
Product
Introducing Repository Access Permissions and Custom Roles
Socket now supports Custom Roles and Repository Access Permissions so organizations can control who can access specific repositories and actions.
Assign default properties, recursively. Lightweight and Fast.
Install package:
# yarn
yarn add defu
# npm
npm install defu
# pnpm
pnpm install defu
import { defu } from "defu";
const options = defu(object, ...defaults);
Leftmost arguments have more priority when assigning defaults.
import { defu } from "defu";
console.log(defu({ a: { b: 2 } }, { a: { b: 1, c: 3 } }));
// => { a: { b: 2, c: 3 } }
const { defu } = require("defu");
Sometimes default merging strategy is not desirable. Using createDefu we can create a custom instance with different merging strategy.
This function accepts obj (source object), key and value (current value) and should return true if applied custom merging.
Example: Sum numbers instead of overriding
import { createDefu } from "defu";
const ext = createDefu((obj, key, value) => {
if (typeof obj[key] === "number" && typeof value === "number") {
obj[key] += value;
return true;
}
});
ext({ cost: 15 }, { cost: 10 }); // { cost: 25 }
Using defuFn, if user provided a function, it will be called with default value instead of merging.
It can be useful for default values manipulation.
Example: Filter some items from defaults (array) and add 20 to the count default value.
import { defuFn } from "defu";
defuFn(
{
ignore: (val) => val.filter((item) => item !== "dist"),
count: (count) => count + 20,
},
{
ignore: ["node_modules", "dist"],
count: 10,
},
);
/*
{
ignore: ['node_modules'],
count: 30
}
*/
Note: if the default value is not defined, the function defined won't be called and kept as value.
defuArrayFn is similar to defuFn but only applies to array values defined in defaults.
Example: Filter some items from defaults (array) and add 20 to the count default value.
import { defuArrayFn } from "defu";
defuArrayFn(
{
ignore: (val) => val.filter((i) => i !== "dist"),
count: () => 20,
},
{
ignore: ["node_modules", "dist"],
count: 10,
},
);
/*
{
ignore: ['node_modules'],
count: () => 20
}
*/
Note: the function is called only if the value defined in defaults is an aray.
object and defaults are not modifiednull and undefined) are skipped. Please use defaults-deep or omit-deep or lodash.defaultsdeep if you need to preserve or different behavior.__proto__ and constructor keys will be skipped to prevent security issues with object pollution.array values (if default property is defined)console.log(defu({ array: ["b", "c"] }, { array: ["a"] }));
// => { array: ['b', 'c', 'a'] }
We expose Defu as a type utility to return a merged type that follows the rules that defu follows.
import type { Defu } from 'defu'
type Options = Defu<{ foo: 'bar' }, [{}, { bar: 'baz' }, { something: 42 }]>
// returns { foo: 'bar', bar: 'baz', 'something': 42 }
MIT. Made with 💖
Lodash's merge function offers similar deep merging capabilities as defu. However, lodash is a much larger library with a wide range of utilities beyond object merging. While defu is focused and lightweight, lodash provides a comprehensive suite of tools that may be beneficial for projects needing more than just object merging.
Deepmerge is another npm package that specializes in merging objects deeply. Like defu, it is focused on this specific task, but it offers more customization options, such as array merging strategies and cloning. This makes deepmerge a more flexible choice for complex merging needs, though it might be slightly more complex to use than defu.
FAQs
Recursively assign default properties. Lightweight and Fast!
The npm package defu receives a total of 23,877,627 weekly downloads. As such, defu popularity was classified as popular.
We found that defu demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Product
Socket now supports Custom Roles and Repository Access Permissions so organizations can control who can access specific repositories and actions.

Product
Socket MCP now lets AI assistants review org alerts, investigate threats using the Socket threat feed, and inspect package files in addition to dependency scoring.

Product
Socket Firewall blocks malicious VS Code and Open VSX extensions before install, protecting developers from compromised editor marketplaces.