Keep Using Lodash — Without the Risk

Lodash still powers millions of JavaScript apps. Now it has the support your team needs.

Lodash changed JavaScript development. It brought utility, speed, and structure to a language that didn’t yet have native solutions for deep cloning, object merging, and reliable iteration. Lodash has been the unsung backbone of enterprise web apps, build pipelines, and npm packages for over a decade. And guess what? It still is.

HeroDevs has launched Never-Ending Support (NES) for Lodash. This commercial support package delivers long-term security, compliance, and peace of mind for Lodash 3.x and 4.x—versions still used across critical production code, but no longer actively maintained.
‍

The Real-World Risks of Legacy Lodash

Lodash may still get millions of downloads per day, but its repo tells a different story. No commits for months. No roadmap for v5. No guarantee that new vulnerabilities will ever be patched.

Here’s what that means for your business:

• Unpatched vulnerabilities – Prototype pollution and code injection issues remain unaddressed in 3.x and older 4.x builds. New vulns? You’re on your own.
  
  
• Compliance failures – Running unmaintained dependencies is a red flag for SOC 2, HIPAA, and PCI-DSS auditors.
  
  
• Migration drag – Upgrading from Lodash 3 to 4—or removing it entirely—is a non-trivial engineering lift with potential for regressions.
  
  
• Production risk – Lodash is often buried deep in the stack. Bugs here ripple across multiple layers of your codebase.
  
  

Lodash isn’t broken. But without updates, it’s exposed. NES for Lodash fixes that.
‍

What HeroDevs Provides

NES for Lodash delivers enterprise-grade support for versions 3.x and 4.x—without forcing rewrites, migrations, or risk.

• Security Patch Delivery – Ongoing protection against new CVEs. We patch what the original maintainers no longer touch.
  
  
• Audit-Ready Compliance – Documentation, changelogs, and SLAs that meet enterprise standards.
  
  
• Drop-In Compatibility – No code changes. Just point your app to our package and you’re covered.
  
  
• Expert Engineering Access – Lodash internals are complex. Our team knows them cold.
  
  
• Dual Track Support – Whether you're on 3.10 or 4.17, we’ve got a support line for you.
  
  

NES for Lodash keeps your utilities and your uptime secure.
‍

Why It Matters

With NES for Lodash, you can:

• Extend the life of your apps without diving into risky refactors
  
  
• Avoid compliance violations tied to unsupported software
  
  
• Unblock dev time from patch hunting and Lodash removal
  
  
• Decouple security timelines from upgrade pipelines
  
  
• Save six figures in migration costs you don’t need to spend
  
  

HeroDevs: We Support the Code That Won’t Die

At HeroDevs, we maintain the forgotten but still essential software the modern web depends on. From AngularJS and Knockout to jQuery and now Lodash, we give your legacy stack the future it deserves.

Still using Lodash in production? We’ve got you.
Explore pricing