This is a Node.js implementation of JSON Pointer (RFC6901), providing functions to get and set values in JSON objects using pointer strings. It is useful for filtering, locating, and updating data fields from code (for example, using paths like /bar/baz).
Project status
- Active maintenance, yes on GitHub activity but unclear on npm updates: The upstream repo has an identifiable recent push on 2026-07-29, but the provided tagged updates stop at v5.0.1 (2022-07-13), so npm/package publishing appears infrequent.
- Apparent update cadence: After v5.0.0 (2021-11-12), the next known tagged update is v5.0.1 (2022-07-13), then there is a multi-year gap with no further tagged updates shown up to 2026-08-13.
AI summary generated
Recent updates
v5.0.1
v5.0.1 includes fixes related to JSON Pointer traversal when encountering null values, plus updates to the accompanying TypeScript typings and tests. While the release notes mention null traversal and typing corrections, the actual diff also shows return value behavior changes (null versus undefined) in several cases.
v5.0.0
v5.0.0 primarily hardens jsonpointer.set against prototype pollution and improves validation for array-form JSON pointers. The release notes describe returning the original, unmodified object when pointer segments include __proto__, constructor, or prototype, and throwing an error for invalid array pointer parts.
BreakingSecurityv4.1.0
v4.1.0 primarily addresses prototype pollution in JSON Pointer operations. The release notes mention this as a bug fix, but the code diff also includes additional changes such as new TypeScript typings, test and CI updates, and a notable package.json version change.
Security4.0.1
Release 4.0.1 is primarily a packaging change intended to reduce npm package size by whitelisting production files. The code diff provided does not include any runtime source changes, but the README shows an update to the documented return value for a missing JSON pointer path.
4.0.0
Version 4.0.0 updates jsonpointer.get/set semantics around missing and unset values. Missing paths now return undefined instead of null, and jsonpointer.set no longer deletes properties when given null; use undefined to delete/unset instead.
Breaking3.0.1
Version 3.0.1 refactors the jsonpointer implementation by splitting the generic traversal logic into dedicated getter (get) and setter (set) code paths. The release notes claim this improves readability and performance, but the refactor also changes several edge case behaviors around pointer compilation, escaping, and null handling.
3.0.0
Version 3.0.0 introduces a compiled pointer API (jsonpointer.compile) and adds support for setting nested properties, including appending to arrays via the '/-' token. The release also modernizes tooling with StandardJS linting and drops support for very old Node versions.
BreakingFeatures2.0.0
Version 2.0.0 primarily modernizes error handling, changing thrown values from strings to Error instances, and removes an unused console import. The diff also updates CI and package metadata to target newer Node.js versions than the previous release.
Breaking1.0.1
Version 1.0.1 was released on 2015-05-18, but the publisher did not provide any release notes. No specific changes, fixes, or compatibility updates can be determined from the provided information.
1.1.0
Release 1.1.0 contains no release notes from the publisher. The code changes in this diff substantially alter JSON Pointer parsing and lookup semantics, including how missing paths are handled and how pointer escaping is decoded.
BreakingFeatures