New version: 3.5.0.

Author: uhop

README.md

@@ -69,6 +69,7 @@ BSD-3-Clause
 
 ## Release History
 
+- 3.5.0 _New `maxDepth` option on path filters. Thx [ataberk.xyz](https://github.com/ataberk-xyz)._
 - 3.4.0 _Deprecated `stream-json/utils/{pipe,drain}` — use `stream-chain`'s generic helpers directly; the file-edge internals now delegate to `stream-chain`._
 - 3.3.0 _File I/O components (`parseFile`, `stringerToFile`, `verifyFile`), faithful JSONC comma round-trip (`streamCommas` / `useCommas`), JSONL delegated to `stream-chain`._
 - 3.2.0 _Improvements in TS typings, faster JSON parser._

llms-full.txt

@@ -397,6 +397,7 @@ All filters are built on `filterBase` and accept these common options:
   - **function** `(stack, chunk) => boolean` — custom matching logic.
 - `pathSeparator` (string, default: `'.'`) — separator for path matching.
 - `once` (boolean) — if true, stop filtering after the first match.
+- `maxDepth` (number, default: `1024`) — maximum JSON nesting depth to evaluate; a token nested deeper throws a `RangeError`. A guard for untrusted input with unbounded nesting. Pass `Infinity` to disable.
 - `streamKeys` (boolean) — control key streaming in output.
 
 Each filter ships in both substrates. The Node entry (`stream-json/filters/<name>.js`) has `asStream` and `asWebStream` plus `withParser`, `withParserAsStream`, and `withParserAsWebStream`. The Web entry (`stream-json/web/filters/<name>.js`) has `asWebStream` plus `withParser` and `withParserAsWebStream`, and pulls in no Node-stream imports.

llms.txt

@@ -118,7 +118,7 @@ e.addEventListener('keyValue', ev => console.log(ev.detail));
 
 ## Filters
 
-All filters accept `{filter, pathSeparator, once, streamKeys}` options. `filter` can be a string, RegExp, or `(stack, chunk) => boolean`.
+All filters accept `{filter, pathSeparator, once, streamKeys, maxDepth}` options. `filter` can be a string, RegExp, or `(stack, chunk) => boolean`. `maxDepth` caps the JSON nesting depth a filter evaluates (default `1024`; a deeper token throws a `RangeError`, `Infinity` disables the limit).
 
 - **`pick(options)`** — passes only matching subobjects, discards the rest.
 - **`replace(options)`** — replaces matching subobjects. Extra option: `replacement` (function, value, or array of tokens).

package-lock.json

@@ -1,6 +1,6 @@
 {
   "name": "stream-json",
-  "version": "3.4.0",
+  "version": "3.5.0",
   "description": "A micro-library of stream components for building custom JSON and JSONC processing pipelines with a minimal memory footprint — parse, filter, and transform JSON far larger than available memory with a SAX-inspired token API, on Node.js or Web Streams.",
   "type": "module",
   "main": "./src/index.js",
@@ -77,9 +77,9 @@
   },
   "devDependencies": {
     "@types/node": "^26.1.0",
-    "nano-benchmark": "^1.0.16",
-    "prettier": "^3.8.3",
-    "tape-six": "^1.10.1",
+    "nano-benchmark": "^1.1.0",
+    "prettier": "^3.9.4",
+    "tape-six": "^1.14.0",
     "tape-six-proc": "^1.3.1",
     "typescript": "^6.0.3"
   },