v4.18.0
Full Changelog: https://github.com/lodash/lodash/compare/4.17.23...4.18.0
Security
_.unset / _.omit: Fixed prototype pollution via constructor/prototype path traversal (GHSA-f23m-r3pf-42rh, ). Previously, array-wrapped path segments and primitive roots could bypass the existing guards, allowing deletion of properties from built-in prototypes. Now and are blocked unconditionally as non-terminal path keys, matching . Calls that previously returned and deleted the property now return and leave the target untouched.