[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
es-toolkit (source)	1.49.0 → 1.53.1

---

Release Notes

toss/es-toolkit (es-toolkit)

v1.53.1

Compare Source

Released on October 31st, 2026.

This release includes security fixes for es-toolkit/compat, and we recommend upgrading.
The fixes match Lodash, so results may differ if you relied on the previous behavior.

• Fixed compat/template to reject variable values and imports keys that are not
  plain parameter names, and to replace all whitespace in sourceURL, preventing code injection.
• Fixed compat/defaultsDeep to ignore __proto__ keys, preventing prototype pollution.
• Fixed compat/unset, compat/omit, and compat/pullAt to stop when __proto__,
  constructor, or prototype appears before the last path key, preventing the deletion
  of built-in prototype properties.

The following are other fixes in this release.

• Fixed clone to preserve the offset and length of a DataView. ([#​2166])
• Fixed split to keep surrogate pairs and combining marks together for an empty separator. ([#​2171])
• Fixed withTimeout to clear its timer after the operation completes. ([#​2170])
• Fixed compat/pickBy to not treat objects with a numeric length as array-like. ([#​2165])
• Fixed compat/findLast and compat/some to not treat length as an element of
  array-likes. ([#​2168])

We sincerely thank @​arba-octo, @​dayongkr, @​frogscooper, and @​KooYS for their contributions.
We appreciate your great efforts!

v1.53.0

Compare Source

Released on October 24th, 2026.

• Added serialize to es-toolkit/util, and hash in the new es-toolkit/util/hash
  entrypoint. ([#​2067], [#​2154])

• Added Queue to es-toolkit/util. ([#​2150], [#​2153])

• Added stringify to es-toolkit/query-string. ([#​2121])

• Added sentenceCase. ([#​2079])

• Added lerp and inverseLerp. ([#​2078])

• Added the DistributiveOmit type. ([#​2142])

• es-toolkit/compat now runs on Node.js 6 and ES2015 environments without
  transpilation or polyfills. ([#​2097], [#​2161])

• Fixed deepFreeze to freeze symbol and non-enumerable properties. ([#​2143])

• Fixed Semaphore to keep release fast when many tasks are waiting. ([#​2149])

• Fixed DeepPartial and DeepReadonly to preserve branded primitive types. ([#​2074])

• Fixed the Merge type to keep the input type when merging a type with itself or a
  narrower type, and to use the source type when a defined source replaces a nullable
  or primitive value. ([#​2148], [#​2155])

• Fixed the fp intersectionBy to match each mapped value at most once in lazy
  pipes. ([#​2146])

The following change results or types that v1.52.0 produced, so review them if you
relied on the previous behavior.

• dedent now leaves interpolated values out of the indentation calculation ([#​2099]),
  and throws a TypeError for a malformed template literal, like String.dedent ([#​2100]).
• deburr now keeps letters of non-Latin scripts as they are. ([#​2124])
• orderBy and sortBy now sort NaN in a consistent position. ([#​2133])
• once now calls the function with the caller's this. ([#​2069])
• findKey and mapKeys now type keys like Object.keys, so numeric keys are
  strings. ([#​2077], [#​2156])
• The fp head, last, maxBy, and minBy now always return T | undefined.
  ([#​2113])

The following bring es-toolkit/compat closer to Lodash. Behavior for the affected
edge cases now matches Lodash, so results may differ if you relied on the previous output.

• Fixed compat/add, compat/subtract, compat/multiply, and compat/divide to
  match Lodash on null operands. ([#​2056])

• Fixed compat/ceil, compat/floor, and compat/round to coerce arguments like
  Lodash. ([#​2064])

• Fixed compat/toString to read sparse array holes as undefined. ([#​2091])

• Fixed compat/dropWhile, compat/dropRightWhile, and compat/some to normalize
  the predicate. ([#​2072])

• Fixed compat/countBy to return a plain object. ([#​2090])

• Fixed compat/pull, compat/pullAll, compat/pullAllBy, and compat/remove to
  handle nullish inputs. ([#​2095])

• Fixed compat/xorBy and compat/xorWith to ignore the iteratee and comparator for
  a single array. ([#​2098])

• Fixed compat/reduce and compat/reduceRight to resolve the iteratee like Lodash,
  and compat/forEach, compat/forEachRight, compat/forIn, compat/forInRight,
  compat/forOwn, and compat/forOwnRight to treat a non-function iteratee as
  identity. ([#​2101], [#​2158])

• Fixed compat/words to match titlecase letters, emoji sequences, and non-ASCII
  numerals and symbols, and to keep combining marks attached to their letter.
  ([#​2102], [#​2103], [#​2110])

• Fixed compat/unionWith to pass comparator arguments in Lodash's order. ([#​2114])

• Fixed compat/groupBy, compat/maxBy, and compat/minBy to call the iteratee
  with only the element. ([#​2122])

• Fixed compat/deburr to only deburr Latin letters. ([#​2123])

• Fixed compat/truncate to escape a string separator. ([#​2130])

• Fixed compat/cloneDeep and compat/cloneDeepWith to keep errors uncloned, and
  compat/isMatch and compat/matches to compare errors like Lodash. ([#​2159])

• Fixed compat/startCase to only uppercase the first letter of each word. ([#​2160])

• Exported the PropertyPath type from es-toolkit/compat. ([#​2145])

• Reduced the CommonJS bundle size of compat/every and compat/findLastIndex. ([#​2162])

• Fixed documentation examples whose results did not match the code. ([#​2071],
  [#​2109], [#​2132], [#​2136], [#​2138])

• Listed the iterator docs under the es-toolkit and fp tabs. ([#​2137])

• Clarified which compat behavior fixes the contributing guide accepts. ([#​2107],
  [#​2108], [#​2125])

We sincerely thank @​arba-octo, @​Archibald1948, @​cyclomati, @​D-Sketon, @​dayongkr,
@​HyoYoonNam, @​jaideeppyne, @​jeonghoon11, @​jeynes-log, @​JonghwanWon, @​mariazuheros,
@​MFA-G, @​minseonkkim, @​minsoo-web, @​Patrick-SCH03, @​poketopa, @​raon0211, @​ssi02014,
@​TalhaHunter101, and @​Tnalxmsk for their contributions. We appreciate your great
efforts!

v1.52.0

Compare Source

Released on August 28th, 2026.

• Added the es-toolkit/iterator entrypoint, a lazy iterator module with chunk,
  count, dropWhile, head, iterate, partition, range, scan,
  takeWhile, uniqBy, and zip ([#​1815]), plus cartesianProduct ([#​2031]).
  The same functions are also available from es-toolkit/fp/iterator.

• Added defer and deferAsync to es-toolkit/util. ([#​2032])

• Added flowAsync to es-toolkit/fp, a promise-aware left-to-right composition. ([#​2033])

• Added the EmptyObject, IsEqual, JSONValue, Primitive, SetOptional,
  SetRequired, and UnknownRecord types. ([#​2044])

• Fixed merge to infer the deep merged return type, and exported the Merge type. ([#​1959])

• Fixed omitBy and pickBy to type numeric callback keys as strings, and
  exported the ObjectKeys type. ([#​2037])

• Fixed attempt and attemptAsync to default their error type parameter to unknown. ([#​2052])

The following bring es-toolkit/compat closer to Lodash. Behavior for the affected
edge cases now matches Lodash, so results may differ if you relied on the previous output.

• Fixed compat/debounce to skip the maxWait invocation when both leading and
  trailing are false. ([#​1678])

• Fixed compat/toString to convert objects with a custom valueOf. ([#​2034])

• Fixed compat/mergeWith to assign null values in array sources. ([#​1929])

• Fixed compat/has and compat/hasIn to normalize the -0 path key. ([#​2035])

• Fixed compat/differenceWith and compat/without to normalize -0 to 0. ([#​2049])

• Fixed compat/findLastIndex to convert fromIndex to an integer. ([#​2047])

• Fixed compat/xorWith to match Lodash when no comparator is given. ([#​2057])

• Covered the new iterator entrypoints in the dist and browser compatibility
  checks. ([#​2030])

• Made the agent skills portable when installed on their own. ([#​2054])

• Fixed documentation typos and the Deno install commands. ([#​2062])

v1.51.0

Compare Source

Released on August 17th, 2026.

• Added the es-toolkit/bigint entrypoint: bigint counterparts of the math
  functions (sum, sumBy, max, min, maxBy, minBy, clamp, inRange,
  median, medianBy, percentile, range, rangeRight), kept separate so
  the number implementations stay unchanged. ([#​1966])

• Added dedent, which removes common leading whitespace from template strings. ([#​1679])

• Added deepFreeze for recursively freezing objects. ([#​1680])

• Added mapValuesAsync and mapKeysAsync. ([#​1544])

• Added toPascalCaseKeys, toKebabCaseKeys, and toConstantCaseKeys,
  completing the object key casing family. ([#​1984])

• Exported the ToCamelCaseKeys, ToPascalCaseKeys, ToSnakeCaseKeys,
  ToKebabCaseKeys, and ToConstantCaseKeys types. ([#​1651])

• Added a preserveArrays option to flattenObject. ([#​974])

• Fixed retry to pass the last error to the delay callback ([#​1759]) and to
  throw the last attempt's error without applying a final delay ([#​1901]).

• Fixed mergeWith and toMerged to handle mixed array/object types
  consistently with merge. ([#​2026])

• Fixed pullAt to remove the correct elements with negative indices. ([#​1613])

• Fixed at, pullAt, orderBy, and sortBy to accept readonly arrays. ([#​2016])

• Moved limitAsync from the array to the promise category. ([#​2022])

• Included the NOTICE file in the published npm and JSR packages. ([#​2020])

The following bring es-toolkit/compat closer to Lodash. Behavior for the affected
edge cases now matches Lodash, so results may differ if you relied on the previous output.

• Added entries and entriesIn. ([#​1874])

• Fixed compat/isMatch and compat/isMatchWith to handle object source
  patterns against primitive and non-plain-object targets like Lodash. ([#​1432])

• Fixed compat/set to block constructor.prototype paths, preventing
  prototype pollution. ([#​1904])

• Fixed compat/find to respect array-like length ([#​1958]) and to convert
  fromIndex to an integer ([#​1961]), and compat/indexOf to convert
  fromIndex to an integer when searching for NaN ([#​1951]).

• Fixed compat/orderBy to resolve unresolved deep paths and nullish elements
  to undefined ([#​2010]), to exclude the length property from array-like
  values ([#​2002]), and to read the criterion property from primitive values ([#​1903]).

• Fixed compat/toPath to split unquoted dotted keys inside brackets. ([#​1899])

• Fixed compat/omit to treat a key array as a single deep path. ([#​1902])

• Fixed compat/map to make the iteratee optional with an identity default. ([#​1928])

• Fixed compat/size to count combined Unicode symbols as single characters. ([#​1900])

• Fixed compat/intersectionBy to support number, object, and nullish iteratee
  shorthands ([#​1993]), and compat/intersectionWith to apply the comparator
  when deduplicating the first array ([#​1953]).

• Fixed compat/difference, compat/differenceBy, compat/uniqBy, and
  compat/unionBy to normalize -0 to 0. ([#​2007])

• Fixed compat/maxBy and compat/minBy to skip nullish iteratee values ([#​1927]),
  and compat/meanBy to skip undefined values when averaging ([#​1978]).

• Fixed compat/some, compat/template ([#​2009]), and compat/fill ([#​1952])
  to gate guard handling with isIterateeCall.

• Fixed compat/iteratee to treat a boolean as a property shorthand. ([#​1941])

• Fixed compat/reverse to support array-like objects and arguments. ([#​2008])

• Fixed compat/toArray to convert non-array-like iterables. ([#​1999])

• Fixed compat/toString to render nested nullish values like Lodash. ([#​1992])

• Fixed compat/zipObject to treat null keys and values as empty arrays. ([#​2005])

• Fixed compat/sampleSize to clamp the default size to the collection length. ([#​2003])

• Fixed compat/takeWhile, compat/takeRightWhile, and compat/uniqBy to
  support string inputs. ([#​2004])

• Fixed compat/chunk to return an empty array for an empty collection with an
  Infinity size. ([#​1995])

• Fixed compat/lastIndexOf to read holes in sparse arrays as undefined. ([#​1977])

• Fixed compat/last to return undefined for empty array-like inputs. ([#​1954])

• Fixed compat/pullAll to return the array as-is when values is nullish. ([#​1962])

• Added a browser compatibility test suite. ([#​2012])

• Improved documentation, JSDoc accuracy, tests, and internal refactoring across
  compat and the docs site. ([#​1622], [#​1789], [#​1824], [#​1844], [#​1849],
  [#​1854], [#​1855], [#​1859], [#​1860], [#​1868], [#​1871], [#​1887], [#​1898],
  [#​1933], [#​1939], [#​1947], [#​1950], [#​1955], [#​1956], [#​1957], [#​1960],
  [#​1963], [#​1964], [#​1968], [#​1969], [#​1970], [#​1972], [#​1979], [#​1985],
  [#​2000], [#​2001], [#​2021], [#​2025], [#​2027])

We sincerely thank @​Antoliny0919, @​D-Sketon, @​kojesung, @​chuenchen309,
@​mariazuheros, @​DongEun02, @​raon0211, @​sukvvon, @​racgoo, @​dayongkr, @​Kropiunig,
@​ssi02014, @​sarathfrancis90, @​mym0404, @​mlnwns, @​kdelay, @​gwagjiug, @​dohwi,
@​blro0319, @​benedictleejh, @​amir-rezaei, @​ianzone, @​sen2y, @​rossyman,
@​eunwoo-levi, @​ramong26, @​Gdm0714, and everyone else who contributed.
We appreciate your great efforts!

v1.50.0

Compare Source

Released on July 24th, 2026.

• Added the es-toolkit/types entrypoint: a declaration-only module of compile-time
  type utilities TypeScript lacks natively — ValueOf, Simplify, Writable,
  NonEmptyArray, DeepPartial, and DeepReadonly. ([#​1818])
• Added flow to es-toolkit/fp, a reusable data-last composition built on pipe. ([#​1812])

The following bring es-toolkit/compat closer to Lodash. Behavior for the affected
edge cases now matches Lodash, so results may differ if you relied on the previous output.

• Fixed compat/intersectionBy to dedupe a single array (including by the iteratee)
  and to keep results consistent with Lodash. ([#​1935])

• Fixed compat/findIndex and compat/findLastIndex to coerce a NaN fromIndex
  to 0 and to convert fromIndex to an integer. ([#​1828], [#​1834], [#​1938])

• Fixed compat/lastIndexOf to coerce fromIndex like Lodash. ([#​1832])

• Fixed compat/every to treat a falsy, non-nullish doesMatch as a _.property
  shorthand instead of identity. ([#​1940])

• Fixed compat/nth to support string inputs. ([#​1833])

• Fixed compat/inRange to not throw on a lone negative bound. ([#​1835])

• Fixed compat/toArray to convert Sets to arrays like Lodash. ([#​1840])

• Fixed compat/values to treat sparse array holes as undefined. ([#​1894])

• Fixed compat/maxBy and compat/minBy to restore Lodash-compatible comparison. ([#​1893])

• Fixed compat/includes to exclude the length property when matching array-like values. ([#​1886])

• Fixed the case functions to split ordinal numbers like Lodash, and to count string
  size and padding by code points for multi-byte characters. ([#​1836], [#​1852], [#​1853])

• Fixed compat/unset to not treat an own literal dotted key as a deep path. ([#​1808])

• Moved compat/flattenDepth's flattening logic out of flatten. ([#​1847])

• Restored the standalone eq and templateSettings entry points. ([#​1895])

• Fixed deburr to remove all combining diacritical marks, matching Lodash. ([#​1807])

• Fixed partition to accept any predicate return value, like Array.prototype.filter. ([#​1937])

• Fixed has and hasIn to prioritize nullish literal keys over paths. ([#​1810])

• Fixed invokeMap to normalize a string path via toPath for this binding. ([#​1814])

• Fixed isDeepKey to detect deep keys with stricter patterns. ([#​1621])

• Fixed unzipWith to return an empty array instead of throwing on empty input. ([#​1816])

• Improved documentation, JSDoc accuracy, and internal refactoring across compat
  and fp. ([#​1817], [#​1820], [#​1822], [#​1823], [#​1825], [#​1829], [#​1830], [#​1842],
  [#​1845], [#​1851], [#​1858], [#​1867], [#​1879])

We sincerely thank @​Antoliny0919, @​raon0211, @​dayongkr, @​spokodev, @​sarathfrancis90,
@​mayur-shenoy, @​mahirhir, @​kojesung, @​Hprogram, @​BangDori, and everyone else who
contributed. We appreciate your great efforts!

---

Configuration

📅 Schedule: (in timezone Europe/Paris)

• Branch creation
  • Between 12:00 AM and 03:59 AM (* 0-3 * * *)
• Automerge
  • Between 12:00 AM and 03:59 AM (* 0-3 * * *)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.