Secure merge. Familiar contract.

@stackline/deepmerge

Immutable deep merge with prototype-pollution defenses, cycles, resource limits, accurate types, and zero runtime dependencies.

npm install @stackline/deepmerge

v1.0.0 Node 14.17+ TypeScript 3.9-7.0

Runs the production bundle

Merge playground

Preset

Unsafe keys

Max depth Max keys

JSON

JSON

Ready 0.000 ms Object.prototype unchanged

Lowest-change adoption

Install through an npm alias and code that imports deepmerge continues to work.

npm uninstall deepmerge
npm install deepmerge@npm:@stackline/deepmerge

import merge from 'deepmerge';

const config = merge(defaults, environment);

Public contract

Full reference

Export	Purpose	Available in
`merge(target, source, options?)`	Immutable recursive merge	ESM, CJS, browser
`merge.all(objects, options?)`	Merge a list from left to right	ESM, CJS, browser
`isMergeableObject(value)`	Default traversal predicate	Named and static export
`UnsafeKeyError`	Strict unsafe-key rejection	Named and static export
`DeepMergeLimitError`	Depth or key budget exceeded	Named and static export

Release evidence