Cloning Proxy-wrapped objects with _.cloneDeep in Lodash 4.x: expected behavior vs observed outcome

Direct Answer

_.cloneDeep in Lodash 4.x does not preserve a Proxy. It treats the Proxy as a plain object, iterates its enumerable string-keyed properties (triggering get traps during iteration), recursively clones those values, and returns a brand-new plain object. The result has no internal reference to the original handler — no traps fire after the clone.

Confirmed Facts & Mechanism

p>The algorithm treats uncloneable values as plain objects and does not invoke Proxy traps. Because Proxy is not in the internal Lodash cloneableTags list, it falls through to the plain-object cloning path.

• Identity: The clone is a plain object (Object.prototype.toString.call(clone) === '[object Object]').
• Data Loss: Only enumerable string-keyed properties are copied. Symbol-keyed properties, non-enumerable properties, and the prototype chain of the Proxy are lost.
• WeakMaps: WeakMap instances are treated as objects, but since internal entries are not enumerable, the result is an empty WeakMap.
nn
• Uncloneables: Functions and DOM nodes are not cloned; _.cloneDeep returns the exact same reference.

Security Boundary Implications

Teams should not consider the cloned output a safe data boundary for security-sensitive payloads (such as expired credentials). Because the Proxy is replaced by a plain object, any behavior enforced by the handler (revocation, validation, membrane semantics) is lost. The clone is a data-only snapshot of the Proxy's surface at clone time, but any nested object references remain shared.

Verification Steps

To verify this in a modern environment (Node 18+ or browser):

1. Create a Proxy with a handler that logs get and has traps.
2. Call _.cloneDeep(proxy) and verify the result is a plain object.
3. Confirm no handler traps fire during iteration beyond normal property access.
4. Check that mutating the clone does not affect the original target (for primitive values).

When to Rebuild Manually

If your application requires Proxy-wrapped logic or security membranes, you must rebuild Proxy-wrapped objects manually or use a custom cloner that preserves the Proxy identity and handler logic.

Diagnostic Question

Does your Proxy target contain nested objects that the handler also wraps or mediates? If yes, those nested objects are shared by reference in the clone, revoking the original Proxy may leave the clone holding stale or now-unmediated capabilities.