node-lodash (4.17.15+dfsg-2ubuntu0.1~esm1) focal-security; urgency=medium

  * SECURITY UPDATE: ReDoS in _.trim via toNumber
    - debian/patches/CVE-2020-28500.patch: restrict trim regex to
      prevent catastrophic backtracking on crafted input in lodash.js,
      test/test.js.
    - CVE-2020-28500
  * SECURITY UPDATE: prototype pollution via zipObjectDeep
    - debian/patches/CVE-2020-8203.patch: add path key blocklist in
      baseSet and baseUnset to reject __proto__ and constructor in
      lodash.js, test/test.js.
    - CVE-2020-8203
  * SECURITY UPDATE: command injection via _.template variable option
    - debian/patches/CVE-2021-23337.patch: validate variable names in
      template against reForbiddenIdentifierChars in lodash.js,
      test/test.js.
    - CVE-2021-23337
  * SECURITY UPDATE: prototype pollution in baseUnset
    - debian/patches/CVE-2025-13465.patch: add path traversal guards
      in baseUnset to block __proto__ and constructor.prototype paths in
      lodash.js, test/test.js.
    - CVE-2025-13465
  * SECURITY UPDATE: prototype pollution in baseUnset (bypass)
    - debian/patches/CVE-2026-2950.patch: use toKey() to normalize path
      segments and block constructor/prototype as non-terminal keys in
      lodash.js, test/test.js.
    - CVE-2026-2950
  * SECURITY UPDATE: command injection via _.template imports keys
    - debian/patches/CVE-2026-4800_1.patch: validate imports key names
      against reForbiddenIdentifierChars and switch assignInWith to
      assignWith in lodash.js, test/test.js.
    - debian/patches/CVE-2026-4800_2.patch: fix test references in
      test/test.js.
    - CVE-2026-4800

 -- Shafayat Hossain Majumder <shafayat.majumder@canonical.com>  Mon, 08 Jun 2026 09:36:23 -0400

node-lodash (4.17.15+dfsg-2) unstable; urgency=medium

  * Team upload

  [ Debian Janitor ]
  * Set field Upstream-Contact in debian/copyright.
  * Set upstream metadata fields: Bug-Submit.
  * Remove obsolete fields Contact, Name from debian/upstream/metadata
    (already present in machine-readable debian/copyright).

  [ Xavier Guimard ]
  * Declare compliance with policy 4.5.0
  * Add "Rules-Requires-Root: no"
  * Fix deprecation warning about "root" (Closes: #935845)
  * Install upstream lodash.js, not a custom one (Closes: #949615)
  * Mention component source (Closes: #943389)

 -- Xavier Guimard <yadd@debian.org>  Thu, 30 Jan 2020 06:25:45 +0100

node-lodash (4.17.15+dfsg-1) unstable; urgency=medium

  * Team upload
  * Bump debhelper compatibility level to 12
  * Update gbp.conf
  * New upstream version 4.17.15+dfsg (Closes: #933079, CVE-2019-10744)
  * Update debian/copyright
  * Install in /usr/share/nodejs
  * Update debian/clean
  * Allow stderr output in autopkgtest "require" test. Fixes debci
  * Remove LICENSE and README.md files in node-lodash-packages

 -- Xavier Guimard <yadd@debian.org>  Tue, 13 Aug 2019 17:47:38 +0200

node-lodash (4.17.11+dfsg-4) unstable; urgency=medium

  [ Xavier Guimard ]
  * Fix "Files-Excluded" field

  [ Pirate Praveen ]
  * Reupload to unstable
  * Bump Standards-Version to 4.4.0 (no changes needed)
  * Switch to uglifyjs.terser

 -- Pirate Praveen <praveen@debian.org>  Mon, 05 Aug 2019 05:40:03 +0000

node-lodash (4.17.11+dfsg-3) experimental; urgency=medium

  [ Xavier Guimard ]
  * Add upstream/metadata
  * Update URLs to https
  * Use debian/clean to clean build
  * Fix debian/watch

  [ Pirate Praveen ]
  * Generate ES modules and provide node-lodash-es
  * Drop debian/node_modules in favor of multiple tarballs

 -- Pirate Praveen <praveen@debian.org>  Thu, 27 Jun 2019 18:34:57 +0530

node-lodash (4.17.11+dfsg-2) unstable; urgency=medium

  * Drop modules directory (now generated from source)
  * Embed lodash-cli module
  * Don't gitignore debian/node_modules
  * Generate split npm packages and files for lodash node module
  * Add node-lodash-packages binary (Closes: #873016)

 -- Pirate Praveen <praveen@debian.org>  Mon, 18 Feb 2019 15:31:23 +0530

node-lodash (4.17.11+dfsg-1) unstable; urgency=medium

  * New upstream release

 -- Pirate Praveen <praveen@debian.org>  Fri, 21 Sep 2018 17:15:00 +0530

node-lodash (4.17.4+dfsg-1) unstable; urgency=medium

  * New upstream release
  * Add debian/README.Debian to explain steps of using multi orig tarballs

 -- Pirate Praveen <praveen@debian.org>  Tue, 22 Aug 2017 22:54:01 +0530

node-lodash (4.16.6+dfsg-2) unstable; urgency=medium

  * Include per method js files (Closes: #849275)
  * Add myself to uploaders

 -- Pirate Praveen <praveen@debian.org>  Sun, 25 Dec 2016 12:58:16 +0530

node-lodash (4.16.6+dfsg-1) unstable; urgency=medium

  * Team upload

  [ Paolo Greppi ]
  * Fix build when /bin/sh is set to bash (see #841698).

  [ Sruthi Chandran ]
  * New upstream release (Closes: #842589)
  * Use gitlab mirror in debian/watch (github.com tag page cannot show
    latest releases)

 -- Sruthi Chandran <srud@disroot.org>  Thu, 10 Nov 2016 22:41:04 +0530

node-lodash (4.3.0+dfsg-1) experimental; urgency=medium

  * Team upload.
  * New upstream release.
  * Clean up debian/copyright

 -- Valentin OVD <valentin.ovd@live.fr>  Fri, 12 Feb 2016 15:02:12 +0200
node-lodash (3.9.3+dfsg-1) experimental; urgency=medium

  * Team upload.
  * New upstream release (Closes: #805282).
  * Ran wrap-and-sort -t -a.
  * Added public-domain license in debian/copyright.
  * Standards-Version is now 3.9.6.

 -- Thomas Goirand <zigo@debian.org>  Mon, 16 Nov 2015 11:37:25 +0000

node-lodash (2.4.1+dfsg-3) unstable; urgency=low

  * Add the missing licence (Closes: #751583)

 -- Valentin OVD <valentin.ovd@live.fr>  Thu, 19 Jun 2014 17:08:03 +0200

node-lodash (2.4.1+dfsg-2) unstable; urgency=low

  * Move javascript-common from recommends to depends for libjs-lodash

 -- Valentin OVD <valentin.ovd@live.fr>  Thu, 12 Jun 2014 16:19:58 +0200

node-lodash (2.4.1+dfsg-1) unstable; urgency=low

  * Initial release (Closes: #748610)

 -- Valentin OVD <valentin.ovd@live.fr>  Mon, 12 May 2014 16:19:58 +0200
