GeezerVison

Summary

Backport of the Dove fix for GHSA-28xv-ph75-77wh / CVE-2026-54335 to Crow (Feathers 4.x).

The recursive _.merge helper in @feathersjs/commons iterates Object.keys(source). When the source came from JSON.parse('{"__proto__":...}'), __proto__ is returned as an own-enumerable key, so the recursive call resolves target['__proto__'] to Object.prototype and writes onto it.

This adds the standard guard to skip __proto__, constructor, and prototype keys during iteration — the same remediation as dove #3690 / @feathersjs/[email protected].

• Tell us about the problem your pull request is solving.
• Are there any open issues that are related to this?
• Is this PR dependent on PRs in other repos?

Related: #3690 (dove), #3687 (original report by @ridingsa), GHSA-28xv-ph75-77wh.

No dependency on other repos.

Changes

• packages/commons/src/utils.ts: skip the three prototype-mutating keys in the merge loop.
• packages/commons/test/utils.test.ts: regression test confirming a JSON-parsed __proto__ / constructor.prototype source no longer mutates Object.prototype.

Notes

• No public API change — merge still works for all documented input shapes.
• After merge, publish @feathersjs/[email protected] (and bump dependents as needed for the Crow release), then update GHSA-28xv-ph75-77wh with a Crow patched range (<= 4.5.19 → 4.5.20).

Reported-by: Andrew Ridings (@ridingsa)

Verification

cd packages/commons && npm test
# 53 passing