Skip to content

Release 1.13.8 #3015

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
jgonggrijp wants to merge 14 commits into
base: master-pre1.13.8
Choose a base branch
from
Open

Release 1.13.8 #3015

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
14 commits
Select commit Hold shift + click to select a range
837ef7e
Bump the version to 1.13.8
jgonggrijp Feb 15, 2026
354734e
Bump the copyright years
jgonggrijp Feb 15, 2026
0ad2338
Add a .editorconfig
jgonggrijp Feb 16, 2026
8b314a1
Add regression test against stack overflow in _.flatten
jgonggrijp Feb 16, 2026
411e222
Make internal flatten nonrecursive
jgonggrijp Feb 16, 2026
f2b5164
Add regression test against stack overflow in _.isEqual
jgonggrijp Feb 17, 2026
a6e23ae
Make _.isEqual nonrecursive
jgonggrijp Feb 17, 2026
42823bb
Temporarily obfuscate comments
jgonggrijp Feb 17, 2026
1ccfdd0
Add preliminary release notes for 1.13.8
jgonggrijp Feb 18, 2026
4a4019e
Update minified bundles
jgonggrijp Feb 18, 2026
45ea015
Revert obfuscations from 42823bb.
jgonggrijp Feb 19, 2026
b579595
Mention CVE-2026-27601 in comments and documentation (#3011)
jgonggrijp Mar 3, 2026
a1ac1d3
Add links to diff and docs in 1.13.8 change log entry
jgonggrijp Mar 3, 2026
309ad7e
Re-generate annotated sources and minified codemaps
jgonggrijp Mar 3, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
17 changes: 17 additions & 0 deletions .editorconfig
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,17 @@
# EditorConfig helps developers define and maintain consistent
# coding styles between different editors and IDEs
# editorconfig.org

root = true


[*]

indent_style = space
indent_size = 2
charset = utf-8
insert_final_newline = true
trim_trailing_whitespace = true

[**/package.json]
indent_size = 2
56 changes: 37 additions & 19 deletions docs/modules/_flatten.html
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -863,21 +863,12 @@ <h1>_flatten.js</h1>
<div class="pilwrap ">
<a class="pilcrow" href="#section-2">&#182;</a>
</div>
<p>Internal implementation of a recursive <code>flatten</code> function.</p>
<p>Internal implementation of a <code>flatten</code> function.</p>

</div>

<div class="content"><div class='highlight'><pre><span class="hljs-keyword">export</span> <span class="hljs-keyword">default</span> <span class="hljs-keyword">function</span> <span class="hljs-title function_">flatten</span>(<span class="hljs-params">input, depth, strict, output</span>) {
output = output || [];
<span class="hljs-keyword">if</span> (!depth &amp;&amp; depth !== <span class="hljs-number">0</span>) {
depth = <span class="hljs-title class_">Infinity</span>;
} <span class="hljs-keyword">else</span> <span class="hljs-keyword">if</span> (depth &lt;= <span class="hljs-number">0</span>) {
<span class="hljs-keyword">return</span> output.<span class="hljs-title function_">concat</span>(input);
}
<span class="hljs-keyword">var</span> idx = output.<span class="hljs-property">length</span>;
<span class="hljs-keyword">for</span> (<span class="hljs-keyword">var</span> i = <span class="hljs-number">0</span>, length = <span class="hljs-title function_">getLength</span>(input); i &lt; length; i++) {
<span class="hljs-keyword">var</span> value = input[i];
<span class="hljs-keyword">if</span> (<span class="hljs-title function_">isArrayLike</span>(value) &amp;&amp; (<span class="hljs-title function_">isArray</span>(value) || <span class="hljs-title function_">isArguments</span>(value))) {</pre></div></div>
<div class="content"><div class='highlight'><pre><span class="hljs-keyword">export</span> <span class="hljs-keyword">default</span> <span class="hljs-keyword">function</span> <span class="hljs-title function_">flatten</span>(<span class="hljs-params">input, depth, strict</span>) {
<span class="hljs-keyword">if</span> (!depth &amp;&amp; depth !== <span class="hljs-number">0</span>) depth = <span class="hljs-title class_">Infinity</span>;</pre></div></div>

</li>

Expand All @@ -888,17 +879,44 @@ <h1>_flatten.js</h1>
<div class="pilwrap ">
<a class="pilcrow" href="#section-3">&#182;</a>
</div>
<p>We will be avoiding recursive calls because this could be exploited to
cause a stack overflow (CVE-2026-27601). Instead, we “trampoline” on an
explicit stack.</p>

</div>

<div class="content"><div class='highlight'><pre> <span class="hljs-keyword">var</span> output = [], idx = <span class="hljs-number">0</span>, i = <span class="hljs-number">0</span>, length = <span class="hljs-title function_">getLength</span>(input) || <span class="hljs-number">0</span>, stack = [];
<span class="hljs-keyword">while</span> (<span class="hljs-literal">true</span>) {
<span class="hljs-keyword">if</span> (i &gt;= length) {
<span class="hljs-keyword">if</span> (!stack.<span class="hljs-property">length</span>) <span class="hljs-keyword">break</span>;
<span class="hljs-keyword">var</span> frame = stack.<span class="hljs-title function_">pop</span>();
i = frame.<span class="hljs-property">i</span>;
input = frame.<span class="hljs-property">v</span>;
length = <span class="hljs-title function_">getLength</span>(input);
<span class="hljs-keyword">continue</span>;
}
<span class="hljs-keyword">var</span> value = input[i++];
<span class="hljs-keyword">if</span> (stack.<span class="hljs-property">length</span> &gt;= depth) {
output[idx++] = value;
} <span class="hljs-keyword">else</span> <span class="hljs-keyword">if</span> (<span class="hljs-title function_">isArrayLike</span>(value) &amp;&amp; (<span class="hljs-title function_">isArray</span>(value) || <span class="hljs-title function_">isArguments</span>(value))) {</pre></div></div>

</li>


<li id="section-4">
<div class="annotation">

<div class="pilwrap ">
<a class="pilcrow" href="#section-4">&#182;</a>
</div>
<p>Flatten current level of array or arguments object.</p>

</div>

<div class="content"><div class='highlight'><pre> <span class="hljs-keyword">if</span> (depth &gt; <span class="hljs-number">1</span>) {
<span class="hljs-title function_">flatten</span>(value, depth - <span class="hljs-number">1</span>, strict, output);
idx = output.<span class="hljs-property">length</span>;
} <span class="hljs-keyword">else</span> {
<span class="hljs-keyword">var</span> j = <span class="hljs-number">0</span>, len = value.<span class="hljs-property">length</span>;
<span class="hljs-keyword">while</span> (j &lt; len) output[idx++] = value[j++];
}
<div class="content"><div class='highlight'><pre> stack.<span class="hljs-title function_">push</span>({<span class="hljs-attr">i</span>: i, <span class="hljs-attr">v</span>: input});
i = <span class="hljs-number">0</span>;
input = value;
length = <span class="hljs-title function_">getLength</span>(input);
} <span class="hljs-keyword">else</span> <span class="hljs-keyword">if</span> (!strict) {
output[idx++] = value;
}
Expand Down
2 changes: 1 addition & 1 deletion docs/modules/_setup.html
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -850,7 +850,7 @@ <h1>_setup.js</h1>

</div>

<div class="content"><div class='highlight'><pre><span class="hljs-keyword">export</span> <span class="hljs-keyword">var</span> <span class="hljs-variable constant_">VERSION</span> = <span class="hljs-string">&#x27;1.13.7&#x27;</span>;</pre></div></div>
<div class="content"><div class='highlight'><pre><span class="hljs-keyword">export</span> <span class="hljs-keyword">var</span> <span class="hljs-variable constant_">VERSION</span> = <span class="hljs-string">&#x27;1.13.8&#x27;</span>;</pre></div></div>

</li>

Expand Down
4 changes: 2 additions & 2 deletions docs/modules/index.html
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -865,9 +865,9 @@ <h1 id="named-exports">Named Exports</h1>
<div class="pilwrap ">
<a class="pilcrow" href="#section-3">&#182;</a>
</div>
<pre><code><span class="hljs-title class_">Underscore</span>.<span class="hljs-property">js</span> <span class="hljs-number">1.13</span><span class="hljs-number">.7</span>
<pre><code><span class="hljs-title class_">Underscore</span>.<span class="hljs-property">js</span> <span class="hljs-number">1.13</span><span class="hljs-number">.8</span>
<span class="hljs-attr">https</span>:<span class="hljs-comment">//underscorejs.org</span>
(c) <span class="hljs-number">2009</span>-<span class="hljs-number">2024</span> <span class="hljs-title class_">Jeremy</span> <span class="hljs-title class_">Ashkenas</span>, <span class="hljs-title class_">Julian</span> <span class="hljs-title class_">Gonggrijp</span>, and <span class="hljs-title class_">DocumentCloud</span> and <span class="hljs-title class_">Investigative</span> <span class="hljs-title class_">Reporters</span> &amp; <span class="hljs-title class_">Editors</span>
(c) <span class="hljs-number">2009</span>-<span class="hljs-number">2026</span> <span class="hljs-title class_">Jeremy</span> <span class="hljs-title class_">Ashkenas</span>, <span class="hljs-title class_">Julian</span> <span class="hljs-title class_">Gonggrijp</span>, and <span class="hljs-title class_">DocumentCloud</span> and <span class="hljs-title class_">Investigative</span> <span class="hljs-title class_">Reporters</span> &amp; <span class="hljs-title class_">Editors</span>
<span class="hljs-title class_">Underscore</span> may be freely distributed under the <span class="hljs-variable constant_">MIT</span> license.
</code></pre>

Expand Down
Loading