dset

dset copied to clipboard

Includes type definitions to handle deep merging of nested objects and overwriting arrays. The types ensure that primitive values from the second argument (U) overwrite those in the first (T),...

telesvar

Vulnerability version 3.1.3

2

Identifiers [pkg:npm/[email protected]](https://ossindex.sonatype.org/component/pkg:npm/[email protected]?utm_source=dependency-check&utm_medium=integration&utm_content=8.2.1) (Confidence:Highest) [cpe:2.3:a:dset_project:dset:3.1.3:*:*:*:*:*:*:*](https://nvd.nist.gov/vuln/search/results?form_type=Advanced&results_type=overview&search_type=all&cpe_vendor=cpe%3A%2F%3Adset_project&cpe_product=cpe%3A%2F%3Adset_project%3Adset&cpe_version=cpe%3A%2F%3Adset_project%3Adset%3A3.1.3) (Confidence:Highest) Published Vulnerabilities [CVE-2022-25645](https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2022-25645) All versions of package dset are vulnerable to Prototype Pollution via 'dset/merge' mode, as the dset function checks for prototype pollution by...

dcardonac31

build(deps-dev): bump set-value from 3.0.2 to 3.0.3 in /bench

1

Bumps [set-value](https://github.com/jonschlinkert/set-value) from 3.0.2 to 3.0.3. Commits 170ceff 3.0.3 09c4b10 back port patch for 4.0.1 See full diff in compare view [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with...

dependabot[bot]

Consider adding array merge strategy option

1

Given following code: ```js const host = { arr: ['hello'] } const { dset } = require('dset/merge') dset(host, 'arr', ['world']) // or const host = { arr: ['hello'] } const...

webketje

`dset` mutates the source object but doesn't return it. If the object was returned, we would get these advantages: - would simplify the case of immutability: instead of having to...

paulovieira

This test currently fails: ```js objects(`should ${verb} null values`, () => { let { input } = prepare({ hello: null }); dset(input, ['hello', 'a'], 123); assert.equal(input, { hello: { a:...

bgoscinski

This test currently fails: ```js objects(`should ${verb} empty string property`, () => { let { input } = prepare({}); dset(input, ["hello", ""], 123); assert.equal(input, { hello: { "": 123 },...

bgoscinski

👋 I believe I have discovered a bug in this library based on [GraphiQL](https://github.com/graphql/graphiql/blob/main/packages/graphiql/src/components/GraphiQL.tsx#L1396) usage of the library. If given: ```js import { dset } from "dset/merge" let input =...

ozziek

I noticed that there is a weird bug when using `dset` with `mobx`: ``` dset(data, "a.b.c", 1) ``` If `data` is an mobx observable (a deep and proxied one), `dset`...

filippodossena-mozart

Any particular reason `3.1.4` is on npm but there's no discrete release here for it?

jorgegonzalez