From 42e2585e5fef7075b06c99ce4b6ef36003348fd3 Mon Sep 17 00:00:00 2001
From: Benjamin Tan <demoneaux@gmail.com>
Date: Sun, 20 Dec 2020 14:19:47 +0800
Subject: [PATCH] Bump to v4.17.20.

---
 README.md             |  4 ++--
 _baseClone.js         |  1 +
 _baseOrderBy.js       | 17 ++++++++++++++++-
 _baseSet.js           |  4 ++++
 _baseSortedIndexBy.js | 11 +++++++----
 _equalArrays.js       |  9 +++++----
 _equalObjects.js      |  9 +++++----
 filter.js             |  4 ++++
 lodash.default.js     |  2 +-
 matches.js            |  7 +++++++
 matchesProperty.js    |  7 +++++++
 overEvery.js          |  4 ++++
 overSome.js           |  7 +++++++
 package.json          |  3 ++-
 sortBy.js             |  6 +++---
 template.js           |  8 +++-----
 16 files changed, 78 insertions(+), 25 deletions(-)

diff --git a/README.md b/README.md
index 55430825c..aea0080cd 100644
--- a/README.md
+++ b/README.md
@@ -1,4 +1,4 @@
-# lodash-es v4.17.15
+# lodash-es v4.17.20
 
 The [Lodash](https://lodash.com/) library exported as [ES](http://www.ecma-international.org/ecma-262/6.0/) modules.
 
@@ -7,4 +7,4 @@ Generated using [lodash-cli](https://www.npmjs.com/package/lodash-cli):
 $ lodash modularize exports=es -o ./
 ```
 
-See the [package source](https://github.com/lodash/lodash/tree/4.17.15-es) for more details.
+See the [package source](https://github.com/lodash/lodash/tree/4.17.20-es) for more details.
diff --git a/_baseClone.js b/_baseClone.js
index 04c200a7f..1584780ac 100644
--- a/_baseClone.js
+++ b/_baseClone.js
@@ -19,6 +19,7 @@ import isMap from './isMap.js';
 import isObject from './isObject.js';
 import isSet from './isSet.js';
 import keys from './keys.js';
+import keysIn from './keysIn.js';
 
 /** Used to compose bitmasks for cloning. */
 var CLONE_DEEP_FLAG = 1,
diff --git a/_baseOrderBy.js b/_baseOrderBy.js
index b9d00aaf9..7ec555ebf 100644
--- a/_baseOrderBy.js
+++ b/_baseOrderBy.js
@@ -1,10 +1,12 @@
 import arrayMap from './_arrayMap.js';
+import baseGet from './_baseGet.js';
 import baseIteratee from './_baseIteratee.js';
 import baseMap from './_baseMap.js';
 import baseSortBy from './_baseSortBy.js';
 import baseUnary from './_baseUnary.js';
 import compareMultiple from './_compareMultiple.js';
 import identity from './identity.js';
+import isArray from './isArray.js';
 
 /**
  * The base implementation of `_.orderBy` without param guards.
@@ -16,8 +18,21 @@ import identity from './identity.js';
  * @returns {Array} Returns the new sorted array.
  */
 function baseOrderBy(collection, iteratees, orders) {
+  if (iteratees.length) {
+    iteratees = arrayMap(iteratees, function(iteratee) {
+      if (isArray(iteratee)) {
+        return function(value) {
+          return baseGet(value, iteratee.length === 1 ? iteratee[0] : iteratee);
+        }
+      }
+      return iteratee;
+    });
+  } else {
+    iteratees = [identity];
+  }
+
   var index = -1;
-  iteratees = arrayMap(iteratees.length ? iteratees : [identity], baseUnary(baseIteratee));
+  iteratees = arrayMap(iteratees, baseUnary(baseIteratee));
 
   var result = baseMap(collection, function(value, key, collection) {
     var criteria = arrayMap(iteratees, function(iteratee) {
diff --git a/_baseSet.js b/_baseSet.js
index 6cdc792c6..e17dd6709 100644
--- a/_baseSet.js
+++ b/_baseSet.js
@@ -29,6 +29,10 @@ function baseSet(object, path, value, customizer) {
     var key = toKey(path[index]),
         newValue = value;
 
+    if (key === '__proto__' || key === 'constructor' || key === 'prototype') {
+      return object;
+    }
+
     if (index != lastIndex) {
       var objValue = nested[key];
       newValue = customizer ? customizer(objValue, key, nested) : undefined;
diff --git a/_baseSortedIndexBy.js b/_baseSortedIndexBy.js
index 20a90d0ad..6ab156532 100644
--- a/_baseSortedIndexBy.js
+++ b/_baseSortedIndexBy.js
@@ -22,11 +22,14 @@ var nativeFloor = Math.floor,
  *  into `array`.
  */
 function baseSortedIndexBy(array, value, iteratee, retHighest) {
-  value = iteratee(value);
-
   var low = 0,
-      high = array == null ? 0 : array.length,
-      valIsNaN = value !== value,
+      high = array == null ? 0 : array.length;
+  if (high === 0) {
+    return 0;
+  }
+
+  value = iteratee(value);
+  var valIsNaN = value !== value,
       valIsNull = value === null,
       valIsSymbol = isSymbol(value),
       valIsUndefined = value === undefined;
diff --git a/_equalArrays.js b/_equalArrays.js
index 77cafd960..cf599255c 100644
--- a/_equalArrays.js
+++ b/_equalArrays.js
@@ -27,10 +27,11 @@ function equalArrays(array, other, bitmask, customizer, equalFunc, stack) {
   if (arrLength != othLength && !(isPartial && othLength > arrLength)) {
     return false;
   }
-  // Assume cyclic values are equal.
-  var stacked = stack.get(array);
-  if (stacked && stack.get(other)) {
-    return stacked == other;
+  // Check that cyclic values are equal.
+  var arrStacked = stack.get(array);
+  var othStacked = stack.get(other);
+  if (arrStacked && othStacked) {
+    return arrStacked == other && othStacked == array;
   }
   var index = -1,
       result = true,
diff --git a/_equalObjects.js b/_equalObjects.js
index 9f304ab7a..91795616f 100644
--- a/_equalObjects.js
+++ b/_equalObjects.js
@@ -39,10 +39,11 @@ function equalObjects(object, other, bitmask, customizer, equalFunc, stack) {
       return false;
     }
   }
-  // Assume cyclic values are equal.
-  var stacked = stack.get(object);
-  if (stacked && stack.get(other)) {
-    return stacked == other;
+  // Check that cyclic values are equal.
+  var objStacked = stack.get(object);
+  var othStacked = stack.get(other);
+  if (objStacked && othStacked) {
+    return objStacked == other && othStacked == object;
   }
   var result = true;
   stack.set(object, other);
diff --git a/filter.js b/filter.js
index e45a7ba57..ef6ac6113 100644
--- a/filter.js
+++ b/filter.js
@@ -39,6 +39,10 @@ import isArray from './isArray.js';
  * // The `_.property` iteratee shorthand.
  * _.filter(users, 'active');
  * // => objects for ['barney']
+ *
+ * // Combining several predicates using `_.overEvery` or `_.overSome`.
+ * _.filter(users, _.overSome([{ 'age': 36 }, ['age', 40]]));
+ * // => objects for ['fred', 'barney']
  */
 function filter(collection, predicate) {
   var func = isArray(collection) ? arrayFilter : baseFilter;
diff --git a/lodash.default.js b/lodash.default.js
index 540d2d757..9772408bb 100644
--- a/lodash.default.js
+++ b/lodash.default.js
@@ -45,7 +45,7 @@ import toInteger from './toInteger.js';
 import lodash from './wrapperLodash.js';
 
 /** Used as the semantic version number. */
-var VERSION = '4.17.15';
+var VERSION = '4.17.20';
 
 /** Used to compose bitmasks for function metadata. */
 var WRAP_BIND_KEY_FLAG = 2;
diff --git a/matches.js b/matches.js
index 62aed6c77..fd3ed49ec 100644
--- a/matches.js
+++ b/matches.js
@@ -16,6 +16,9 @@ var CLONE_DEEP_FLAG = 1;
  * values against any array or object value, respectively. See `_.isEqual`
  * for a list of supported value comparisons.
  *
+ * **Note:** Multiple values can be checked by combining several matchers
+ * using `_.overSome`
+ *
  * @static
  * @memberOf _
  * @since 3.0.0
@@ -31,6 +34,10 @@ var CLONE_DEEP_FLAG = 1;
  *
  * _.filter(objects, _.matches({ 'a': 4, 'c': 6 }));
  * // => [{ 'a': 4, 'b': 5, 'c': 6 }]
+ *
+ * // Checking for several possible values
+ * _.filter(objects, _.overSome([_.matches({ 'a': 1 }), _.matches({ 'a': 4 })]));
+ * // => [{ 'a': 1, 'b': 2, 'c': 3 }, { 'a': 4, 'b': 5, 'c': 6 }]
  */
 function matches(source) {
   return baseMatches(baseClone(source, CLONE_DEEP_FLAG));
diff --git a/matchesProperty.js b/matchesProperty.js
index a98fea92c..4dea7fd3d 100644
--- a/matchesProperty.js
+++ b/matchesProperty.js
@@ -13,6 +13,9 @@ var CLONE_DEEP_FLAG = 1;
  * `srcValue` values against any array or object value, respectively. See
  * `_.isEqual` for a list of supported value comparisons.
  *
+ * **Note:** Multiple values can be checked by combining several matchers
+ * using `_.overSome`
+ *
  * @static
  * @memberOf _
  * @since 3.2.0
@@ -29,6 +32,10 @@ var CLONE_DEEP_FLAG = 1;
  *
  * _.find(objects, _.matchesProperty('a', 4));
  * // => { 'a': 4, 'b': 5, 'c': 6 }
+ *
+ * // Checking for several possible values
+ * _.filter(objects, _.overSome([_.matchesProperty('a', 1), _.matchesProperty('a', 4)]));
+ * // => [{ 'a': 1, 'b': 2, 'c': 3 }, { 'a': 4, 'b': 5, 'c': 6 }]
  */
 function matchesProperty(path, srcValue) {
   return baseMatchesProperty(path, baseClone(srcValue, CLONE_DEEP_FLAG));
diff --git a/overEvery.js b/overEvery.js
index 6b262d8b3..a71e1b3ab 100644
--- a/overEvery.js
+++ b/overEvery.js
@@ -5,6 +5,10 @@ import createOver from './_createOver.js';
  * Creates a function that checks if **all** of the `predicates` return
  * truthy when invoked with the arguments it receives.
  *
+ * Following shorthands are possible for providing predicates.
+ * Pass an `Object` and it will be used as an parameter for `_.matches` to create the predicate.
+ * Pass an `Array` of parameters for `_.matchesProperty` and the predicate will be created using them.
+ *
  * @static
  * @memberOf _
  * @since 4.0.0
diff --git a/overSome.js b/overSome.js
index 9893ba670..e3af9a08a 100644
--- a/overSome.js
+++ b/overSome.js
@@ -5,6 +5,10 @@ import createOver from './_createOver.js';
  * Creates a function that checks if **any** of the `predicates` return
  * truthy when invoked with the arguments it receives.
  *
+ * Following shorthands are possible for providing predicates.
+ * Pass an `Object` and it will be used as an parameter for `_.matches` to create the predicate.
+ * Pass an `Array` of parameters for `_.matchesProperty` and the predicate will be created using them.
+ *
  * @static
  * @memberOf _
  * @since 4.0.0
@@ -24,6 +28,9 @@ import createOver from './_createOver.js';
  *
  * func(NaN);
  * // => false
+ *
+ * var matchesFunc = _.overSome([{ 'a': 1 }, { 'a': 2 }])
+ * var matchesPropertyFunc = _.overSome([['a', 1], ['a', 2]])
  */
 var overSome = createOver(arraySome);
 
diff --git a/package.json b/package.json
index f0f7459b7..31d0df655 100644
--- a/package.json
+++ b/package.json
@@ -1,12 +1,13 @@
 {
   "name": "lodash-es",
-  "version": "4.17.15",
+  "version": "4.17.20",
   "description": "Lodash exported as ES modules.",
   "keywords": "es6, modules, stdlib, util",
   "homepage": "https://lodash.com/custom-builds",
   "bugs": "https://github.com/lodash/lodash-cli/issues",
   "repository": "lodash/lodash",
   "license": "MIT",
+  "type": "module",
   "jsnext:main": "lodash.js",
   "main": "lodash.js",
   "module": "lodash.js",
diff --git a/sortBy.js b/sortBy.js
index e37cd2ca9..45dfdacea 100644
--- a/sortBy.js
+++ b/sortBy.js
@@ -22,15 +22,15 @@ import isIterateeCall from './_isIterateeCall.js';
  * var users = [
  *   { 'user': 'fred',   'age': 48 },
  *   { 'user': 'barney', 'age': 36 },
- *   { 'user': 'fred',   'age': 40 },
+ *   { 'user': 'fred',   'age': 30 },
  *   { 'user': 'barney', 'age': 34 }
  * ];
  *
  * _.sortBy(users, [function(o) { return o.user; }]);
- * // => objects for [['barney', 36], ['barney', 34], ['fred', 48], ['fred', 40]]
+ * // => objects for [['barney', 36], ['barney', 34], ['fred', 48], ['fred', 30]]
  *
  * _.sortBy(users, ['user', 'age']);
- * // => objects for [['barney', 34], ['barney', 36], ['fred', 40], ['fred', 48]]
+ * // => objects for [['barney', 34], ['barney', 36], ['fred', 30], ['fred', 48]]
  */
 var sortBy = baseRest(function(collection, iteratees) {
   if (collection == null) {
diff --git a/template.js b/template.js
index aab4a0841..a746c3268 100644
--- a/template.js
+++ b/template.js
@@ -169,11 +169,11 @@ function template(string, options, guard) {
 
   // Use a sourceURL for easier debugging.
   // The sourceURL gets injected into the source that's eval-ed, so be careful
-  // with lookup (in case of e.g. prototype pollution), and strip newlines if any.
-  // A newline wouldn't be a valid sourceURL anyway, and it'd enable code injection.
+  // to normalize all kinds of whitespace, so e.g. newlines (and unicode versions of it) can't sneak in
+  // and escape the comment, thus injecting code that gets evaled.
   var sourceURL = hasOwnProperty.call(options, 'sourceURL')
     ? ('//# sourceURL=' +
-       (options.sourceURL + '').replace(/[\r\n]/g, ' ') +
+       (options.sourceURL + '').replace(/\s/g, ' ') +
        '\n')
     : '';
 
@@ -206,8 +206,6 @@ function template(string, options, guard) {
 
   // If `variable` is not specified wrap a with-statement around the generated
   // code to add the data object to the top of the scope chain.
-  // Like with sourceURL, we take care to not check the option's prototype,
-  // as this configuration is a code injection vector.
   var variable = hasOwnProperty.call(options, 'variable') && options.variable;
   if (!variable) {
     source = 'with (obj) {\n' + source + '\n}\n';