# What changed in defu

> 4 changes in defu 6 from its official release notes, upgrade guides and advisories: 1 breaking, 1 security, 1 new APIs and options. Each one cited. Sources checked 2026-10-19. HTML: https://unstale.sh/npm/defu/

To see which of these apply to a repository, run `npx @unstale/cli init` in it.

## defu 6

### Breaking changes

- Ignores inherited enumerable properties. (6.1.5) — [release notes](https://github.com/unjs/defu/releases/tag/v6.1.5)

### Security

- defu: Prototype pollution via `__proto__` key in defaults argument (6.1.5) — [security advisory](https://github.com/advisories/GHSA-737V-MQG7-C878), [release notes](https://github.com/unjs/defu/releases/tag/v6.1.5)

### New APIs and options

- Defu types are now exported for developers to use in TypeScript. (6.1.7) — [release notes](https://github.com/unjs/defu/releases/tag/v6.1.7)

### Fixes and other changes

- The types export entry was corrected so package type resolution uses the right entry. (6.1.7) — [release notes](https://github.com/unjs/defu/releases/tag/v6.1.7)