neotraverse v1 is out. 🚀 5 million downloads a week. Zero dependencies. And the biggest release in its history. ~50 tree-shakeable helpers, ~5x faster than traverse, an adversarial security audit gated in CI, and a new core that walks 200,000-deep JSON without crashing. 🧵 neotraverse.puruvj.dev
Post
Object walkers are the classic home of prototype pollution, so I ran an adversarial audit (the kind where "looks safe" means keep digging). Found and fixed a JSON __proto__ injection AND a boxed-key bypass. Every finding has a regression test, gated in CI.
0 reposts1 like
And the new piece: neotraverse/safe. The default walk is recursive (fast, but overflows on deep input). /safe is iterative: it walks 200,000-deep trees that crash everything else. Lazy and copy-on-write too. Out now. Full story 👇 puruvj.dev/blog/neotrav...