO
+JJs+XNKKt+0wyHXDTsynH5dLm8i70vzEYIMy56+xZMYHNed0Dc=
=XiuI
-----END PGP SIGNATURE-----