Update bower dependencies.

app/bower_components/lodash/test/test-fp.js

@@ -233,25 +233,14 @@
       assert.strictEqual(add('2')('1'), '12');
     });
 
-    QUnit.test('should only add a `placeholder` property if needed', function(assert) {
+    QUnit.test('should add a `placeholder` property', function(assert) {
       assert.expect(2);
 
       if (!document) {
-        var methodNames = _.keys(mapping.placeholder),
-            expected = _.map(methodNames, _.constant(true));
-
-        var actual = _.map(methodNames, function(methodName) {
-          var object = {};
-          object[methodName] = _[methodName];
-
-          var lodash = convert(object);
-          return methodName in lodash;
-        });
-
-        assert.deepEqual(actual, expected);
-
         var lodash = convert({ 'add': _.add });
-        assert.notOk('placeholder' in lodash);
+
+        assert.strictEqual(lodash.placeholder, lodash);
+        assert.strictEqual(lodash.add.placeholder, lodash);
       }
       else {
         skipAssert(assert, 2);
@@ -645,7 +634,16 @@
       });
     });
 
-    _.forOwn(mapping.placeholder, function(truthy, methodName) {
+    var methodNames = [
+      'bind',
+      'bindKey',
+      'curry',
+      'curryRight',
+      'partial',
+      'partialRight'
+    ];
+
+    _.each(methodNames, function(methodName) {
       var func = fp[methodName];
 
       QUnit.test('fp.' + methodName + '` should have a `placeholder` property', function(assert) {
@@ -2138,6 +2136,16 @@
       assert.strictEqual(typeof actual.a.b, 'number');
     });
 
+    QUnit.test('should not convert uncloneables to objects', function(assert) {
+      assert.expect(2);
+
+      var object = { 'a': { 'b': _.constant(true) } },
+          actual = fp.update('a.b')(_.identity)(object);
+
+      assert.strictEqual(typeof object.a.b, 'function');
+      assert.strictEqual(object.a.b, actual.a.b);
+    });
+
     QUnit.test('should not mutate values', function(assert) {
       assert.expect(2);
 

app/bower_components/lodash/test/test.js

@@ -2958,7 +2958,7 @@
           assert.deepEqual(getSymbols(actual.a.b), [symbol]);
           assert.deepEqual(actual.a.b[symbol], object.a.b[symbol]);
           assert.deepEqual(actual.a.b[symbol2], object.a.b[symbol2]);
-          assert.deepEqual(actual.a.b[symbol3], object.a.b[symbol3])
+          assert.deepEqual(actual.a.b[symbol3], object.a.b[symbol3]);
         }
         else {
           skipAssert(assert, 7);
@@ -7539,6 +7539,50 @@
       actual = _.groupBy([{ 'a': '__proto__' }], 'a');
       assert.notOk(actual instanceof Array);
     });
+
+    QUnit.test('should not merge "__proto__" properties', function(assert) {
+      assert.expect(1);
+
+      if (JSON) {
+        _.merge({}, JSON.parse('{"__proto__":{"a":1}}'));
+
+        var actual = 'a' in objectProto;
+        delete objectProto.a;
+
+        assert.notOk(actual);
+      } else {
+        skipAssert(assert);
+      }
+    });
+
+    QUnit.test('should not indirectly merge builtin prototype properties', function(assert) {
+      assert.expect(2);
+
+      _.merge({}, { 'toString': { 'constructor': { 'prototype': { 'a': 1 } } } });
+
+      var actual = 'a' in funcProto;
+      delete funcProto.a;
+
+      assert.notOk(actual);
+
+      _.merge({}, { 'constructor': { 'prototype': { 'a': 1 } } });
+
+      actual = 'a' in objectProto;
+      delete objectProto.a;
+
+      assert.notOk(actual);
+    });
+
+    QUnit.test('should not indirectly merge `Object` properties', function(assert) {
+      assert.expect(1);
+
+      _.merge({}, { 'constructor': { 'a': 1 } });
+
+      var actual = 'a' in Object;
+      delete Object.a;
+
+      assert.notOk(actual);
+    });
   }());
 
   /*--------------------------------------------------------------------------*/
@@ -14885,19 +14929,39 @@
       assert.strictEqual(Foo.a, 1);
     });
 
+    QUnit.test('should merge first source object properties to function', function(assert) {
+      assert.expect(1);
+
+      var fn = function() {},
+          object = { 'prop': {} },
+          actual = _.merge({ 'prop': fn }, object);
+
+      assert.deepEqual(actual, object);
+    });
+
+    QUnit.test('should merge first and second source object properties to function', function(assert) {
+      assert.expect(1);
+
+      var fn = function() {},
+          object = { 'prop': {} },
+          actual = _.merge({ 'prop': fn }, { 'prop': fn }, object);
+
+      assert.deepEqual(actual, object);
+    });
+
     QUnit.test('should not merge onto function values of sources', function(assert) {
       assert.expect(3);
 
       var source1 = { 'a': function() {} },
           source2 = { 'a': { 'b': 2 } },
+          expected = { 'a': { 'b': 2 } },
           actual = _.merge({}, source1, source2);
 
-      assert.deepEqual(actual, { 'a': { 'b': 2 } });
+      assert.deepEqual(actual, expected);
+      assert.notOk('b' in source1.a);
 
       actual = _.merge(source1, source2);
-
-      assert.strictEqual(typeof actual.a, 'function');
-      assert.strictEqual(actual.a.b, 2);
+      assert.deepEqual(actual, expected);
     });
 
     QUnit.test('should merge onto non-plain `object` values', function(assert) {
@@ -25332,6 +25396,22 @@
 
       assert.deepEqual(actual, [['a'], ['b'], ['c']]);
     });
+
+    QUnit.test('should prevent ReDoS', function(assert) {
+      assert.expect(2);
+
+      var largeWordLen = 50000,
+          largeWord = 'A'.repeat(largeWordLen),
+          maxMs = 1000,
+          startTime = lodashStable.now();
+
+      assert.deepEqual(_.words(largeWord + 'ÆiouAreVowels'), [largeWord, 'Æiou', 'Are', 'Vowels']);
+
+      var endTime = lodashStable.now(),
+          timeSpent = endTime - startTime;
+
+      assert.ok(timeSpent < maxMs, 'operation took ' + timeSpent + 'ms');
+    });
   }());
 
   /*--------------------------------------------------------------------------*/