Post

neotraverse v1 is out. 🚀 5 million downloads a week. Zero dependencies. And the biggest release in its history. ~50 tree-shakeable helpers, ~5x faster than traverse, an adversarial security audit gated in CI, and a new core that walks 200,000-deep JSON without crashing. 🧵 neotraverse.puruvj.dev

If you last saw neotraverse at 0.6, it was a class: new Traverse(obj).map(...). 1.0 makes the functional API the default: ~50 standalone, tree-shakeable functions. clone, merge, diff/patch, deepEqual, $ref resolution, async. The whole toolbelt is ~5.8KB, and get alone is a rounding error.

Object walkers are the classic home of prototype pollution, so I ran an adversarial audit (the kind where "looks safe" means keep digging). Found and fixed a JSON __proto__ injection AND a boxed-key bypass. Every finding has a regression test, gated in CI.