lodash/lodash: 4 upstream defects

Each entry is a real fix from the project's own history. Apply its patch and run the project's own suite, and the tests written in that same upstream commit fall.

the suite it was checked against

language	tests	green run, s	flaky runs	test files locked
node	7,158	19.24	0/10	6

One of the pinned external suites the repair arbiter was run against, as listed on the benchmarks page (fixed values in site/build.py).

the defects

fix: prototype pollution in _.defaultsDeep (#4336)

6 source line(s), 1 test(s) fall, deterministic over three runs. upstream fix 1f8ea0774696. the test that catches it was written by the same engineer in the same commit and was never touched.

file lodash.js · status reported · 2026-08-01

git apply bench/evidence/2026-08-01-real-defect-mine/patches/lodash-defaultsDeep-constructor-pollution.patch && <the project's own suite>

Fix lodash.isEqual for circular references (#4320) (#4515)

18 source line(s), 2 test(s) fall, deterministic over three runs. upstream fix 0cec225778d4. the test that catches it was written by the same engineer in the same commit and was never touched.

file lodash.js · status reported · 2026-08-01

git apply bench/evidence/2026-08-01-real-defect-mine/patches/lodash-isEqual-circular-refs.patch && <the project's own suite>

Ensure `orderBy` will accept iteratee path arrays #4438 (#4513)

15 source line(s), 1 test(s) fall, deterministic over three runs. upstream fix 659e8c019cca. the test that catches it was written by the same engineer in the same commit and was never touched.

file lodash.js · status reported · 2026-08-01

git apply bench/evidence/2026-08-01-real-defect-mine/patches/lodash-orderBy-iteratee-path-arrays.patch && <the project's own suite>

fix(zipObjectDeep): prototype pollution (#4759)

4 source line(s), 10 test(s) fall, deterministic over three runs. upstream fix c84fe82760fb. the test that catches it was written by the same engineer in the same commit and was never touched.

file lodash.js · status reported · 2026-08-01

git apply bench/evidence/2026-08-01-real-defect-mine/patches/lodash-zipObjectDeep-proto-pollution.patch && <the project's own suite>