# Contributor handoff — lodash/lodash

> Canonical page: https://codevetter.com/unpack/lodash/agent-handoff

# Contributor handoff — lodash/lodash

Scanned commit 2b5e6f7399a7b48005140b5d5c6bc6c0e62919a8 (2026-09-11). Generated by codevetter codevetter 1.12.0 on 2026-09-22.

Read `.github/CONTRIBUTING.md` first — it states the core rule that for additions or bug fixes you should only modify `lodash.js` and add tests in `test/`, and explicitly says not to regenerate `dist/` or `doc/`. That rule is in tension with `ci-dist-sync.yml`, which fails the build if `npm run build` changes `dist/`, so a change to `lodash.js` does require a rebuild and commit of `dist/lodash.js` and `dist/lodash.min.js`. The style gate is JSCS with unusual rules (`requireEarlyReturn`, no `with`, single quotes, 2-space indent, JSDoc types required), so match the surrounding code exactly. Never hand-edit `dist/*`, `doc/README.md`, or anything under `vendor/` — they are generated or vendored.
- CONTRIBUTING states the contract directly: "For additions or bug fixes you should only need to modify `lodash.js`. Include updated unit tests in the `test` directory... Don't worry about regenerating the `dist/` or `doc/` files." — [.github/CONTRIBUTING.md#L21-26](https://github.com/lodash/lodash/blob/2b5e6f7399a7b48005140b5d5c6bc6c0e62919a8/.github/CONTRIBUTING.md#L21-L26)
- Despite that guidance, `ci-dist-sync.yml` runs `npm run build` then `git diff --exit-code dist/` and fails with an explicit "Run 'npm run build' and commit the updated dist/ files" error — so an agent editing `lodash.js` must also commit the rebuilt `dist/lodash.js` and `dist/lodash.min.js`. — [.github/workflows/ci-dist-sync.yml#L30-37](https://github.com/lodash/lodash/blob/2b5e6f7399a7b48005140b5d5c6bc6c0e62919a8/.github/workflows/ci-dist-sync.yml#L30-L37) [.github/CONTRIBUTING.md#L24-26](https://github.com/lodash/lodash/blob/2b5e6f7399a7b48005140b5d5c6bc6c0e62919a8/.github/CONTRIBUTING.md#L24-L26)
- `dist/lodash.js` is currently byte-identical to `lodash.js` (the build is a plain `fs.copy`), so any `lodash.js` edit produces a mechanically predictable dist diff. — [lib/main/build-dist.js#L11-29](https://github.com/lodash/lodash/blob/2b5e6f7399a7b48005140b5d5c6bc6c0e62919a8/lib/main/build-dist.js#L11-L29) [dist/lodash.js#L1-9](https://github.com/lodash/lodash/blob/2b5e6f7399a7b48005140b5d5c6bc6c0e62919a8/dist/lodash.js#L1-L9)
- Files an agent must read before editing, in order: `.github/CONTRIBUTING.md`, `package.json` scripts, `lodash.js` (the target region plus the `lodash.<name> =` assignment block), `fp/_mapping.js` if the change touches FP, and `threat-model.md` if the change touches `set`/`merge`/`unset`/`template`. — [.github/CONTRIBUTING.md#L21-30](https://github.com/lodash/lodash/blob/2b5e6f7399a7b48005140b5d5c6bc6c0e62919a8/.github/CONTRIBUTING.md#L21-L30) [package.json#L10-30](https://github.com/lodash/lodash/blob/2b5e6f7399a7b48005140b5d5c6bc6c0e62919a8/package.json#L10-L30) [lodash.js#L16900-16960](https://github.com/lodash/lodash/blob/2b5e6f7399a7b48005140b5d5c6bc6c0e62919a8/lodash.js#L16900-L16960) [threat-model.md#L36-51](https://github.com/lodash/lodash/blob/2b5e6f7399a7b48005140b5d5c6bc6c0e62919a8/threat-model.md#L36-L51)
- Tests to run locally: `npm test` (which force-builds via `pretest`), or the faster direct `node test/test` and `node test/test-fp` once a build exists; `npm run validate` is the full gate that CI uses. — [package.json#L20](https://github.com/lodash/lodash/blob/2b5e6f7399a7b48005140b5d5c6bc6c0e62919a8/package.json#L20) [package.json#L26-30](https://github.com/lodash/lodash/blob/2b5e6f7399a7b48005140b5d5c6bc6c0e62919a8/package.json#L26-L30) [.github/workflows/ci-node.yml#L58-59](https://github.com/lodash/lodash/blob/2b5e6f7399a7b48005140b5d5c6bc6c0e62919a8/.github/workflows/ci-node.yml#L58-L59)
- `node test/test <path>` accepts an alternate build path as its last argument, defaulting to `../lodash.js` — this is how you point the suite at `dist/lodash.min.js` or a core build. — [test/test.js#L213-234](https://github.com/lodash/lodash/blob/2b5e6f7399a7b48005140b5d5c6bc6c0e62919a8/test/test.js#L213-L234)
- The Node suite requires the previous published lodash to be installed at `node_modules/lodash/lodash.js` as `lodashStable`; if it's missing the suite prints "The stable lodash dev dependency should be at least a version behind master branch" and silently returns without running. — [test/test.js#L333-345](https://github.com/lodash/lodash/blob/2b5e6f7399a7b48005140b5d5c6bc6c0e62919a8/test/test.js#L333-L345) [package.json#L46](https://github.com/lodash/lodash/blob/2b5e6f7399a7b48005140b5d5c6bc6c0e62919a8/package.json#L46)
- Style must match JSCS: two-space indent, single quotes (double only to avoid escaping), semicolons required, `with` banned, early returns required, and JSDoc blocks needing types, param descriptions and return types. — [.jscsrc#L8-95](https://github.com/lodash/lodash/blob/2b5e6f7399a7b48005140b5d5c6bc6c0e62919a8/.jscsrc#L8-L95) [.github/CONTRIBUTING.md#L43-70](https://github.com/lodash/lodash/blob/2b5e6f7399a7b48005140b5d5c6bc6c0e62919a8/.github/CONTRIBUTING.md#L43-L70)
- Naming conventions are prescribed: prefer `index`, `array`, `iteratee` over `i`, `arr`, `fn`; JSCS additionally enforces `requireCamelCaseOrUpperCaseIdentifiers`. — [.github/CONTRIBUTING.md#L49-54](https://github.com/lodash/lodash/blob/2b5e6f7399a7b48005140b5d5c6bc6c0e62919a8/.github/CONTRIBUTING.md#L49-L54) [.jscsrc#L53](https://github.com/lodash/lodash/blob/2b5e6f7399a7b48005140b5d5c6bc6c0e62919a8/.jscsrc#L53)
- An optional pre-push hook is available by creating a root `.opt-in` file containing `pre-push`, which runs `npm run validate` on push. — [.github/CONTRIBUTING.md#L72-79](https://github.com/lodash/lodash/blob/2b5e6f7399a7b48005140b5d5c6bc6c0e62919a8/.github/CONTRIBUTING.md#L72-L79)
- Safe edit boundary — do not touch: `dist/*` (generated, and `lodash.core*` only by external lodash-cli), `doc/README.md` (docdown output), `vendor/**` (Backbone/Underscore/json2/firebug-lite), `package-lock.json` unless deliberately updating deps. — [lib/main/build-dist.js#L24-29](https://github.com/lodash/lodash/blob/2b5e6f7399a7b48005140b5d5c6bc6c0e62919a8/lib/main/build-dist.js#L24-L29) [lib/main/build-doc.js#L76-81](https://github.com/lodash/lodash/blob/2b5e6f7399a7b48005140b5d5c6bc6c0e62919a8/lib/main/build-doc.js#L76-L81) [dist/lodash.core.js#L1-9](https://github.com/lodash/lodash/blob/2b5e6f7399a7b48005140b5d5c6bc6c0e62919a8/dist/lodash.core.js#L1-L9) [test/underscore.html#L383-390](https://github.com/lodash/lodash/blob/2b5e6f7399a7b48005140b5d5c6bc6c0e62919a8/test/underscore.html#L383-L390)
- Trap: adding an FP-visible method means touching `fp/_mapping.js` in up to five places (`aryMethod` bucket, plus any of `aliasToReal`, `remap`, `methodRearg`, `iterateeAry`, `mutate`, `skipFixed`, `skipRearg`) or the FP build and wiki will silently omit or mis-wrap it. (inferred) — [fp/_mapping.js#L71-120](https://github.com/lodash/lodash/blob/2b5e6f7399a7b48005140b5d5c6bc6c0e62919a8/fp/_mapping.js#L71-L120) [fp/_baseConvert.js#L525-532](https://github.com/lodash/lodash/blob/2b5e6f7399a7b48005140b5d5c6bc6c0e62919a8/fp/_baseConvert.js#L525-L532) [lib/fp/build-modules.js#L113-148](https://github.com/lodash/lodash/blob/2b5e6f7399a7b48005140b5d5c6bc6c0e62919a8/lib/fp/build-modules.js#L113-L148)
- Trap: `test/test.js` is 814 KB and `lodash.js` is 546 KB — read targeted line ranges rather than whole files, and locate work by grepping for `QUnit.module('<methodName>'` or `function base<Name>(`. (inferred) — [test/test.js#L1-10](https://github.com/lodash/lodash/blob/2b5e6f7399a7b48005140b5d5c6bc6c0e62919a8/test/test.js#L1-L10) [lodash.js#L1-15](https://github.com/lodash/lodash/blob/2b5e6f7399a7b48005140b5d5c6bc6c0e62919a8/lodash.js#L1-L15)
- Trap: security-relevant behavior around `__proto__`/`constructor` is asserted by the threat model as intended design — changing `baseSet`, `baseUnset` or `safeGet` guards without reading `threat-model.md` risks reintroducing CVE-2019-10744-class bugs. — [threat-model.md#L36-42](https://github.com/lodash/lodash/blob/2b5e6f7399a7b48005140b5d5c6bc6c0e62919a8/threat-model.md#L36-L42) [threat-model.md#L69-77](https://github.com/lodash/lodash/blob/2b5e6f7399a7b48005140b5d5c6bc6c0e62919a8/threat-model.md#L69-L77) [lodash.js#L4036-4043](https://github.com/lodash/lodash/blob/2b5e6f7399a7b48005140b5d5c6bc6c0e62919a8/lodash.js#L4036-L4043) [lodash.js#L4382-4404](https://github.com/lodash/lodash/blob/2b5e6f7399a7b48005140b5d5c6bc6c0e62919a8/lodash.js#L4382-L4404)
- Security issues go through the GitHub Security tab, not public issues; the TSC handles triage, and `incident_response_plan.md` encodes the full flow including a 5-day acknowledgement target and CVE request step. — [SECURITY.md#L26-36](https://github.com/lodash/lodash/blob/2b5e6f7399a7b48005140b5d5c6bc6c0e62919a8/SECURITY.md#L26-L36) [GOVERNANCE.md#L6-18](https://github.com/lodash/lodash/blob/2b5e6f7399a7b48005140b5d5c6bc6c0e62919a8/GOVERNANCE.md#L6-L18) [incident_response_plan.md#L14-52](https://github.com/lodash/lodash/blob/2b5e6f7399a7b48005140b5d5c6bc6c0e62919a8/incident_response_plan.md#L14-L52)
- `git log` for this checkout shows a single commit touching `dist/` at HEAD (`2b5e6f7 ci: update actions to latest versions`), so treat the dist tree as freshly regenerated relative to `lodash.js`. (inferred) — [dist/lodash.js#L1-9](https://github.com/lodash/lodash/blob/2b5e6f7399a7b48005140b5d5c6bc6c0e62919a8/dist/lodash.js#L1-L9) [.github/workflows/ci-dist-sync.yml#L30-37](https://github.com/lodash/lodash/blob/2b5e6f7399a7b48005140b5d5c6bc6c0e62919a8/.github/workflows/ci-dist-sync.yml#L30-L37)

Every claim links to its cited files at the pinned commit. Citations identify source evidence; they do not establish runtime correctness. Independent CodeVetter scan — not reviewed by upstream maintainers.

## Public product links

- [CodeVetter](https://codevetter.com/)
- [Download](https://codevetter.com/download)
- [Documentation](https://codevetter.com/docs/)
- [Source](https://github.com/Codevetter/codevetter)