robinvdvleuten/shvl

🚧 Get and set dot-notated properties within an object.

shvl's Issues

does return obj[p] = obj[p] has some meaning?

I think return obj[p] || {} is already enough.

help

what's this pic mean ? i cant understand .

High Severity: Prototype Pollution in vulnerable module [email protected]

• shvl version: 2.0.1
• node version: 12.6.1
• npm (or yarn) version: 6.13.4

Problem description:
Snyk reported recently about High Severity: Prototype Pollution in vulnerable module [email protected] . The vuex-persistedstate project depends on shvl and therefore became listed as vulnerable primary dependency in our production project.
https://snyk.io/test/npm/shvl/2.0.1

Could you have a look and provide fix please?

Trying to get in touch regarding a security issue

Hi there,

I couldn't find a SECURITY.md in your repository and am not sure how to best contact you privately to disclose a security issue.

Can you add a SECURITY.md file with an e-mail to your repository, so that our system can send you the vulnerability details? GitHub suggests that a security policy is the best way to make sure security issues are responsibly disclosed.

Once you've done that, you should receive an e-mail within the next hour with more info.

Thanks! (cc @huntr-helper)

^1.3.0 Incompatibility

warning in ./node_modules/vuex-persistedstate/dist/vuex-persistedstate.es.js
1:395-396 "export 'default' (imported as 'e') was not found in 'shvl'

dacc1b8

Array is destructed

Hi, i thing that it should be mentioned in docs that if array is passed as variable it is destructed.

I had "fun" with that half hour until i found error in my code.

So please either make copy of array or mention it in docs.

Thank you.

const obj = {
  a: {
    b: {
      c: 5,
    },
  },
};
const path = ['a', 'b', 'c'];
set(obj, path, 6);
console.log(obj.a.b); // Object { c: 6 }
set(obj, path, 6);
console.log(obj.a.b); // 6