defu is a lightweight Node.js utility for assigning default properties recursively, where leftmost arguments take priority. It supports custom merging strategies (createDefu), special handling for function defaults (defuFn and defuArrayFn), and concatenation of array values when defaults define arrays.
Project status
- Actively maintained: The upstream repo has a very recent push (2026-06-07), and there were multiple
v6.1.xupdates in 2026 (most recentlyv6.1.7on 2026-04-07). - Update cadence (recent): After a long gap since
v6.1.4(2024-01-05), the project resumed more frequentv6.1updates in early April 2026 (v6.1.5,v6.1.6,v6.1.7over about a week), suggesting active ongoing maintenance.
AI summary generated Today
Recent updates
v6.1.7
2 months agov6.1.7 is primarily a TypeScript typing and packaging fix. It updates the published `types` entry in `package.json` and adjusts the `defuProxy` declaration to correctly export Defu-related types.
Breakingv6.1.6
2 months agov6.1.6 is labeled as a build-only change, specifically a fix for mixed TypeScript types. The code diff shows no runtime logic changes, but it does adjust how TypeScript declaration files are exposed for both ESM and CommonJS consumers.
v6.1.5
2 months agov6.1.5 focuses on hardening defu against prototype pollution and improving how it handles enumerable properties from objects. The release notes document protections against `__proto__` pollution in defaults and ignoring inherited enumerable properties, with corresponding test additions.
Securityv6.1.4
1/5/2024v6.1.4 primarily refactors the internal plain-object detection utility and fixes default-merging behavior when the inputs are ESM Module namespace objects. The release notes describe the Module merge fix, and the code diff confirms this change via an updated `isPlainObject` implementation.
v6.1.3
10/24/2023v6.1.3 primarily changes how defu performs deep merges, it will only recursively merge plain objects. It also adds a CommonJS entry wrapper to improve compatibility for require() consumers.
Breakingv6.0.0
3/21/2022v6.0.0 of defu introduces documented breaking changes around named exports and how array values are concatenated when applying defaults. The code also shows additional build and packaging changes (switching toolchains and entrypoints) that are not mentioned in the release notes.
BreakingFeaturesv5.0.0
5/12/2021defu v5.0.0 extends the existing null-skipping behavior to also bypass undefined values from the source object during the merge. This change is reflected in both the runtime merge loop and the TypeScript type-level merge logic, and it updates README and the changelog accordingly.
BreakingFeaturesv4.0.0
5/12/2021v4.0.0 primarily introduces a new module export strategy for the package. The code diff shows explicit Node/ESM entrypoints via the package.json exports field, alongside a change in build tooling from bili to siroc.
BreakingFeaturesv3.2.2
11/10/2020Release v3.2.2 is described as a bug fix that restores ES5 support by switching the build pipeline back from siroc to bili. The diff shows the project build command and related dev dependencies were changed, along with a large lockfile update.
v3.2.1
11/9/2020v3.2.1 is a small release focused on TypeScript type inference correctness. The release notes describe a fix for merged types when the destination and defaults are the same.