GeezerVison

Summary

The recursive _.merge helper in @feathersjs/commons iterates Object.keys(source). When the source came from JSON.parse('{"__proto__":...}'), __proto__ is returned as an own-enumerable key, so the recursive call resolves target['__proto__'] to Object.prototype and writes onto it.

This adds the standard guard to skip __proto__, constructor, and prototype keys during iteration.

Changes

• src/index.ts: skip the three prototype-mutating keys in the merge loop.
• test/utils.test.ts: regression test confirming a JSON-parsed __proto__/constructor.prototype source no longer mutates Object.prototype, fresh objects, or the target.

Notes

• No public API change — merge still works for all documented input shapes.
• Reported by Andrew Ridings (@ridingsa). Reimplemented here as a maintainer commit (supersedes fix(commons): skip __proto__ / constructor / prototype keys in _.merge #3687) so the change lands under a reviewed, verified commit.

Reported-by: Andrew Ridings (@ridingsa)