[node-core-library] Remove lodash from production packages; add Objects.mergeWith and Objects.isRecord

apps/api-extractor/package.json

@@ -70,7 +70,6 @@
     "@rushstack/terminal": "workspace:*",
     "@rushstack/ts-command-line": "workspace:*",
     "diff": "~8.0.2",
-    "lodash": "~4.18.1",
     "minimatch": "10.2.3",
     "resolve": "~1.22.1",
     "semver": "~7.5.4",
@@ -79,7 +78,6 @@
   },
   "devDependencies": {
     "@rushstack/heft": "1.2.12",
-    "@types/lodash": "4.17.23",
     "@types/resolve": "1.20.2",
     "@types/semver": "7.5.0",
     "decoupled-local-node-rig": "workspace:*",

apps/api-extractor/src/api/ExtractorConfig.ts

@@ -4,7 +4,6 @@
 import * as path from 'node:path';
 
 import * as resolve from 'resolve';
-import lodash = require('lodash');
 
 import { EnumMemberOrder, ReleaseTag } from '@microsoft/api-extractor-model';
 import { TSDocConfiguration, TSDocTagDefinition } from '@microsoft/tsdoc';
@@ -14,6 +13,7 @@ import {
   JsonFile,
   JsonSchema,
   FileSystem,
+  Objects,
   PackageJsonLookup,
   type INodePackageJson,
   PackageName,
@@ -629,10 +629,10 @@ export class ExtractorConfig {
     let currentConfigFilePath: string = path.resolve(jsonFilePath);
     let configObject: Partial<IConfigFile> = {};
 
-    // Lodash merges array values by default, which is unintuitive for config files (and makes it impossible for derived configurations to overwrite arrays).
-    // For example, given a base config containing an array property with value ["foo", "bar"] and a derived config that specifies ["baz"] for that property, lodash will produce ["baz", "bar"], which is unintuitive.
-    // This customizer function ensures that arrays are always overwritten.
-    const mergeCustomizer: lodash.MergeWithCustomizer = (objValue, srcValue) => {
+    // Arrays are overwritten rather than merged, which is the intuitive behavior for config files.
+    // For example, given a base config containing an array property with value ["foo", "bar"] and a
+    // derived config that specifies ["baz"] for that property, the result is ["baz"] (not ["baz", "bar"]).
+    const mergeCustomizer: Objects.MergeWithCustomizer = (objValue, srcValue) => {
       if (Array.isArray(srcValue)) {
         return srcValue;
       }
@@ -680,11 +680,11 @@ export class ExtractorConfig {
         }
 
         // This step has to be performed in advance, since the currentConfigFolderPath information will be lost
-        // after lodash.merge() is performed.
+        // after the merge is performed.
         ExtractorConfig._resolveConfigFileRelativePaths(baseConfig, currentConfigFolderPath);
 
         // Merge extractorConfig into baseConfig, mutating baseConfig
-        lodash.mergeWith(baseConfig, configObject, mergeCustomizer);
+        Objects.mergeWith(baseConfig, configObject, mergeCustomizer);
         configObject = baseConfig;
 
         currentConfigFilePath = extendsField;
@@ -694,11 +694,11 @@ export class ExtractorConfig {
     }
 
     // Lastly, apply the defaults
-    configObject = lodash.mergeWith(
-      lodash.cloneDeep(ExtractorConfig._defaultConfig),
+    configObject = Objects.mergeWith(
+      structuredClone(ExtractorConfig._defaultConfig),
       configObject,
       mergeCustomizer
-    );
+    ) as Partial<IConfigFile>;
 
     ExtractorConfig.jsonSchema.validateObject(configObject, jsonFilePath);
 

apps/rush/src/test/sandbox/legacy-repo/project/package.json

@@ -9,7 +9,7 @@
   "author": "",
   "license": "ISC",
   "dependencies": {
-    "lodash": "^4.17.15",
+    "semver": "^7.5.4",
     "react": "^0.14.9"
   }
 }

apps/rush/src/test/sandbox/repo/project/package.json

@@ -9,7 +9,7 @@
   "author": "",
   "license": "ISC",
   "dependencies": {
-    "lodash": "^4.17.15",
+    "semver": "^7.5.4",
     "react": "^0.14.9"
   }
 }

build-tests/localization-plugin-test-02/package.json

@@ -15,11 +15,9 @@
     "@rushstack/set-webpack-public-path-plugin": "^4.1.16",
     "@rushstack/webpack4-localization-plugin": "workspace:*",
     "@rushstack/webpack4-module-minifier-plugin": "workspace:*",
-    "@types/lodash": "4.17.23",
     "@types/webpack-env": "1.18.8",
     "eslint": "~9.37.0",
     "html-webpack-plugin": "~4.5.2",
-    "lodash": "~4.18.1",
     "local-node-rig": "workspace:*",
     "webpack": "~4.47.0",
     "webpack-bundle-analyzer": "~4.5.0",

build-tests/localization-plugin-test-02/src/chunks/chunkWithStrings.ts

@@ -1,13 +1,18 @@
 // Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
 // See LICENSE in the project root for license information.
 
-import * as lodash from 'lodash';
-
 import strings from './strings2.loc.json';
 
+function htmlEscape(str: string): string {
+  return str.replace(
+    /[&<>"']/g,
+    (c) => ({ '&': '&amp;', '<': '&lt;', '>': '&gt;', '"': '&quot;', "'": '&#39;' })[c] ?? c
+  );
+}
+
 export class ChunkWithStringsClass {
   public doStuff(): void {
     // eslint-disable-next-line no-console
-    console.log(lodash.escape(strings.string1));
+    console.log(htmlEscape(strings.string1));
   }
 }

build-tests/localization-plugin-test-02/src/chunks/chunkWithoutStrings.ts

@@ -1,11 +1,16 @@
 // Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
 // See LICENSE in the project root for license information.
 
-import * as lodash from 'lodash';
+function htmlEscape(str: string): string {
+  return str.replace(
+    /[&<>"']/g,
+    (c) => ({ '&': '&amp;', '<': '&lt;', '>': '&gt;', '"': '&quot;', "'": '&#39;' })[c] ?? c
+  );
+}
 
 export class ChunkWithoutStringsClass {
   public doStuff(): void {
     // eslint-disable-next-line no-console
-    console.log(lodash.escape('STATIC STRING'));
+    console.log(htmlEscape('STATIC STRING'));
   }
 }

build-tests/rush-package-manager-integration-test/src/testNpmMode.ts

@@ -34,7 +34,7 @@ export async function testNpmModeAsync(terminal: ITerminal): Promise<void> {
     testRepoPath,
     'test-project-a',
     '1.0.0',
-    { lodash: '^4.17.21' },
+    { semver: '^7.5.4' },
     `node -e "const fs = require('fs'); fs.mkdirSync('lib', {recursive: true}); fs.writeFileSync('lib/index.js', 'module.exports = { greet: () => \\"Hello from A\\" };');"`
   );
 
@@ -65,7 +65,7 @@ export async function testNpmModeAsync(terminal: ITerminal): Promise<void> {
   await helper.executeRushAsync(['install'], testRepoPath);
 
   // Verify node_modules were populated correctly
-  await helper.verifyDependenciesAsync(testRepoPath, 'test-project-a', ['lodash']);
+  await helper.verifyDependenciesAsync(testRepoPath, 'test-project-a', ['semver']);
   await helper.verifyDependenciesAsync(testRepoPath, 'test-project-b', ['test-project-a']);
 
   // Run rush build

build-tests/rush-package-manager-integration-test/src/testYarnMode.ts

@@ -34,7 +34,7 @@ export async function testYarnModeAsync(terminal: ITerminal): Promise<void> {
     testRepoPath,
     'test-project-a',
     '1.0.0',
-    { lodash: '^4.17.21' },
+    { semver: '^7.5.4' },
     `node -e "const fs = require('fs'); fs.mkdirSync('lib', {recursive: true}); fs.writeFileSync('lib/index.js', 'module.exports = { greet: () => \\"Hello from A\\" };');"`
   );
 
@@ -65,7 +65,7 @@ export async function testYarnModeAsync(terminal: ITerminal): Promise<void> {
   await helper.executeRushAsync(['install'], testRepoPath);
 
   // Verify node_modules were populated correctly
-  await helper.verifyDependenciesAsync(testRepoPath, 'test-project-a', ['lodash']);
+  await helper.verifyDependenciesAsync(testRepoPath, 'test-project-a', ['semver']);
   await helper.verifyDependenciesAsync(testRepoPath, 'test-project-b', ['test-project-a']);
 
   // Run rush build

common/changes/@microsoft/api-extractor/remove-lodash_2026-04-16-23-08.json

@@ -0,0 +1,10 @@
+{
+  "changes": [
+    {
+      "packageName": "@microsoft/api-extractor",
+      "comment": "Remove dependecy on `lodash`.",
+      "type": "patch"
+    }
+  ],
+  "packageName": "@microsoft/api-extractor"
+}

common/changes/@microsoft/rush/remove-lodash_2026-04-16-23-10.json

@@ -0,0 +1,10 @@
+{
+  "changes": [
+    {
+      "packageName": "@microsoft/rush",
+      "comment": "",
+      "type": "none"
+    }
+  ],
+  "packageName": "@microsoft/rush"
+}

common/changes/@rushstack/heft-jest-plugin/remove-lodash_2026-04-16-23-08.json

@@ -0,0 +1,10 @@
+{
+  "changes": [
+    {
+      "packageName": "@rushstack/heft-jest-plugin",
+      "comment": "Remove dependecy on `lodash`.",
+      "type": "patch"
+    }
+  ],
+  "packageName": "@rushstack/heft-jest-plugin"
+}

common/changes/@rushstack/node-core-library/remove-lodash_2026-04-16-23-08.json

@@ -0,0 +1,10 @@
+{
+  "changes": [
+    {
+      "packageName": "@rushstack/node-core-library",
+      "comment": "Add two new APIs: `Object.isRecord` asserts if an object is a `Record<string, unknown>` object and `Object.mergeWith` is a customizable deep object merge.",
+      "type": "minor"
+    }
+  ],
+  "packageName": "@rushstack/node-core-library"
+}

common/changes/@rushstack/npm-check-fork/remove-lodash_2026-04-16-23-08.json

@@ -0,0 +1,10 @@
+{
+  "changes": [
+    {
+      "packageName": "@rushstack/npm-check-fork",
+      "comment": "Remove dependecy on `lodash`.",
+      "type": "patch"
+    }
+  ],
+  "packageName": "@rushstack/npm-check-fork"
+}

common/config/rush/nonbrowser-approved-packages.json

@@ -198,10 +198,6 @@
       "name": "@rushstack/heft-dev-cert-plugin",
       "allowedCategories": [ "libraries", "tests" ]
     },
-    {
-      "name": "@rushstack/heft-static-asset-typings-plugin",
-      "allowedCategories": [ "libraries", "tests" ]
-    },
     {
       "name": "@rushstack/heft-isolated-typescript-transpile-plugin",
       "allowedCategories": [ "tests" ]
@@ -242,6 +238,10 @@
       "name": "@rushstack/heft-serverless-stack-plugin",
       "allowedCategories": [ "tests" ]
     },
+    {
+      "name": "@rushstack/heft-static-asset-typings-plugin",
+      "allowedCategories": [ "libraries", "tests" ]
+    },
     {
       "name": "@rushstack/heft-storybook-plugin",
       "allowedCategories": [ "tests" ]
@@ -870,10 +870,6 @@
       "name": "local-web-rig",
       "allowedCategories": [ "libraries", "tests", "vscode-extensions" ]
     },
-    {
-      "name": "lodash",
-      "allowedCategories": [ "libraries", "tests" ]
-    },
     {
       "name": "long",
       "allowedCategories": [ "tests" ]

common/config/subspaces/build-tests-subspace/repo-state.json

@@ -1,6 +1,6 @@
 // DO NOT MODIFY THIS FILE MANUALLY BUT DO COMMIT IT. It is generated and used by Rush.
 {
-  "pnpmShrinkwrapHash": "b1f311ce3022b7da1f29ddfd0c9f36fc9369eb6a",
+  "pnpmShrinkwrapHash": "bd8dac1e8e2962919f64c6784b22d17b4abf9621",
   "preferredVersionsHash": "550b4cee0bef4e97db6c6aad726df5149d20e7d9",
-  "packageJsonInjectedDependenciesHash": "716af2ed336a08a888140c784ff3d11e6aea0e4b"
+  "packageJsonInjectedDependenciesHash": "7bcd0c465594aefb6e51e674bb235fa385a071a7"
 }