@bybrave/object-path2

Maintained, drop-in fork of object-path — access and set deep object properties by a string/array path (get, set, has, del, push, insert, empty, coalesce, ensureExists).

The original has been unmaintained since 2023 (last release 0.11.8), ships no ESM build, and has no bundled TypeScript types. This fork keeps the exact same API and behavior, byte-for-byte compatible with the original test suite, and adds what modern projects need.

npm install @bybrave/object-path2

Why this fork

| Improvement | Detail | |---|---| | Dual ESM + CJS | Native import and require from a single package via the exports map — no more ERR_REQUIRE_ESM / bundler workarounds | | Built-in TypeScript types | index.d.ts bundled — you no longer need a separate @types/object-path install | | Zero dependencies | No runtime deps, nothing transitive to audit | | Bug fix — set through a null node (#97 / #94) | set({a: null}, 'a.b', 'c') now rebuilds the container instead of throwing Cannot set property 'b' of null | | Modern tooling | Node 18/20/22 CI, tests on node:test, prototype-pollution protection covered by an explicit CVE test |

Prototype-pollution protection (__proto__ / prototype / constructor) from upstream is preserved and covered by tests.

Compatibility

100% API-compatible with [email protected]. The fork passes the original upstream test suite unchanged (test/compat.js) plus its own tests. The only behavioral change is the set-through-null fix above, which lives in a case the original left as an unhandled throw.

Migration

Drop-in — just change the import specifier:

- const objectPath = require('object-path');
+ const objectPath = require('@bybrave/object-path2');

// ESM + TypeScript (types are bundled)
import objectPath, { get, set } from '@bybrave/object-path2';

You can remove @types/object-path from your devDependencies.

Usage

import objectPath from '@bybrave/object-path2';

const obj = { a: { b: { c: 1 } }, list: [1, 2, 3] };

objectPath.get(obj, 'a.b.c');            // => 1
objectPath.get(obj, 'a.b.x', 'default'); // => 'default'
objectPath.set(obj, 'a.b.d', 2);         // sets obj.a.b.d = 2
objectPath.has(obj, 'a.b.c');            // => true
objectPath.push(obj, 'list', 4);         // list => [1,2,3,4]
objectPath.del(obj, 'a.b.c');            // removes obj.a.b.c

// bound mode — object is pre-bound
const op = objectPath(obj);
op.get('a.b.d');                         // => 2

// inherited-props / security variants
objectPath.withInheritedProps.get(obj, 'a.b.c');
const custom = objectPath.create({ includeInheritedProps: true });

All methods accept the path as a dotted string ('a.b.c'), a number, or an array of segments (['a', 'b', 'c']).

Support

If this package saves you time, you can support maintenance:

Bitcoin (BTC): bc1q37557q5jpeaxqydzwvf3jgj7zhnfpn2td3q40q

License

MIT © 2015 Mario Casciaro (original object-path), © 2026 bybrave (fork). See LICENSE.