{"id":14687,"library":"lodash._topath","title":"Lodash toPath Internal Utility","description":"This package, `lodash._topath`, provides the internal `toPath` utility function from Lodash, specifically from its v3 branch. It is designed to convert various input values into a normalized array of path segments, which is crucial for higher-order Lodash functions like `_.get`, `_.set`, or `_.has` that operate on deeply nested object properties using string paths. While historically published as a standalone module for granular consumption, its direct use is generally discouraged in modern applications in favor of accessing equivalent path resolution functionality directly from the main `lodash` package or `lodash-es` (v4+), where `toPath` serves as an internal helper. The current stable version provided by this specific package is `3.8.1`. The parent Lodash project, from which this utility originates, follows semantic versioning and has an active, though somewhat infrequent for major versions, release cadence. Key differentiators of `toPath` include its robust handling of complex path syntax, such as dot notation, bracket notation for array indices or properties with special characters, and direct array inputs, providing a consistent and reliable way to abstract property access.","status":"maintenance","version":"3.8.1","language":"javascript","source_language":"en","source_url":"https://github.com/lodash/lodash","tags":["javascript"],"install":[{"cmd":"npm install lodash._topath","lang":"bash","label":"npm"},{"cmd":"yarn add lodash._topath","lang":"bash","label":"yarn"},{"cmd":"pnpm add lodash._topath","lang":"bash","label":"pnpm"}],"dependencies":[],"imports":[{"note":"This `lodash._topath` package (v3.x) is CommonJS-only and provides the internal `toPath` utility from Lodash v3. Attempting to use ES module `import` syntax will result in a runtime error.","wrong":"import toPath from 'lodash._topath';","symbol":"toPath","correct":"const toPath = require('lodash._topath');"},{"note":"In Lodash v4+, `toPath` is primarily an internal utility. It is not directly exported from the main `lodash` or `lodash-es` packages. Developers typically use public functions like `_.get`, `_.set`, or `_.has` which internally leverage path parsing logic similar to `toPath`.","wrong":"import { toPath } from 'lodash';","symbol":"toPath (via main Lodash)","correct":"import { get } from 'lodash';"},{"note":"This package does not export dedicated TypeScript types for `toPath`. The function expects a string or an array of path segments. You may need to declare a local type alias for clarity if using TypeScript with this specific (v3.x) package.","symbol":"toPath (TypeScript types)","correct":"type Path = string | Array<string | number | symbol>;"}],"quickstart":{"code":"const toPath = require('lodash._topath');\n\n// Example 1: Basic string path\nconst path1 = 'user.address.street';\nconsole.log(`Path \"${path1}\" parsed:`, toPath(path1));\n// Expected: [ 'user', 'address', 'street' ]\n\n// Example 2: Path with array index\nconst path2 = 'data.items[0].name';\nconsole.log(`Path \"${path2}\" parsed:`, toPath(path2));\n// Expected: [ 'data', 'items', '0', 'name' ]\n\n// Example 3: Path with mixed notation and special characters\nconst path3 = 'config[\"api-keys\"][1].secret';\nconsole.log(`Path \"${path3}\" parsed:`, toPath(path3));\n// Expected: [ 'config', 'api-keys', '1', 'secret' ]\n\n// Example 4: Already an array (should return itself)\nconst path4 = ['config', 'version'];\nconsole.log(`Path ${JSON.stringify(path4)} parsed:`, toPath(path4));\n// Expected: [ 'config', 'version' ]\n\n// Example 5: Non-string, non-array input (should convert to string then path)\nconst path5 = Symbol('id');\nconsole.log(`Path ${String(path5)} parsed:`, toPath(path5));\n// Expected: [ 'Symbol(id)' ]","lang":"javascript","description":"Demonstrates how to use `lodash._topath` to parse various string and array representations of object paths into an array of segments, showcasing its handling of dot and bracket notation for robust property access."},"warnings":[{"fix":"For new projects or migrations to Lodash v4+, prefer using the path resolution inherent in functions like `_.get`, `_.set`, or `_.has` from the main `lodash` or `lodash-es` packages. Avoid direct use of this internal v3.x package unless specifically required for legacy compatibility.","message":"This `lodash._topath` package is based on Lodash v3.x. When migrating projects to Lodash v4.0.0 or later, be aware that many core Lodash APIs and internal behaviors changed. Relying on `lodash._topath` directly in a Lodash v4+ environment may lead to unexpected behavior or redundancy, as `toPath` is primarily an internal utility in modern Lodash.","severity":"breaking","affected_versions":">=4.0.0 (for main lodash)"},{"fix":"Always use CommonJS `require()` syntax: `const toPath = require('lodash._topath');`.","message":"The `lodash._topath` package (v3.x) is distributed as CommonJS. Attempting to use ES module `import` syntax (`import toPath from 'lodash._topath';`) will result in a runtime error.","severity":"gotcha","affected_versions":"all"},{"fix":"If you need robust path parsing, consider using a dedicated path utility library or extracting the logic if you understand the implications. Otherwise, rely on the pathing provided by public Lodash methods like `_.get`, `_.set`, etc.","message":"`lodash._topath` is an internal utility, originally published separately for modularity in Lodash v3. Direct reliance on internal modules is generally discouraged as their API surface or existence may change without adhering to semantic versioning for external consumers. In modern Lodash (v4+), `toPath` is strictly an internal helper.","severity":"gotcha","affected_versions":"all"},{"fix":"Ensure any functions consuming paths (e.g., `_.unset`, `_.omit`) are from patched versions of `lodash` (v4.18.1 or higher) to mitigate prototype pollution risks. This particular `lodash._topath` package is not directly affected, but its output could be used in a vulnerable context.","message":"While this specific package (`lodash._topath` v3.x) does not directly manipulate objects, users should be aware of a prototype pollution vulnerability (GHSA-f23m-r3pf-42rh) in `lodash` v4.18.0 concerning `_.unset` and `_.omit`. If paths generated by this (or any) `toPath` utility are subsequently used with vulnerable versions of `_.unset` or `_.omit` from the main `lodash` library, it could lead to security issues.","severity":"gotcha","affected_versions":">=4.18.0 (for main lodash)"}],"env_vars":null,"last_verified":"2026-04-19T00:00:00.000Z","next_check":"2026-07-18T00:00:00.000Z","problems":[{"fix":"For `lodash._topath` (v3.x), always use `const toPath = require('lodash._topath');`. Ensure your environment supports CommonJS or configure transpilation correctly if mixing module types.","cause":"Attempting to use ES module `import` syntax for `lodash._topath` (a CommonJS package) or using `require` in an ES module without proper configuration.","error":"SyntaxError: Unexpected token 'export' (or similar 'require is not defined')"},{"fix":"Rely on public Lodash functions like `_.get`, `_.set`, `_.has` which internally handle path parsing. If you specifically need the `toPath` logic and are using Lodash v3.x, use `require('lodash._topath')`.","cause":"The `toPath` function is an internal utility in modern Lodash (v4+) and is not directly exported from the main `lodash` or `lodash-es` packages.","error":"SyntaxError: The requested module 'lodash' does not provide an export named 'toPath' (or similar for CommonJS)"}],"ecosystem":"npm"}