npm / defu

defu

What changed in defu 6, from its official release notes, upgrade guides and advisories. Sources checked 2026-10-19.

1 breaking1 security1 new APIs and options1 fixes and other

See which of these apply to your code, ranked, in your agent:

npx @unstale/cli init

@unstale/cli 0.2.8 on npm

defu 64 changes

Breaking changes 1

Ignores inherited enumerable properties.
6.1.5release notes

Security 1

defu: Prototype pollution via __proto__ key in defaults argument
6.1.5security advisory release notes

New APIs and options 1

Defu types are now exported for developers to use in TypeScript.
6.1.7release notes

Fixes and other changes 1

The types export entry was corrected so package type resolution uses the right entry.
6.1.7release notes