# System map — lodash/lodash

> Canonical page: https://codevetter.com/unpack/lodash/system-map

# System map — lodash/lodash

Scanned commit 2b5e6f7399a7b48005140b5d5c6bc6c0e62919a8 (2026-09-11). Generated by codevetter codevetter 1.12.0 on 2026-09-22.

There is no server or CLI entrypoint; the shipped artifact is `lodash.js`, declared as `main` in a `private: true` package.json, exported via a three-way UMD tail (AMD `define`, CommonJS `freeModule.exports`, global `root._`). All build logic lives in `lib/`, split into `lib/common/` (file copy, uglify wrapper, error-throwing callback, Hash), `lib/main/` (dist, modules, docdown, site HTML) and `lib/fp/` (webpack dist, `.jst`-templated module emission, FP wiki). The only persistent storage is the filesystem: `dist/` for builds and `doc/README.md` for generated API docs. Eight GitHub Actions workflows cover Node 4–25, four Bun versions, browser matrix, docs generation, dist-sync verification, CodeQL, OSSF Scorecard and Renovate. Deployment is out-of-repo — the Release Team publishes to npm, and `dist/lodash.core.js` is produced by the external `lodash-cli`, not by `npm run build`.
- The package is `private: true` with `main: "lodash.js"` and `engines.node >= 4.0.0`, so the repo itself is never published; it is the source-of-truth checkout that other release tooling consumes. — [package.json#L1-9](https://github.com/lodash/lodash/blob/2b5e6f7399a7b48005140b5d5c6bc6c0e62919a8/package.json#L1-L9)
- `lodash.js` is a single `;(function() { ... }.call(this))` IIFE whose entire API is built inside a `runInContext(context)` factory at line 1449; the module-level `var _ = runInContext()` at line 17232 creates the default instance. — [lodash.js#L9-15](https://github.com/lodash/lodash/blob/2b5e6f7399a7b48005140b5d5c6bc6c0e62919a8/lodash.js#L9-L15) [lodash.js#L1449-1462](https://github.com/lodash/lodash/blob/2b5e6f7399a7b48005140b5d5c6bc6c0e62919a8/lodash.js#L1449-L1462) [lodash.js#L17230-17234](https://github.com/lodash/lodash/blob/2b5e6f7399a7b48005140b5d5c6bc6c0e62919a8/lodash.js#L17230-L17234)
- The export tail branches three ways in strict order — AMD `define.amd` (also assigning `root._` to survive script-tag loading), then `freeModule.exports` for Node/CommonJS, then a bare global assignment — which is why the file works unchanged in every listed CI runtime. — [lodash.js#L17236-17256](https://github.com/lodash/lodash/blob/2b5e6f7399a7b48005140b5d5c6bc6c0e62919a8/lodash.js#L17236-L17256)
- Runtime-boundary detection is done once at the top level via `freeGlobal`/`freeSelf`/`Function('return this')()` for `root`, plus `freeExports`, `freeModule`, `moduleExports` and `freeProcess` for Node-only features like `Buffer` and `util.types`. — [lodash.js#L431-462](https://github.com/lodash/lodash/blob/2b5e6f7399a7b48005140b5d5c6bc6c0e62919a8/lodash.js#L431-L462)
- `npm run build` is only `build:main && build:fp`: `lib/main/build-dist.js` copies `lodash.js` → `dist/lodash.js` and minifies it, while `lib/fp/build-dist.js` runs two webpack passes (`fp/_mapping.js` → `dist/mapping.fp.js`, `fp/_convertBrowser.js` → `dist/lodash.fp.js`, both UMD) then minifies. — [package.json#L11-14](https://github.com/lodash/lodash/blob/2b5e6f7399a7b48005140b5d5c6bc6c0e62919a8/package.json#L11-L14) [lib/main/build-dist.js#L24-31](https://github.com/lodash/lodash/blob/2b5e6f7399a7b48005140b5d5c6bc6c0e62919a8/lib/main/build-dist.js#L24-L31) [lib/fp/build-dist.js#L16-56](https://github.com/lodash/lodash/blob/2b5e6f7399a7b48005140b5d5c6bc6c0e62919a8/lib/fp/build-dist.js#L16-L56)
- Minification is centralized in `lib/common/minify.js`, which shells into `uglify-js@2.7.5` with `unsafe: true`, `pure_getters: true`, `ascii_only: true` and a `/@license/` comment filter from `lib/common/uglify.options.js`. — [lib/common/minify.js#L24-37](https://github.com/lodash/lodash/blob/2b5e6f7399a7b48005140b5d5c6bc6c0e62919a8/lib/common/minify.js#L24-L37) [lib/common/uglify.options.js#L9-22](https://github.com/lodash/lodash/blob/2b5e6f7399a7b48005140b5d5c6bc6c0e62919a8/lib/common/uglify.options.js#L9-L22) [package.json#L57](https://github.com/lodash/lodash/blob/2b5e6f7399a7b48005140b5d5c6bc6c0e62919a8/package.json#L57)
- All build scripts share the same async shape: `lib/common/file.js` returns `_.partial`-applied `fs.copy`/`minify`/`fs.writeFile` thunks that are handed to `async.series` with `util.pitch` as the terminal callback, and `pitch` simply rethrows any error. — [lib/common/file.js#L21-71](https://github.com/lodash/lodash/blob/2b5e6f7399a7b48005140b5d5c6bc6c0e62919a8/lib/common/file.js#L21-L71) [lib/common/util.js#L31-40](https://github.com/lodash/lodash/blob/2b5e6f7399a7b48005140b5d5c6bc6c0e62919a8/lib/common/util.js#L31-L40) [lib/main/build-dist.js#L25-28](https://github.com/lodash/lodash/blob/2b5e6f7399a7b48005140b5d5c6bc6c0e62919a8/lib/main/build-dist.js#L25-L28)
- `lib/common/mapping.js` wraps `fp/_mapping.js` in a null-prototype `Hash` (recursively, via `_.transform` with `Hash.prototype = Object.create(null)`), so build-time lookups like `mapping.skipFixed[name]` can't collide with inherited `Object.prototype` keys. — [lib/common/mapping.js#L1-9](https://github.com/lodash/lodash/blob/2b5e6f7399a7b48005140b5d5c6bc6c0e62919a8/lib/common/mapping.js#L1-L9) [lib/common/util.js#L15-23](https://github.com/lodash/lodash/blob/2b5e6f7399a7b48005140b5d5c6bc6c0e62919a8/lib/common/util.js#L15-L23)
- Documentation is a two-stage pipeline: `lib/main/build-doc.js` runs `docdown` over `lodash.js` in either `github` or `site` style and writes `doc/README.md`; `lib/main/build-site.js` then feeds that markdown through `marky-markdown` + `cheerio` and emits `doc/<version>.html` with Jekyll front matter. — [lib/main/build-doc.js#L17-35](https://github.com/lodash/lodash/blob/2b5e6f7399a7b48005140b5d5c6bc6c0e62919a8/lib/main/build-doc.js#L17-L35) [lib/main/build-doc.js#L76-81](https://github.com/lodash/lodash/blob/2b5e6f7399a7b48005140b5d5c6bc6c0e62919a8/lib/main/build-doc.js#L76-L81) [lib/main/build-site.js#L181-237](https://github.com/lodash/lodash/blob/2b5e6f7399a7b48005140b5d5c6bc6c0e62919a8/lib/main/build-site.js#L181-L237) [package.json#L16-19](https://github.com/lodash/lodash/blob/2b5e6f7399a7b48005140b5d5c6bc6c0e62919a8/package.json#L16-L19)
- `doc/README.md` is a checked-in 295 KB generated artifact (its first line carries the `v4.18.1` docdown title), and `doc/*.html` is gitignored — so the markdown is versioned but the site HTML is not. — [doc/README.md#L1-3](https://github.com/lodash/lodash/blob/2b5e6f7399a7b48005140b5d5c6bc6c0e62919a8/doc/README.md#L1-L3) [.gitignore#L1-4](https://github.com/lodash/lodash/blob/2b5e6f7399a7b48005140b5d5c6bc6c0e62919a8/.gitignore#L1-L4) [lib/main/build-doc.js#L12-22](https://github.com/lodash/lodash/blob/2b5e6f7399a7b48005140b5d5c6bc6c0e62919a8/lib/main/build-doc.js#L12-L22)
- Eight workflows exist: `ci-node.yml` (Node 4 through 25 on ubuntu, `npm run validate`), `ci-bun.yml` (Bun 1.0–1.3), `browser-testing.yml` (Playwright), `ci-docs.yml`, `ci-dist-sync.yml`, `codeql.yml`, `scorecards.yml`, `renovate.yml`. — [.github/workflows/ci-node.yml#L14-50](https://github.com/lodash/lodash/blob/2b5e6f7399a7b48005140b5d5c6bc6c0e62919a8/.github/workflows/ci-node.yml#L14-L50) [.github/workflows/ci-bun.yml#L10-38](https://github.com/lodash/lodash/blob/2b5e6f7399a7b48005140b5d5c6bc6c0e62919a8/.github/workflows/ci-bun.yml#L10-L38) [.github/workflows/ci-dist-sync.yml#L24-37](https://github.com/lodash/lodash/blob/2b5e6f7399a7b48005140b5d5c6bc6c0e62919a8/.github/workflows/ci-dist-sync.yml#L24-L37)
- Every third-party action is SHA-pinned (e.g. `actions/checkout@3d3c42e5...` v7.0.1, `github/codeql-action/init@b96794f0...` v4.38.0), and Renovate is self-hosted monthly with `minimumReleaseAge: 14d` and npm major updates disabled. — [.github/workflows/scorecards.yml#L33-58](https://github.com/lodash/lodash/blob/2b5e6f7399a7b48005140b5d5c6bc6c0e62919a8/.github/workflows/scorecards.yml#L33-L58) [.github/workflows/renovate.yml#L10-22](https://github.com/lodash/lodash/blob/2b5e6f7399a7b48005140b5d5c6bc6c0e62919a8/.github/workflows/renovate.yml#L10-L22) [renovate.json#L1-17](https://github.com/lodash/lodash/blob/2b5e6f7399a7b48005140b5d5c6bc6c0e62919a8/renovate.json#L1-L17)
- `vendor/` carries four vendored third-party trees used only by the browser harnesses — Backbone (source + 7 test files + setup), Underscore (source, min, 7 test files), json-js `json2.js`, and a ~960 KB `firebug-lite` console used by the perf page. — [test/backbone.html#L88-98](https://github.com/lodash/lodash/blob/2b5e6f7399a7b48005140b5d5c6bc6c0e62919a8/test/backbone.html#L88-L98) [test/underscore.html#L383-390](https://github.com/lodash/lodash/blob/2b5e6f7399a7b48005140b5d5c6bc6c0e62919a8/test/underscore.html#L383-L390) [perf/index.html#L42](https://github.com/lodash/lodash/blob/2b5e6f7399a7b48005140b5d5c6bc6c0e62919a8/perf/index.html#L42)
- Deployment is explicitly out-of-repo: `GOVERNANCE.md` names a single-member Release Team responsible for npm publishes, and the README documents that `dist/` builds come from `lodash-cli` (`lodash -o ./dist/lodash.js`). — [GOVERNANCE.md#L20-26](https://github.com/lodash/lodash/blob/2b5e6f7399a7b48005140b5d5c6bc6c0e62919a8/GOVERNANCE.md#L20-L26) [README.md#L19-25](https://github.com/lodash/lodash/blob/2b5e6f7399a7b48005140b5d5c6bc6c0e62919a8/README.md#L19-L25)

Every claim links to its cited files at the pinned commit. Citations identify source evidence; they do not establish runtime correctness. Independent CodeVetter scan — not reviewed by upstream maintainers.

## Public product links

- [CodeVetter](https://codevetter.com/)
- [Download](https://codevetter.com/download)
- [Documentation](https://codevetter.com/docs/)
- [Source](https://github.com/Codevetter/codevetter)