Post

neotraverse v1 is out. 🚀 5 million downloads a week. Zero dependencies. And the biggest release in its history. ~50 tree-shakeable helpers, ~5x faster than traverse, an adversarial security audit gated in CI, and a new core that walks 200,000-deep JSON without crashing. 🧵 neotraverse.puruvj.dev

{PuruVijay}.svelte

@puruvj.dev

If you last saw neotraverse at 0.6, it was a class: new Traverse(obj).map(...). 1.0 makes the functional API the default: ~50 standalone, tree-shakeable functions. clone, merge, diff/patch, deepEqual, $ref resolution, async. The whole toolbelt is ~5.8KB, and get alone is a rounding error.

11/6/26, 1:27 pm0 reposts2 likes

{PuruVijay}.svelte

@puruvj.dev

11 June

Hardening plus a rewrite usually cost performance. This time they bought it. ~4.96x faster than traverse on average. Up to 10x on clone. ~5.5x less memory per op, 6x+ on pure traversal. One context object per node, lazy paths, one write per key.

{PuruVijay}.svelte

@puruvj.dev

11 June

Object walkers are the classic home of prototype pollution, so I ran an adversarial audit (the kind where "looks safe" means keep digging). Found and fixed a JSON __proto__ injection AND a boxed-key bypass. Every finding has a regression test, gated in CI.

{PuruVijay}.svelte

@puruvj.dev

11 June

And the new piece: neotraverse/safe. The default walk is recursive (fast, but overflows on deep input). /safe is iterative: it walks 200,000-deep trees that crash everything else. Lazy and copy-on-write too. Out now. Full story 👇 puruvj.dev/blog/neotrav...