Remove lodash from bitcore-lib by MichaelAJay · Pull Request #4149 · bitpay/bitcore · GitHub

Description

Remove lodash from bitcore-lib. Also some general cleanup, and especially 'forEach' fixing.

Changelog

Replace lodash in bitcore-lib with plain JS implementations

Testing Notes

Checklist

I have read CONTRIBUTING.md and verified that this PR follows the guidelines and requirements outlined in it.

…dash

Pull request overview

This pull request removes the lodash runtime dependency from packages/bitcore-lib by replacing lodash helpers with equivalent native JavaScript implementations across the library and its test suite.

Changes:

Replaced lodash type checks, collection helpers, cloning, and object extension with native JS (typeof, Array.isArray, map/filter/reduce, Object.assign, etc.).
Updated transaction sorting/shuffling and various loops to avoid .forEach and lodash utilities.
Removed lodash from bitcore-lib dependencies and stopped exporting it via bitcore.deps._.

Reviewed changes

Copilot reviewed 45 out of 46 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
packages/bitcore-lib/test/transaction/unspentoutput.js	Drops lodash usage in tests; uses structuredClone for deep copy.
packages/bitcore-lib/test/transaction/transaction.js	Replaces lodash shuffle stubbing with Math.random stubbing; minor test cleanups.
packages/bitcore-lib/test/transaction/signature.js	Removes unused lodash/chai should imports from test file.
packages/bitcore-lib/test/transaction/output.js	Removes unused imports (expect/lodash/errors) after cleanup.
packages/bitcore-lib/test/transaction/input/publickeyhash.js	Removes lodash/chai imports (relies on existing test environment setup).
packages/bitcore-lib/test/transaction/input/multisigscripthash.js	Replaces lodash-based assertions with native array mapping + chai members checks.
packages/bitcore-lib/test/transaction/input/multisig.js	Replaces lodash checks with native array mapping + chai members checks.
packages/bitcore-lib/test/transaction/input/input.js	Replaces lodash iteration with for...of; adds lint suppressions for bitwise ops.
packages/bitcore-lib/test/script/interpreter.js	Removes lodash and replaces array checks/iteration with native constructs.
packages/bitcore-lib/test/opcode.js	Replaces _.size with Object.keys(...).length.
packages/bitcore-lib/test/hdpublickey.js	Removes lodash/assert usage; modernizes to const + chai deep equality.
packages/bitcore-lib/test/hdprivatekey.js	Removes lodash/assert usage; replaces lodash iteration with for...of.
packages/bitcore-lib/test/hdkeys.js	Replaces _.each with for...of; removes unused imports.
packages/bitcore-lib/test/crypto/signature.js	Replaces lodash iteration with loops; updates fixture runner implementation.
packages/bitcore-lib/package.json	Removes lodash dependency; pins elliptic to an exact version.
packages/bitcore-lib/package-lock.json	Updates lockfile to reflect dependency removal and related resolution changes.
packages/bitcore-lib/lib/util/preconditions.js	Replaces lodash string checks with typeof.
packages/bitcore-lib/lib/util/js.js	Replaces lodash checks and forEach with native checks/loops; simplifies try/catch.
packages/bitcore-lib/lib/uri.js	Removes lodash; switches to Object.assign and native loops; replaces URL variable usage.
packages/bitcore-lib/lib/unit.js	Removes lodash; replaces object checks and iteration with native constructs.
packages/bitcore-lib/lib/transaction/unspentoutput.js	Removes lodash; replaces undefined/number/object checks with native equivalents.
packages/bitcore-lib/lib/transaction/transaction.js	Removes lodash; replaces sum/difference/without/shuffle with native implementations.
packages/bitcore-lib/lib/transaction/output.js	Removes lodash type checks; adds bitwise lint suppression and minor cleanup.
packages/bitcore-lib/lib/transaction/input/multisigscripthash.js	Replaces _.sortBy with explicit array copy + comparator sort.
packages/bitcore-lib/lib/transaction/input/multisig.js	Replaces lodash collection helpers with native map/filter/reduce/sort and loops.
packages/bitcore-lib/lib/transaction/input/input.js	Removes lodash; replaces type checks; adds bitwise lint suppressions.
packages/bitcore-lib/lib/script/script.js	Removes lodash; replaces object checks and sorting with native equivalents.
packages/bitcore-lib/lib/script/interpreter.js	Removes lodash; replaces undefined checks with nullish checks; adds JSUtil usage.
packages/bitcore-lib/lib/publickey.js	Removes lodash; replaces isUndefined patterns with explicit === undefined checks.
packages/bitcore-lib/lib/privatekey.js	Removes lodash; replaces null/undefined and string/object checks with native checks.
packages/bitcore-lib/lib/opcode.js	Removes lodash; replaces type checks and _.extend with Object.assign.
packages/bitcore-lib/lib/message.js	Removes lodash; replaces string checks with typeof.
packages/bitcore-lib/lib/hdpublickey.js	Removes lodash; replaces collection/type helpers with native equivalents.
packages/bitcore-lib/lib/hdprivatekey.js	Removes lodash; replaces includes/some/every/type checks with native equivalents.
packages/bitcore-lib/lib/errors/index.js	Removes lodash; replaces _.each and type checks with native equivalents.
packages/bitcore-lib/lib/encoding/bufferreader.js	Removes lodash; replaces undefined/string/object checks with native equivalents.
packages/bitcore-lib/lib/encoding/base58check.js	Removes lodash; replaces string checks with typeof.
packages/bitcore-lib/lib/encoding/base58.js	Removes lodash; rewrites validCharacters with native checks/iteration.
packages/bitcore-lib/lib/crypto/signature.js	Removes lodash; introduces helper for DER sign-bit checks; adjusts strict defaulting.
packages/bitcore-lib/lib/crypto/point.js	Removes unused catch variable; minor import order tweak.
packages/bitcore-lib/lib/crypto/bn.js	Removes lodash; replaces type checks; adds bitwise lint suppressions.
packages/bitcore-lib/lib/block/merkleblock.js	Removes lodash; replaces extend/array checks/undefined checks with native equivalents.
packages/bitcore-lib/lib/block/blockheader.js	Removes lodash; replaces type checks; replaces noop setter.
packages/bitcore-lib/lib/block/block.js	Removes lodash; replaces extend and array building with native equivalents.
packages/bitcore-lib/lib/address.js	Removes lodash; replaces array/object/number checks and mapping with native equivalents.
packages/bitcore-lib/index.js	Stops exporting lodash via bitcore.deps._.

Files not reviewed (1)

packages/bitcore-lib/package-lock.json: Language not supported

Comments suppressed due to low confidence (1)

packages/bitcore-lib/test/crypto/signature.js:262

Inside the for loop, non-hex fixture vectors should be skipped, but return; exits test_sigs early and prevents generating the rest of the fixture tests. This changes the semantics compared to the prior forEach callback (where return only skipped the current element).

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

…dash

@MichaelAJay Man, I forgot about this PR. Could you dust this off by resolving the conflicts, please?

Copilot review overview

🟡 Changes recommended

The vulnerable elliptic pin and several functional and test regressions must be corrected.

Review effort: Balanced
Findings: 2 · 6 · 1

Open (9)

Cache accumulator only after successful validation · New
Avoid pinning vulnerable elliptic version · New
Reject invalid array and object character inputs · New
Use continue instead of return when skipping signatures · New
Initialize Chai should interface locally · New
Restore local Chai should interface initialization · New
Restore Chai should initialization · New
Initialize Chai should interface in this test · New
Align JSDoc option name with function parameter · New

Resolved since last review (1)

Interpreter.SCRIPT_VERIFY_CLEANSTACK = ... , is currently chained with the next assignment via…

MichaelAJay added 30 commits April 16, 2026 09:54

[LIB] - rm lodash from dependencies

7111f9c

[LIB] lint address.js

583e5e2

[LIB] replaces lodash in address.js

fc3270c

[LIB] lint hdprivatekey.js

a86ad2c

[LIB] rm lodash usage in hdprivatekey

508394a

change isUndefined() replacement

43ea0fe

[LIB] lint hdpublickey

d6fdf4e

[LIB] remove lodash from hdpublickey

af89af0

[LIB] lint message.js

ea561e2

[LIB] rm lodash from message.js

8d56f53

[LIB] lint opcode.js

97a9d91

[LIB] replace lodash in opcode.js

d1b70af

[LIB] lint privatekey.js

d5d19f0

[LIB] rm lodash from privatekey.js

f411112

[LIB] lint publickey.js

dbdc2d1

[LIB] rm lodash from publickey.js

01e89fa

[LIB] lint unit.js

0661636

[LIB] rm lodash from unit.js

d200d42

[LIB] rm lodas from unit.js 2/2

01b1ae7

[LIB] favor for of over forEach

e833fe9

[LIB] lint uri.js

57b3426

[LIB] rm lodash from uri.js

87233d4

[LIB] lint block.js

749b0a1

[LIB] rm lodash from block.js

f043978

[LIB] replace forEach with map in block.js

5c8edfb

[LIB] lint blockheader.js

6fbe443

[LIB] rm lodash from blockheader.js

b72fef9

[LIB\ lint merkleblock.js

b8ec4e4

[LIB] rm lodash from merkleblock.js

3371c00

[LIB] lint bn.js

457fa42

MichaelAJay added 10 commits May 5, 2026 16:16

Merge branch 'master' of https://github.com/bitpay/bitcore into rm-lo…

07d6e08

…dash

fix double imports

304ab10

fix direct buffer usage & optional chaining operator

cb3fbf3

Merge branch 'master' of https://github.com/bitpay/bitcore into rm-lo…

4b7e574

…dash

lint (kick tests)

8b163d2

bump rippled.Dockerfile base image (node 18 bullseye -> 22 trixie)

d88ba6e

update rippled.Dockerfile

4b2b111

update rippled Dockerfile to match XRPL documentation

32c594e

Merge commit '32c594eda28d56d58e15d2e1aa4b1cab76beedf6' into rm-lodash

6167594

update crpc rippled.Dockerfile

bc89dd9

MichaelAJay changed the title WIP remove lodash Remove lodash from bitcore-lib May 11, 2026

MichaelAJay marked this pull request as ready for review May 11, 2026 18:54

MichaelAJay added 2 commits May 11, 2026 17:11

Merge branch 'master' of https://github.com/bitpay/bitcore into rm-lo…

50e4392

…dash

fix bad merge resolution

6eef478

kajoseph requested a review from Copilot June 3, 2026 21:12

Copilot started reviewing on behalf of kajoseph June 3, 2026 21:12 View session

Copilot AI reviewed Jun 3, 2026

View reviewed changes

Comment thread packages/bitcore-lib/lib/script/interpreter.js Outdated

MichaelAJay added 3 commits July 14, 2026 14:31

merge master

a6634e3

fix: inappropriate comma usage

2118d3c

fix outdated bitcore-lib package lock

2a4af61

MichaelAJay force-pushed the rm-lodash branch from f7e52f3 to 2a4af61 Compare July 14, 2026 20:35

MichaelAJay added 3 commits July 16, 2026 13:04

Merge branch 'master' of https://github.com/bitpay/bitcore into rm-lo…

2ebc188

…dash

add an extra minute to browser test runner config, 4 -> 5

2b25e69

refactor Transaction.prototype._hasDustOutputs

0a45c50

MichaelAJay force-pushed the rm-lodash branch from 9544ccd to 0a45c50 Compare July 16, 2026 17:14

merge master

3920035

kajoseph requested a balanced review from Copilot October 6, 2026 21:39

Copilot started reviewing on behalf of kajoseph October 6, 2026 21:40 View session

Copilot AI reviewed Oct 6, 2026

View reviewed changes

+                  this._inputAmount = 0;
+                  for (const input of this.inputs || []) {
                     if (input.output == null) {
                       throw new errors.Transaction.Input.MissingPreviousOutput();
                     }

-                  "elliptic": "^6.5.3",
-                  "inherits": "=2.0.1",
-                  "lodash": "^4.17.20"
+                  "elliptic": "=6.5.3",

+                // Backwards compat: lodash _.map(null/undefined) yields [], _.every([]) is true.
+                if (chars == null) {
+                  return true;
+                }
+                if (typeof chars !== 'string') {
+                  // Backwards compat: lodash _.map on non-string primitives (number, boolean, etc.) yields [].
+                  // Boxed strings must be unwrapped: lodash maps each character of String objects.
+                  if (chars instanceof String) {
+                    chars = chars.valueOf();
+                  } else {
+                    return true;
+                  }
+                }
+                return Array.prototype.every.call(chars, char => ALPHABET.includes(char));

-              var xpubkeyTestnet = 'tpubD6NzVbkrYhZ4WZaiWHz59q5EQ61bd6dUYfU4ggRWAtNAyyYRNWT6ktJ7UHJEXURvTfTfskFQmK7Ff4FRkiRN5wQH8nkGAb6aKB4Yyeqsw5m';
-              var json = '{"network":"livenet","depth":0,"fingerPrint":876747070,"parentFingerPrint":0,"childIndex":0,"chainCode":"873dff81c02f525623fd1fe5167eac3a55a049de3d314bb42ee227ffed37d508","publicKey":"0339a36013301597daef41fbe593a02cc513d0b55527ec2df1050e2e8ff49c85c2","checksum":-1421395167,"xpubkey":"xpub661MyMwAqRbcFtXgS5sYJABqqG9YLmC4Q1Rdap9gSE8NqtwybGhePY2gZ29ESFjqJoCu1Rupje8YtGqsefD265TMg7usUDFdp6W1EGMcet8"}';
-              var derived_0_1_200000 = 'xpub6BqyndF6rkBNTV6LXwiY8Pco8aqctqq7tGEUdA8fmGDTnDJphn2fmxr3eM8Lm3m8TrNUsLbEjHvpa3adBU18YpEx4tp2Zp6nqax3mQkudhX';
+              const expect = require('chai').expect;

                * @param {number} threshold amount of required signatures to spend the output
                * @param {Array} signatures and array of signature buffers to append to the script
-               * @param {Object=} opts
+               * @param {Object=} _opts

Remove lodash from bitcore-lib by MichaelAJay · Pull Request #4149 · bitpay/bitcore · GitHub

Repository navigation

Remove lodash from bitcore-lib - #4149

Remove lodash from bitcore-lib#4149
MichaelAJay wants to merge 122 commits into
bitpay:masterfrom
MichaelAJay:rm-lodash

MichaelAJay commented Apr 27, 2026 •
edited
Loading

Uh oh!

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

kajoseph commented Sep 30, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

This branch has not been deployed

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

		for (let i = 0; i < set.length; i++) {
		const vector = set[i];

-              const _ = require('lodash');
-              const should = require('chai').should();
               const expect = require('chai').expect;


		const bitcore = require('../../..');

Remove lodash from bitcore-lib by MichaelAJay · Pull Request #4149 · bitpay/bitcore · GitHub

Repository navigation

Remove lodash from bitcore-lib - #4149

Remove lodash from bitcore-lib#4149MichaelAJay wants to merge 122 commits intobitpay:masterbitpay/bitcore:masterfrom MichaelAJay:rm-lodashMichaelAJay/bitcore:rm-lodashCopy head branch name to clipboard

Conversation

MichaelAJay commented Apr 27, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Description

Changelog

Testing Notes

Checklist

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

kajoseph commented Sep 30, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Copilot review overview

🟡 Changes recommended

Uh oh!

This branch has not been deployed

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Remove lodash from bitcore-lib#4149
MichaelAJay wants to merge 122 commits into
bitpay:masterfrom
MichaelAJay:rm-lodash

MichaelAJay commented Apr 27, 2026 •
edited
Loading