Lodash End of Life - Dates and Lifecycle

Lodash is a JavaScript utility library providing well-tested, high-performance functions for arrays, objects, strings, and other common programming tasks. First released in 2012 as a fork of Underscore.js, it became the single most depended-on package in the npm ecosystem, with hundreds of thousands of projects relying on it directly and many more through nested dependencies.

Lodash Lifecycle Explained

Lodash's official policy is simple: only the latest patch of any release line is supported. Once a new version ships, the previous one is immediately considered end of life, it may still receive a fix for a critical vulnerability, but the maintainers make no guarantee of that. There's no scheduled retirement date the way an operating system or language runtime has, supersession itself is what ends a version's support.

What makes Lodash's history unusual is a long gap in that supersession process. Version 4.17.21, released in February 2021, patched a command-injection vulnerability in _.template and a regular-expression denial-of-service issue. It then remained the latest release for almost five years, with no further patches shipping at all. That silence fueled a real "is Lodash dead" narrative across the JavaScript community and helped drive interest in newer alternatives, even as Lodash itself continued to be downloaded by the millions.

That changed in 2025, when the OpenJS Foundation announced Sovereign Tech Agency funding for Lodash and a new governance structure, moving the project toward what it called a "Feature-Complete maturity stage" with a dedicated Technical Steering Committee. The first release after the long gap was 4.17.23 in January 2026, which patched a prototype pollution flaw in _.unset and _.omit that in fact dated all the way back to version 4.0.0, disclosed as CVE-2025-13465. Further releases, 4.18.0 and 4.18.1, followed within a few months. A long-promised Lodash 5 has still never materialized, despite years of community speculation about it.