chore(deps): update dependency defu to v6 [security]

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
defu	^3.2.2 → ^6.0.0

GitHub Vulnerability Alerts

CVE-2026-35209

Impact

Applications that pass unsanitized user input (e.g. parsed JSON request bodies, database records, or config files from untrusted sources) as the first argument to defu() are vulnerable to prototype pollution.

A crafted payload containing a __proto__ key can override intended default values in the merged result:

import { defu } from 'defu'

const userInput = JSON.parse('{"__proto__":{"isAdmin":true}}')
const config = defu(userInput, { isAdmin: false })

config.isAdmin // true — attacker overrides the server default

Root Cause

The internal _defu function used Object.assign({}, defaults) to copy the defaults object. Object.assign invokes the __proto__ setter, which replaces the resulting object's [[Prototype]] with attacker-controlled values. Properties inherited from the polluted prototype then bypass the existing __proto__ key guard in the for...in loop and land in the final result.

Fix

Replace Object.assign({}, defaults) with object spread ({ ...defaults }), which uses [[DefineOwnProperty]] and does not invoke the __proto__ setter.

Affected Versions

<= 6.1.4

Credits

Reported by @​BlackHatExploitation

---

Release Notes

unjs/defu (defu)

v6.1.5

Compare Source

compare changes

🩹 Fixes

• Prevent prototype pollution via __proto__ in defaults (#​156)
• Ignore inherited enumerable properties (11ba022)

🏡 Chore

• Add tea.yaml (70cffe5)
• Update repo (23cc432)
• Fix typecheck (89df6bb)

✅ Tests

• Add more tests for plain objects (b65f603)

🤖 CI

• Bump node (9237d9c)

❤️ Contributors

• Pooya Parsa (@​pi0)
• Kricsleo (@​kricsleo)

v6.1.4

Compare Source

compare changes

🩹 Fixes

• Merge objects with Module type (#​121)

💅 Refactors

• Move isPlainObject to _utils to allow testing (e922a16)
• Make isPlainObject logic more readable (e458b63)

📖 Documentation

• Fix typo (#​116)

🏡 Chore

• release: V6.1.3 (3834ca1)
• Update deps and lint (e5a48d3)
• Enable skipLipCheck for type tests (7c7a9a4)

✅ Tests

• Improve tests for isPlainObject (b24a213)

❤️ Contributors

• Alexander Lichter (@​manniL)
• Pooya Parsa (@​pi0)
• Yu Le is.yuler@gmail.com

v6.1.3

Compare Source

compare changes

🩹 Fixes

• Only merge plain objects (#​111)

📖 Documentation

• Update badges (581dd92)
• Fix typo (#​96)
• Fix the result of the array merging (#​99)
• Fix typo (#​107)

📦 Build

• Backward compatible cjs entry (#​110)

🏡 Chore

• Update dependencies (63d0e8e)
• Enable ts strict mode (82d68c7)
• Fix tests (59d0f6a)

🎨 Styles

• Format with prettier v3 (32650f1)

❤️ Contributors

• Pooya Parsa (@​pi0)
• Abdul Al-Hasany info@kalimah-apps.com
• Kricsleo
• Donald Shtjefni (@​dnldsht)
• Sébastien Chopin seb@nuxtjs.com

v6.1.2

Compare Source

compare changes

🩹 Fixes

• Add node16 compatible type declaration (#​73)

🏡 Chore

• Fix renovate config (#​56)
• Use changelogen to release (5e24124)

🎨 Styles

• Format with prettier (26477ed)

❤️ Contributors

• Pooya Parsa pooya@pi0.io
• Daniel Roe daniel@roe.dev
• Nozomu Ikuta nick.0508.nick@gmail.com

6.1.1 (2022-11-14)

v6.1.1

Compare Source

v6.1.0

Compare Source

Features

• export Defu type helper (#​45) (551ae4c)

Bug Fixes

• types: constrain inferred types of Defu (3d3ea3e)

6.0.1 (2022-08-16)

Bug Fixes

• add typing to allow for non-objects input args (#​42) (1f3a701)
• merge object strings of many types (#​44) (c7226f9)

v6.0.1

Compare Source

Features

• export Defu type helper (#​45) (551ae4c)

Bug Fixes

• types: constrain inferred types of Defu (3d3ea3e)

6.0.1 (2022-08-16)

Bug Fixes

• add typing to allow for non-objects input args (#​42) (1f3a701)
• merge object strings of many types (#​44) (c7226f9)

v6.0.0

Compare Source

Features

• export Defu type helper (#​45) (551ae4c)

Bug Fixes

• types: constrain inferred types of Defu (3d3ea3e)

6.0.1 (2022-08-16)

Bug Fixes

• add typing to allow for non-objects input args (#​42) (1f3a701)
• merge object strings of many types (#​44) (c7226f9)

v5.0.1

Compare Source

⚠ BREAKING CHANGES

• Use named exports:

• import defu from 'defu' => import { defu } from 'defu'
• defu.fn => import { defuFn }
• defu.arrayFn => import { defuArrayFn }

• When merging input value with defaults with an array, order is reversed

Features

• concat array defaults to the last (f6df314)
• use named exports (4a8fc52)

Bug Fixes

• workaround for #​32 (7b1f284)

5.0.1 (2022-01-13)

v5.0.0

Compare Source

⚠ BREAKING CHANGES

• Use named exports:

• import defu from 'defu' => import { defu } from 'defu'
• defu.fn => import { defuFn }
• defu.arrayFn => import { defuArrayFn }

• When merging input value with defaults with an array, order is reversed

Features

• concat array defaults to the last (f6df314)
• use named exports (4a8fc52)

Bug Fixes

• workaround for #​32 (7b1f284)

5.0.1 (2022-01-13)

v4.0.1

Compare Source

⚠ BREAKING CHANGES

• undefined values will be bypassed and not consistent behavior with defaults-deep anymore.

Features

• skip nullish values from source (#​29) (076f10a)

4.0.1 (2021-04-23)

v4.0.0

Compare Source

⚠ BREAKING CHANGES

• undefined values will be bypassed and not consistent behavior with defaults-deep anymore.

Features

• skip nullish values from source (#​29) (076f10a)

4.0.1 (2021-04-23)

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • ""
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.