A bug in our build pipeline caused our SDK to expose an internal library globally. As a result, our subset of the lodash library was bound to window._, overwriting the existing _ global for some customer sites. This meant that some expected library functions were not defined after our script loaded.

Technical Details:

• A code change imported all of lodash and accessed a method on the import instead of importing just the method.
• Webpack bundled lodash, including its window._assignment despite the library being used in a module import context.

Remediations:

• We’ve added additional tests to catch unwanted pollution of the window object by our SDK
• We’ve added an internal linting rule to avoid full lodash imports