Bump 0.30.7

Patched prototype pollution
2026-08-17 14:56:41 -04:00 · 2026-08-17 14:56:18 -04:00
2 changed files with 357 additions and 355 deletions
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
 {
 	"name": "@ztimson/utils",
-	"version": "0.30.6",
+	"version": "0.30.7",
 	"description": "Utility library",
 	"author": "Zak Timson",
 	"license": "MIT",
--- a/src/objects.ts
+++ b/src/objects.ts
@@ -97,8 +97,10 @@ export function deepCopy<T>(value: T): T {
 * @return {any} The des
 */
 export function deepMerge<T>(target: any, ...sources: any[]): T {
+	const BLOCKED = new Set(['__proto__', 'constructor', 'prototype']);
 	sources.forEach(s => {
 		for(const key in s) {
+			if(BLOCKED.has(key) || !Object.prototype.hasOwnProperty.call(s, key)) continue;
 			if(s[key] && typeof s[key] == 'object' && !Array.isArray(s[key])) {
 				if(!target[key]) target[key] = {};
 				deepMerge(target[key], s[key]);
Author	SHA1	Message	Date
Zakary Timson	92f36fdb5b	Bump 0.30.7 All checks were successful Build / Publish Docs (push) Successful in 54s Details Build / Build NPM Project (push) Successful in 34s Details Build / Tag Version (push) Successful in 9s Details	2026-08-17 14:56:41 -04:00
Zakary Timson	721fe2dcf8	Patched prototype pollution Some checks failed Build / Tag Version (push) Has been cancelled Details Build / Build NPM Project (push) Has been cancelled Details Build / Publish Docs (push) Has been cancelled Details	2026-08-17 14:56:18 -04:00