Merging JSON objects: shallow overwrite versus recursive rules

Inspect a shallow overwrite

Object spread copies top-level properties. A later nested object replaces the earlier nested object rather than preserving its missing children.

The result below loses retries. Compare the objects with JSON Diff to make the missing field visible.

const base={network:{timeout:10,retries:3}};
const override={network:{timeout:20}};
({...base,...override}) → {network:{timeout:20}}

Define recursive behavior

A recursive merge might retain retries while changing timeout, but there is no single universal deep-merge rule.

Decide whether arrays concatenate, replace, or merge by identifier. Each choice changes data meaning and should have its own fixture.

Do not borrow deletion semantics accidentally

JSON Merge Patch gives null a deletion meaning for object members. A configuration format may instead need null as a stored value.

Use the Merge Patch tool only when that protocol is intended. Ordinary object spread retains a null value; it does not delete the property.

Test ownership and unexpected keys

Spread is also a shallow copy: nested values that were not replaced can share references with the original object.

For untrusted configuration, validate allowed keys and use a maintained merge implementation that handles prototype-related names safely. A text formatter cannot guarantee merge safety.