v1.1.0

1.1.0 (2026-11-09)

Features

• add a depth option (#12) (d549dd3)
• support bracket notation for object keys (a[key]) (#10) (930d438), closes #2

Bug Fixes

• prevent CPU exhaustion from large array indices (GHSA-27g4-8gfp-mm2j) (cd88e9e)
• recognize native File and Blob values on all runtimes (#8) (0dd0857)
• reject Object.prototype names with ForbiddenKeyError instead of DuplicateKeyError (#9) (d2244c0)
• remove Object.prototype names instead of throwing ForbiddenKeyError (#11) (607cf5e)
• set the name of the error classes (#13) (37580df)

Upgrade notes

Inputs that parsed before give the same result, except for these changes:

• Large array indices: an index above 4294967294 (for example a[4294967295]) throws the new InvalidPathError. Before, the value was dropped or parsing took minutes.
• Built-in property names: an entry with a name that exists on Object.prototype in its path (toString, valueOf, hasOwnProperty, …) is removed from the result. Before, it threw DuplicateKeyError.
• __proto__, constructor and prototype throw ForbiddenKeyError in every position. Before, some positions threw DuplicateKeyError.
• Bracket keys: a[key] is the same as a.key. Brackets that don't pair up stay in the key: a[0 is the key a[0, and a[[0] is the key [0 in a. Before, many of these paths threw DuplicateKeyError or produced keys like foo]. a[[0], a[.] and a[.0] gave an array before; now they are the keys [0, . and .0 in a.
• Error names: every error class sets name (for example 'DuplicateKeyError'), so String(error) and stack traces show the class name instead of Error.
• New exports: DepthLimitError, InvalidPathError. The new depth option defaults to Infinity, so nothing changes unless you set it. For untrusted input, depth: 32 is recommended.