dset

library0.0.1jsnpmunverified

dset is a minimalist JavaScript utility, currently at version 3.1.4, designed for safely setting deeply nested values within objects. It distinguishes itself by its extremely small footprint (under 200 bytes gzipped for the main module) and explicit protection against prototype pollution since v2.1.0. The package has a stable release cadence with frequent patch updates and less frequent minor/major releases. A key differentiator is the `dset/merge` submodule, introduced in v3.1.0, which provides a merging behavior for deep object writes, useful for scenarios like GraphQL stream directives, contrasting with the main `dset` module's default overwrite behavior. It ships with TypeScript definitions, making it well-suited for modern JavaScript and TypeScript projects.

serialization

npm install dset

github ↗package ↗

INSTALL

IMPORT

SIG · DSET

dset

serializationjavascriptv0.0.1

Install

—

Import

—

Disk

—

Pass rate

0/ 6

Env Coverage0 / 6

glibc

18–22

musl

18–22

Install & Compatibility

Where this runs

tested against v? · npm install

Install × environment matrix

Each cell = how many times install + import succeeded across repeated harness runs. Partial = flaky.
glibc = Debian/Ubuntu slim · musl = Alpine Linux

musl

node 18–226 runs

build_error

glibc

node 18–226 runs

build_error

Code

Verified usage

Verified import paths — ran on the pinned version, not inferred.

dset

✓ import { dset } from 'dset';

✗ import dset from 'dset';

The `dset` function is a named export since v3.0.0. Default imports are incorrect for v3+.

mergeDset

✓ import { dset as mergeDset } from 'dset/merge';

✗ import { dset } from 'dset/merge';

Use a named alias (e.g., `mergeDset`) to avoid collision if also importing the main `dset` function. This submodule offers merge semantics instead of overwriting.

dset function (CommonJS)

✓ const { dset } = require('dset');

✗ const dset = require('dset');

While primarily an ESM-first library, a CommonJS bundle is available. Remember `dset` is a named export, even in CommonJS.

Demonstrates basic usage of `dset` to create new deep paths, overwrite non-object values (v3+), update array elements, and initialize arrays.

import { dset } from 'dset'; // Initialize with an existing object let myObject: Record<string, any> = { existingKey: 123, nested: { array: [10, 20], value: 'old' } }; console.log('Initial object:', JSON.stringify(myObject)); // Set a new deep value, creating intermediate objects as needed dset(myObject, 'foo.bar', 'hello world'); console.log('After setting foo.bar:', JSON.stringify(myObject)); // Overwrite an existing non-object value with a new nested structure (v3+ behavior) dset(myObject, 'existingKey.newProp', 456); console.log('After overwriting existingKey:', JSON.stringify(myObject)); // Update an array element by index dset(myObject, 'nested.array.1', 99); console.log('After updating array element:', JSON.stringify(myObject)); // Create a new array and populate it with objects using numeric path segments let anotherObject: Record<string, any> = {}; dset(anotherObject, 'items.0.id', 'a'); dset(anotherObject, 'items.1.id', 'b'); console.log('After creating array items:', JSON.stringify(anotherObject));

Debug

Known issues

breakingSince v3.0.0, `dset` now overwrites existing non-object values when setting a nested path, aligning with `lodash/set`. Previously, it would fail to write if an intermediate path segment was not an object.

fix

Review existing code for instances where `dset` targeted paths that might contain non-object values, as their structure will now be implicitly converted to an object to accommodate the new path.

affects: >=3.0.0

breakingAs of v3.0.0, the `dset` function is exported as a named export instead of a default export. This changes how it must be imported.

fix

Update import statements from `import dset from 'dset';` to `import { dset } from 'dset';`.

affects: >=3.0.0

breakingVersions between `1.0.0` and `2.0.1` (inclusive) are deprecated due to a prototype pollution vulnerability. This was patched in v2.1.0 and subsequent versions.

fix

Upgrade `dset` to version `2.1.0` or higher immediately to ensure protection against prototype pollution attacks.

affects: >=1.0.0 <2.1.0

gotchaThe main `dset` module forcibly writes and overwrites values at the specified key-path. The `dset/merge` submodule, however, merges new values into existing objects, which is distinct behavior.

fix

Choose the appropriate module (`dset` or `dset/merge`) based on whether you intend to replace or merge values at deep paths. Be explicit with your imports to avoid confusion.

affects: >=3.1.0

Errors

Common errors & fixes

TypeError: dset is not a function

Attempting to use `dset` with a default import style after v3.0.0, but it is now a named export.

fix

Change your import statement from `import dset from 'dset';` to `import { dset } from 'dset';`.

Cannot access 'dset/merge' exports outside of the module

Incorrect module resolution settings or outdated tooling not fully supporting Node.js `exports` field for conditional exports, particularly for subpath imports like `dset/merge`.

fix

Ensure your `tsconfig.json` (for TypeScript) and bundler configuration (`webpack.config.js`, `vite.config.js`, etc.) are up-to-date and correctly configured for modern module resolution, e.g., using `"moduleResolution": "bundler"` or `"nodenext"` in TypeScript.

Property '__proto__' cannot be set

Attempting to set a value to a JavaScript prototype property (`__proto__`, `constructor`, `prototype`). Although `dset` has built-in protections since v2.1.0, direct attempts to bypass or similar vulnerabilities could trigger this.

fix

Avoid using `__proto__`, `constructor`, or `prototype` as path segments for security reasons. Ensure your `dset` version is `2.1.0` or higher to benefit from built-in prototype pollution guards.

Upgrade

Version history

0.0.1latest on npm

Audit

Dependencies

No dependency data recorded yet.

Agent activity

8 hits · last 30 days

node

Resources

githubhttps://github.com/lukeed/dset ↗

packagehttps://www.npmjs.com/package/dset ↗