defu is a lightweight Node.js utility for assigning default properties recursively, where leftmost arguments take priority. It supports custom merging strategies (createDefu), special handling for function defaults (defuFn and defuArrayFn), and concatenation of array values when defaults define arrays.
Project status
- Actively maintained: There is a very recent upstream push on 2026-09-09, and the most recent published updates are versioned in 2026 (latest shown is v6.1.7 on 2026-04-07), suggesting the project is actively worked on rather than dormant.
- Update cadence: Updates appear to have clustered in early April 2026 (v6.1.6 on 2026-04-01, v6.1.5 on 2026-04-01, v6.1.7 on 2026-04-07), and then no additional tagged updates are shown until that 2026-09-09 upstream push (about a 5-month gap between the last listed update and today).
AI summary generated
Recent updates
v6.1.7
v6.1.7 is primarily a TypeScript typing and packaging fix. It updates the published `types` entry in `package.json` and adjusts the `defuProxy` declaration to correctly export Defu-related types.
Breakingv6.1.6
v6.1.6 is labeled as a build-only change, specifically a fix for mixed TypeScript types. The code diff shows no runtime logic changes, but it does adjust how TypeScript declaration files are exposed for both ESM and CommonJS consumers.
v6.1.5
v6.1.5 focuses on hardening defu against prototype pollution and improving how it handles enumerable properties from objects. The release notes document protections against `__proto__` pollution in defaults and ignoring inherited enumerable properties, with corresponding test additions.
Securityv6.1.4
v6.1.4 primarily refactors the internal plain-object detection utility and fixes default-merging behavior when the inputs are ESM Module namespace objects. The release notes describe the Module merge fix, and the code diff confirms this change via an updated `isPlainObject` implementation.
v6.1.3
v6.1.3 primarily changes how defu performs deep merges, it will only recursively merge plain objects. It also adds a CommonJS entry wrapper to improve compatibility for require() consumers.
Breakingv6.0.0
v6.0.0 of defu introduces documented breaking changes around named exports and how array values are concatenated when applying defaults. The code also shows additional build and packaging changes (switching toolchains and entrypoints) that are not mentioned in the release notes.
BreakingFeaturesv5.0.0
defu v5.0.0 extends the existing null-skipping behavior to also bypass undefined values from the source object during the merge. This change is reflected in both the runtime merge loop and the TypeScript type-level merge logic, and it updates README and the changelog accordingly.
BreakingFeaturesv4.0.0
v4.0.0 primarily introduces a new module export strategy for the package. The code diff shows explicit Node/ESM entrypoints via the package.json exports field, alongside a change in build tooling from bili to siroc.
BreakingFeaturesv3.2.2
Release v3.2.2 is described as a bug fix that restores ES5 support by switching the build pipeline back from siroc to bili. The diff shows the project build command and related dev dependencies were changed, along with a large lockfile update.
v3.2.1
v3.2.1 is a small release focused on TypeScript type inference correctness. The release notes describe a fix for merged types when the destination and defaults are the same.