fix(deps): update dependency deepmerge-ts to v8 [security]

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
deepmerge-ts	^7.0.0 → ^8.0.0

---

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

---

DeepmergeTS has stack exhaustion when merging recursive object graphs

CVE-2026-40345 / GHSA-ggr8-5vv4-36mx

More information

Details

Summary

deepmerge() and deepmergeInto() can be crashed with a crafted recursive object graph. When both merged values contain self-references at the same property path, the library recurses until Node throws RangeError: Maximum call stack size exceeded.

Details

Record merging is implemented recursively. For each enumerable key, the library collects the values from every input object and immediately calls the same merge routine on that property.

There is no visited-object tracking, pair tracking, or cycle detection in that recursion. As a result, if two merged records both point back to themselves through the same key path, the merge logic keeps revisiting the same object pair forever.

This is reachable through the real public API:

• deepmerge(...)
• deepmergeCustom(...)(...)
• deepmergeInto(target, ...)
• deepmergeIntoCustom(...)(target, ...)

The issue only occurs when recursive object graphs are supplied. Plain JSON alone does not create this condition.

PoC

import { deepmerge, deepmergeInto } from "deepmerge-ts";

const left = {};
left.self = left;

const right = {};
right.self = right;

try {
  deepmerge(left, right);
} catch (error) {
  console.log(error.name, error.message);
  // Expected: the merge should reject or safely handle recursive input without exhausting the stack.
  // Vulnerable behavior: RangeError Maximum call stack size exceeded
}

const target = {};
target.self = target;

const source = {};
source.self = source;

try {
  deepmergeInto(target, source);
} catch (error) {
  console.log(error.name, error.message);
  // Expected: the merge should reject or safely handle recursive input without exhausting the stack.
  // Vulnerable behavior: RangeError Maximum call stack size exceeded
}

Impact

Applications that pass attacker-controlled recursive object graphs into these APIs can be forced into a synchronous crash path. In Node.js services, that can terminate request handling for the affected process or trigger repeated worker restarts until the malicious input is blocked.

Severity

• CVSS Score: 8.2 / 10 (High)
• Vector String: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

References

• https://github.com/RebeccaStevens/deepmerge-ts/security/advisories/GHSA-ggr8-5vv4-36mx
• https://github.com/RebeccaStevens/deepmerge-ts
• https://github.com/RebeccaStevens/deepmerge-ts/releases/tag/v8.0.0

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

---

Release Notes

RebeccaStevens/deepmerge-ts (deepmerge-ts)

v8.0.0

Compare Source

Bug Fixes

• stop deepmergeInto from leak-mutating nested input containers (2cd7824)

Code Refactoring

• rename mergeInfo system and align shorthand, add JSDoc examples (590ed9b)

Features

• add circular reference support, maxDepth option, and hierarchy tracking (#​707) (3984927)
• add deepmergeFastUnsafe and deepmergeIntoFastUnsafe entrypoints (#​708) (df9b11c)
• support deep map value merging (ac4bf7a), closes #​705

Performance Improvements

• add a dedicated fast path for merging 2 records (4dbcea7)
• avoid array reallocation when no undefined values exist (99f2241), closes #​696
• optimize array and set merging (8d435f9), closes #​698
• optimize map merging and remove dead code (14e1604), closes #​702
• optimize record key and type detection (fa85462), closes #​694
• reduce benchmark sample count so the bench fits in 512MB heap (66635e3)
• reduce type-level work and shortcut same-type merges (473a971)
• speed up the mergeUnknowns hot path (95b2964), closes #​699

BREAKING CHANGES

• deepmergeInto no longer leak-mutates input containers.
  Code that depended on inputs being merged into the target through alias
  must now pass copies explicitly. The documented 'update the target'
  behavior is preserved on the target itself.
• • DeepMergeMetaMetaData has been renamed to DeepMergeMergeInfo. Imports
    must be updated.

• The MetaDataUpdater callback's metaMeta parameter is now mergeInfo.
  Implementations must update the parameter name accordingly.
• The MM generic shorthand has been renamed to MI (e.g. in
  MetaDataUpdater<M, MI>).

• The DeepMergeIntoFunctionUtils type has been renamed to DeepMergeIntoUtils.
• Updates the internal calculation logic for mergeMaps and
  mergeMapsInto. Colliding keys will now be merged.

7.1.6 (2026-08-11)

Bug Fixes

• preserve known keys when merging objects with index signatures (#​692) (e86cd8c)

7.1.5 (2025-02-23)

Bug Fixes

• improve type merging of nested optional properties (#​530) (349fd14)

7.1.4 (2025-01-23)

Bug Fixes

• apply filtering to types when selecting a leaf node (#​526) (6d85163), closes #​524

7.1.3 (2024-10-08)

7.1.2 (2024-10-08)

Performance Improvements

• use more performant data structures (#​519) (a48f8c4)

7.1.1 (2024-10-04)

Performance Improvements

• add explicit return type to speed up types (8e1ff6d)

v7.1.6

Compare Source

Bug Fixes

• stop deepmergeInto from leak-mutating nested input containers (2cd7824)

Code Refactoring

• rename mergeInfo system and align shorthand, add JSDoc examples (590ed9b)

Features

• add circular reference support, maxDepth option, and hierarchy tracking (#​707) (3984927)
• add deepmergeFastUnsafe and deepmergeIntoFastUnsafe entrypoints (#​708) (df9b11c)
• support deep map value merging (ac4bf7a), closes #​705

Performance Improvements

• add a dedicated fast path for merging 2 records (4dbcea7)
• avoid array reallocation when no undefined values exist (99f2241), closes #​696
• optimize array and set merging (8d435f9), closes #​698
• optimize map merging and remove dead code (14e1604), closes #​702
• optimize record key and type detection (fa85462), closes #​694
• reduce benchmark sample count so the bench fits in 512MB heap (66635e3)
• reduce type-level work and shortcut same-type merges (473a971)
• speed up the mergeUnknowns hot path (95b2964), closes #​699

BREAKING CHANGES

• deepmergeInto no longer leak-mutates input containers.
  Code that depended on inputs being merged into the target through alias
  must now pass copies explicitly. The documented 'update the target'
  behavior is preserved on the target itself.
• • DeepMergeMetaMetaData has been renamed to DeepMergeMergeInfo. Imports
    must be updated.

• The MetaDataUpdater callback's metaMeta parameter is now mergeInfo.
  Implementations must update the parameter name accordingly.
• The MM generic shorthand has been renamed to MI (e.g. in
  MetaDataUpdater<M, MI>).

• The DeepMergeIntoFunctionUtils type has been renamed to DeepMergeIntoUtils.
• Updates the internal calculation logic for mergeMaps and
  mergeMapsInto. Colliding keys will now be merged.

7.1.6 (2026-08-11)

Bug Fixes

• preserve known keys when merging objects with index signatures (#​692) (e86cd8c)

7.1.5 (2025-02-23)

Bug Fixes

• improve type merging of nested optional properties (#​530) (349fd14)

7.1.4 (2025-01-23)

Bug Fixes

• apply filtering to types when selecting a leaf node (#​526) (6d85163), closes #​524

7.1.3 (2024-10-08)

7.1.2 (2024-10-08)

Performance Improvements

• use more performant data structures (#​519) (a48f8c4)

7.1.1 (2024-10-04)

Performance Improvements

• add explicit return type to speed up types (8e1ff6d)

v7.1.5

Compare Source

Bug Fixes

• improve type merging of nested optional properties (#​530) (349fd14)

v7.1.4

Compare Source

Bug Fixes

• apply filtering to types when selecting a leaf node (#​526) (6d85163), closes #​524

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.