.github/FUNDING.yml

@@ -0,0 +1,2 @@
+tidelift: "npm/underscore"
+patreon: juliangonggrijp

.github/config/codeql.yml

@@ -0,0 +1,6 @@
+paths:
+  - 'modules/**'
+  - 'test/**'
+  - 'test-treeshake/**'
+  - 'rollup*.js'
+  - 'index.html'

.github/workflows/codeql-analysis.yml

@@ -0,0 +1,77 @@
+# For most projects, this workflow file will not need changing; you simply need
+# to commit it to your repository.
+#
+# You may wish to alter this file to override the set of languages analyzed,
+# or to provide custom queries or build logic.
+#
+# ******** NOTE ********
+# We have attempted to detect the languages in your repository. Please check
+# the `language` matrix defined below to confirm you have the correct set of
+# supported CodeQL languages.
+#
+name: "CodeQL"
+
+on:
+  push:
+    branches: [ master ]
+  pull_request:
+    # The branches below must be a subset of the branches above
+    branches: [ master ]
+    paths:
+      - 'modules/**'
+      - 'test/**'
+      - 'test-treeshake/**'
+      - 'rollup*.js'
+      - 'index.html'
+  schedule:
+    - cron: '16 8 * * 3'
+
+jobs:
+  analyze:
+    name: Analyze
+    runs-on: ubuntu-latest
+    permissions:
+      actions: read
+      contents: read
+      security-events: write
+
+    strategy:
+      fail-fast: false
+      matrix:
+        language: [ 'javascript' ]
+        # CodeQL supports [ 'cpp', 'csharp', 'go', 'java', 'javascript', 'python', 'ruby' ]
+        # Learn more about CodeQL language support at https://git.io/codeql-language-support
+
+    steps:
+    - name: Checkout repository
+      uses: actions/checkout@v2
+
+    # Initializes the CodeQL tools for scanning.
+    - name: Initialize CodeQL
+      uses: github/codeql-action/init@v1
+      with:
+        languages: ${{ matrix.language }}
+        # If you wish to specify custom queries, you can do so here or in a config file.
+        # By default, queries listed here will override any specified in a config file.
+        # Prefix the list here with "+" to use these queries and those in the config file.
+        # queries: ./path/to/local/query, your-org/your-repo/queries@main
+        config-file: ./.github/config/codeql.yml
+
+    # Autobuild attempts to build any compiled languages  (C/C++, C#, or Java).
+    # If this step fails, then you should remove it and run the build manually (see below)
+    - name: Autobuild
+      uses: github/codeql-action/autobuild@v1
+
+    # ℹ️ Command-line programs to run using the OS shell.
+    # 📚 https://git.io/JvXDl
+
+    # ✏️ If the Autobuild fails above, remove it and uncomment the following three lines
+    #    and modify them (or add more) to build your code if your project
+    #    uses a compiled language
+
+    #- run: |
+    #   make bootstrap
+    #   make release
+
+    - name: Perform CodeQL Analysis
+      uses: github/codeql-action/analyze@v1

.gitignore

@@ -8,3 +8,4 @@ coverage
 test-treeshake/*-umd.js
 amd
 cjs
+/underscore-node-*-pre*

.travis.yml

@@ -1,24 +1,30 @@
 language: node_js
-services:
-  - xvfb
 sudo: false
 jobs:
   include:
     - node_js: 8
-      env: EXTRA=false
+      env:
+        - DOWNGRADE=true
+        - EXTRA=false
     - node_js: 10
-      env: EXTRA=true
+      env:
+        - DOWNGRADE=false
+        - EXTRA=false
     - node_js: 14
-      env: EXTRA=false
+      env:
+        - DOWNGRADE=false
+        - EXTRA=true
 before_install:
-  - npm install -g karma-cli
+  - "[ $EXTRA = false ] || npm install -g karma-cli"
 before_script:
-  - npm install karma-sauce-launcher
+  - "[ $EXTRA = false ] || npm install karma-sauce-launcher"
+  - "[ $DOWNGRADE = false ] || npm install rollup@1"
 script:
-  - npm test
+  - "[ $EXTRA = false ] || npm run lint"
+  - "[ $EXTRA = true ] || npm run test-node"
+  - "[ $EXTRA = false ] || npm run coveralls"
   - "[ $EXTRA = false ] || npm run test-browser"
   - "[ $EXTRA = false ] || karma start karma.conf-sauce.js"
-  - "[ $EXTRA = false ] || npm run coveralls"
 notifications:
   email: false
 env:

CONTRIBUTING.md

@@ -2,6 +2,8 @@
 
 * This project adheres to a [code of conduct](CODE_OF_CONDUCT.md). By participating, you are expected to uphold this code.
 
+* Please do not open a ticket to report a security issue. Consult the [security policy](SECURITY.md) on what to do instead.
+
 * Before you open a ticket or send a pull request, [search](https://github.com/jashkenas/underscore/issues) for previous discussions about the same feature or issue. Add to the earlier ticket if you find one.
 
 * If you're proposing a new feature, make sure it isn't already implemented in [Underscore-Contrib](https://github.com/documentcloud/underscore-contrib).
@@ -12,4 +14,4 @@
 
 * Use the same coding style as the rest of the [codebase](https://github.com/jashkenas/underscore/blob/master/modules/index.js).
 
-* In your pull request, do not add documentation or re-build the minified `underscore-min.js` file. We'll do those things before cutting a new release.
+* In your pull request, do not add documentation or re-build the minified `underscore-umd-min.js` file. We'll do those things before cutting a new release.

LICENSE

@@ -1,5 +1,4 @@
-Copyright (c) 2009-2020 Jeremy Ashkenas, DocumentCloud and Investigative
-Reporters & Editors
+Copyright (c) 2009-2022 Jeremy Ashkenas, Julian Gonggrijp, and DocumentCloud and Investigative Reporters & Editors
 
 Permission is hereby granted, free of charge, to any person
 obtaining a copy of this software and associated documentation

README.md

@@ -15,7 +15,8 @@ without extending any core JavaScript objects.
 For Docs, License, Tests, and pre-packed downloads, see:
 https://underscorejs.org
 
-For support and questions, please use
+For support and questions, please consult
+our [security policy](SECURITY.md),
 [the gitter channel](https://gitter.im/jashkenas/underscore)
 or [stackoverflow](https://stackoverflow.com/search?q=underscore.js)
 
@@ -25,4 +26,9 @@ https://github.com/documentcloud
 Many thanks to our contributors:
 https://github.com/jashkenas/underscore/contributors
 
+You can support the project by donating on
+[Patreon](https://patreon.com/juliangonggrijp).
+Enterprise coverage is available as part of the
+[Tidelift Subscription](https://tidelift.com/subscription/pkg/npm-underscore?utm_source=npm-underscore&utm_medium=referral&utm_campaign=enterprise).
+
 This project adheres to a [code of conduct](CODE_OF_CONDUCT.md). By participating, you are expected to uphold this code.

SECURITY.md

@@ -0,0 +1,38 @@
+# Security Policy
+
+## Supported Versions
+
+We currently support the following versions of Underscore with security updates:
+
+- the latest commit on the `master` branch (published as "edge" on the
+  [project website][website]);
+- the 1.x release tagged as [latest][npm-latest] on npm;
+- any release tagged as [preview][npm-preview] on npm, if present.
+
+[website]: https://underscorejs.org
+[npm-latest]: https://www.npmjs.com/package/underscore/v/latest
+[npm-preview]: https://www.npmjs.com/package/underscore/v/preview
+
+## Reporting a Vulnerability
+
+Please report security issues by sending an email to
+dev@juliangonggrijp.com and jashkenas@gmail.com.
+
+Do __not__ submit an issue ticket or pull request or otherwise publicly
+disclose the issue.
+
+After receiving your email, we will respond as soon as possible and indicate
+what we plan to do.
+
+## Disclosure policy
+
+After confirming a vulnerability, we will generally release a security update
+as soon as possible, including the minimum amount of information required for
+software maintainers and system administrators to assess the urgency of the
+update for their particular situation.
+
+We postpone the publication of any further details such as code comments,
+tests, commit history and diffs, in order to enable a substantial share of the
+users to install the security fix before this time.
+
+Upon publication of full details, we will credit the reporter if the reporter wishes to be publicly identified.

bower.json

@@ -1,6 +1,6 @@
 {
   "name": "underscore",
-  "main": "underscore.js",
+  "main": "underscore-umd.js",
   "keywords": ["util", "functional", "server", "client", "browser"],
   "ignore" : ["docs", "test", "*.yml", "CNAME", "index.html", "favicon.ico", "CONTRIBUTING.md", ".*", "package.json", "karma.*"]
 }

docs/modules/_collectNonEnumProps.html

@@ -873,7 +873,7 @@ <h1>_collectNonEnumProps.js</h1>
   <span class="hljs-keyword">var</span> hash = {};
   <span class="hljs-keyword">for</span> (<span class="hljs-keyword">var</span> l = keys.length, i = <span class="hljs-number">0</span>; i &lt; l; ++i) hash[keys[i]] = <span class="hljs-literal">true</span>;
   <span class="hljs-keyword">return</span> {
-    <span class="hljs-attr">contains</span>: <span class="hljs-function"><span class="hljs-keyword">function</span>(<span class="hljs-params">key</span>) </span>{ <span class="hljs-keyword">return</span> hash[key]; },
+    <span class="hljs-attr">contains</span>: <span class="hljs-function"><span class="hljs-keyword">function</span>(<span class="hljs-params">key</span>) </span>{ <span class="hljs-keyword">return</span> hash[key] === <span class="hljs-literal">true</span>; },
     <span class="hljs-attr">push</span>: <span class="hljs-function"><span class="hljs-keyword">function</span>(<span class="hljs-params">key</span>) </span>{
       hash[key] = <span class="hljs-literal">true</span>;
       <span class="hljs-keyword">return</span> keys.push(key);

docs/modules/_setup.html

@@ -850,7 +850,7 @@ <h1>_setup.js</h1>
 
             </div>
 
-            <div class="content"><div class='highlight'><pre><span class="hljs-keyword">export</span> <span class="hljs-keyword">var</span> VERSION = <span class="hljs-string">'1.12.1'</span>;</pre></div></div>
+            <div class="content"><div class='highlight'><pre><span class="hljs-keyword">export</span> <span class="hljs-keyword">var</span> VERSION = <span class="hljs-string">'1.13.2'</span>;</pre></div></div>
 
         </li>
 

docs/modules/index.html

@@ -865,9 +865,9 @@ <h1 id="named-exports">Named Exports</h1>
               <div class="pilwrap ">
                 <a class="pilcrow" href="#section-3">&#182;</a>
               </div>
-              <pre><code>Underscore.js <span class="hljs-number">1.12</span><span class="hljs-number">.1</span>
+              <pre><code>Underscore.js <span class="hljs-number">1.13</span><span class="hljs-number">.2</span>
 <span class="hljs-attr">https</span>:<span class="hljs-comment">//underscorejs.org</span>
-(c) <span class="hljs-number">2009</span><span class="hljs-number">-2020</span> Jeremy Ashkenas, DocumentCloud and Investigative Reporters &amp; Editors
+(c) <span class="hljs-number">2009</span><span class="hljs-number">-2021</span> Jeremy Ashkenas, Julian Gonggrijp, and DocumentCloud and Investigative Reporters &amp; Editors
 Underscore may be freely distributed under the MIT license.</code></pre>
             </div>
 

docs/modules/sample.html

@@ -850,10 +850,10 @@ <h1>sample.js</h1>
             </div>
 
             <div class="content"><div class='highlight'><pre><span class="hljs-keyword">import</span> isArrayLike <span class="hljs-keyword">from</span> <span class="hljs-string">'./_isArrayLike.js'</span>;
-<span class="hljs-keyword">import</span> clone <span class="hljs-keyword">from</span> <span class="hljs-string">'./clone.js'</span>;
 <span class="hljs-keyword">import</span> values <span class="hljs-keyword">from</span> <span class="hljs-string">'./values.js'</span>;
 <span class="hljs-keyword">import</span> getLength <span class="hljs-keyword">from</span> <span class="hljs-string">'./_getLength.js'</span>;
-<span class="hljs-keyword">import</span> random <span class="hljs-keyword">from</span> <span class="hljs-string">'./random.js'</span>;</pre></div></div>
+<span class="hljs-keyword">import</span> random <span class="hljs-keyword">from</span> <span class="hljs-string">'./random.js'</span>;
+<span class="hljs-keyword">import</span> toArray <span class="hljs-keyword">from</span> <span class="hljs-string">'./toArray.js'</span>;</pre></div></div>
 
         </li>
 
@@ -876,7 +876,7 @@ <h1>sample.js</h1>
     <span class="hljs-keyword">if</span> (!isArrayLike(obj)) obj = values(obj);
     <span class="hljs-keyword">return</span> obj[random(obj.length - <span class="hljs-number">1</span>)];
   }
-  <span class="hljs-keyword">var</span> sample = isArrayLike(obj) ? clone(obj) : values(obj);
+  <span class="hljs-keyword">var</span> sample = toArray(obj);
   <span class="hljs-keyword">var</span> length = <span class="hljs-keyword">get</span><span class="hljs-title">Length</span>(<span class="hljs-params">sample</span>);
   <span class="hljs-title">n</span> = <span class="hljs-title">Math</span>.<span class="hljs-title">max</span>(<span class="hljs-params">Math.min(n, length</span>), 0);
   <span class="hljs-title">var</span> <span class="hljs-title">last</span> = <span class="hljs-title">length</span> - 1;