secure-json-parse provides a JSON.parse() drop-in replacement that protects against prototype poisoning by handling special keys like __proto__ and constructor.prototype during parsing. It is useful when you need safer JSON parsing in Node.js, with options to throw an error, remove those keys, ignore validation, or return null in “safe” mode.
Project status
- The repository appears actively developed, with an upstream push on 2026-08-06, but the most recently summarized tagged update was v4.1.0 on 2025-10-05, so public version updates have a long gap (roughly 10 months) relative to today (2026-08-12).
- Update cadence looks inconsistent: minor/maintenance-focused updates did ship in 2025 (v3.0.2 in Jan, v4.0.0 in Mar, v4.1.0 in Oct), yet there has been no newly summarized version since v4.1.0 despite the recent upstream activity.
AI summary generated
Recent updates
v4.1.0
v4.1.0 is primarily a maintenance release focused on CI workflow hardening and dependency bumps. In the library code, it improves handling of `constructor: null` during prototype-poisoning checks and adds (or exposes) a `safe` option in the public types and documentation.
v4.0.0
v4.0.0 includes a behavior change to secure-json-parse's safeParse error handling, switching from returning null to returning undefined. The release also updates project and CI hygiene, including renaming master to main, adjusting the CI node matrix to only run on Node 20 and 22, and reducing Dependabot update frequency.
Breakingv3.0.2
v3.0.2 is primarily a development and tooling release. It bumps dev dependencies (airtap and neostandard), updates linting from standard to neostandard (via eslint), and applies small cleanup refactors in tests and benchmarks, along with README badge and wording tweaks.
Featuresv3.0.1
v3.0.1 primarily performs formatting cleanup by removing trailing whitespace. The diff also includes the expected package version bump from 3.0.0 to 3.0.1, with no functional code changes apparent.
v3.0.0
v3.0.0 primarily updates CI configuration (GitHub Actions versions, test matrix coverage, Playwright install), plus adds a TypeScript overload for sjson.parse. The code diff is small in runtime logic, but several TypeScript and project metadata changes were made alongside dependency/dev-tooling bumps.
Featuresv2.7.0
v2.7.0 updates secure-json-parse with a dependency bump (tsd) and a performance improvement focused on the JSON.parse error path. The code change introduces a wrapper around the internal parse implementation to temporarily adjust Error.stackTraceLimit during parsing.
v2.6.0
v2.6.0 updates development tooling (tsd and CI workflow), removes the Snyk badge from the README, and includes a change labeled as NodeNext compatibility. The release notes do not mention any user-facing API or TypeScript surface changes.
v2.5.0
v2.5.0 is primarily a tooling and CI update release, plus some changes around parsing and safe parsing behavior. In the actual code, the sanitization logic was refactored so that `parse()` delegates to a new internal `filter()` function that can return `null` in a “safe” mode, and `scan()` is now exported as that same filter and returns a value instead of `void`.
v2.4.0
Release v2.4.0 primarily introduces TypeScript typings for secure-json-parse, adding an index.d.ts file with exported types and function signatures. Alongside the typings, the project updates its test tooling to run TypeScript definition checks (tsd) and adjusts the GitHub Actions Node.js test matrix.
Featuresv2.3.2
v2.3.2 changes prototype-poisoning handling so that the library only throws or removes a user-controlled constructor property when it specifically contains its own prototype child. The updated behavior is covered by new tests and README wording. Most other changes in this release are CI and repository housekeeping.
Breaking