@cognigy/webchat 3.42.0 → 3.43.0

package/OSS_LICENSES.txt

@@ -1,4 +1,4 @@
-Created on 30-04-2026 at 06:59:50
+Created on 15-05-2026 at 12:21:32
 
 {
   "@babel/code-frame@7.29.0": {
@@ -170,7 +170,7 @@ Created on 30-04-2026 at 06:59:50
     "licenseFile": "node_modules/@cognigy/socket-client/LICENSE",
     "copyright": "Copyright (c) 2019 Cognigy GmbH"
   },
-  "@cognigy/webchat@3.42.0": {
+  "@cognigy/webchat@3.43.0": {
     "licenses": "MIT*",
     "repository": "https://github.com/Cognigy/Webchat",
     "publisher": "Cognigy GmbH",
@@ -528,7 +528,7 @@ Created on 30-04-2026 at 06:59:50
     "licenseFile": "node_modules/autolinker/LICENSE",
     "copyright": "Copyright (c) 2014 Gregory Jacobs (http://greg-jacobs.com)"
   },
-  "axios@1.15.0": {
+  "axios@1.15.2": {
     "licenses": "MIT",
     "repository": "https://github.com/axios/axios",
     "publisher": "Matt Zabriskie",

package/dist/webchat.esm.js

@@ -1,7 +1,7 @@
 /*!
- * webchat.esm.js v3.42.0
- * https://github.com/Cognigy/Webchat/tree/v3.42.0
- * https://github.com/Cognigy/Webchat/tree/v3.42.0/OSS_LICENSES.txt
+ * webchat.esm.js v3.43.0
+ * https://github.com/Cognigy/Webchat/tree/v3.43.0
+ * https://github.com/Cognigy/Webchat/tree/v3.43.0/OSS_LICENSES.txt
  */
 import * as __WEBPACK_EXTERNAL_MODULE_react__ from "react";
 import * as __WEBPACK_EXTERNAL_MODULE_react_dom_7dac9eee__ from "react-dom";
@@ -135860,16 +135860,18 @@ const factory = env => {
   const encodeText = isFetchSupported && (typeof TextEncoder === 'function' ? (encoder => str => encoder.encode(str))(new TextEncoder()) : async str => new Uint8Array(await new Request(str).arrayBuffer()));
   const supportsRequestStream = isRequestSupported && isReadableStreamSupported && test(() => {
     let duplexAccessed = false;
-    const body = new ReadableStream();
-    const hasContentType = new Request(_platform_index_js__WEBPACK_IMPORTED_MODULE_0__/* ["default"] */ .A.origin, {
-      body,
+    const request = new Request(_platform_index_js__WEBPACK_IMPORTED_MODULE_0__/* ["default"] */ .A.origin, {
+      body: new ReadableStream(),
       method: 'POST',
       get duplex() {
         duplexAccessed = true;
         return 'half';
       }
-    }).headers.has('Content-Type');
-    body.cancel();
+    });
+    const hasContentType = request.headers.has('Content-Type');
+    if (request.body != null) {
+      request.body.cancel();
+    }
     return duplexAccessed && !hasContentType;
   });
   const supportsResponseStream = isResponseSupported && isReadableStreamSupported && test(() => _utils_js__WEBPACK_IMPORTED_MODULE_1__/* ["default"] */ .A.isReadableStream(new Response('').body));
@@ -135961,6 +135963,15 @@ const factory = env => {
       // Cloudflare Workers throws when credentials are defined
       // see https://github.com/cloudflare/workerd/issues/902
       const isCredentialsSupported = isRequestSupported && 'credentials' in Request.prototype;
+
+      // If data is FormData and Content-Type is multipart/form-data without boundary,
+      // delete it so fetch can set it correctly with the boundary
+      if (_utils_js__WEBPACK_IMPORTED_MODULE_1__/* ["default"] */ .A.isFormData(data)) {
+        const contentType = headers.getContentType();
+        if (contentType && /^multipart\/form-data/i.test(contentType) && !/boundary=/i.test(contentType)) {
+          headers.delete('content-type');
+        }
+      }
       const resolvedOptions = {
         ...fetchOptions,
         signal: composedSignal,
@@ -136853,6 +136864,7 @@ AxiosError.ERR_BAD_REQUEST = 'ERR_BAD_REQUEST';
 AxiosError.ERR_CANCELED = 'ERR_CANCELED';
 AxiosError.ERR_NOT_SUPPORT = 'ERR_NOT_SUPPORT';
 AxiosError.ERR_INVALID_URL = 'ERR_INVALID_URL';
+AxiosError.ERR_FORM_DATA_DEPTH_EXCEEDED = 'ERR_FORM_DATA_DEPTH_EXCEEDED';
 /* harmony default export */ const __WEBPACK_DEFAULT_EXPORT__ = (AxiosError);
 
 /***/ },
@@ -136870,38 +136882,37 @@ AxiosError.ERR_INVALID_URL = 'ERR_INVALID_URL';
 
 
 const $internals = Symbol('internals');
-const isValidHeaderValue = value => !/[\r\n]/.test(value);
-function assertValidHeaderValue(value, header) {
-  if (value === false || value == null) {
-    return;
-  }
-  if (_utils_js__WEBPACK_IMPORTED_MODULE_0__/* ["default"] */ .A.isArray(value)) {
-    value.forEach(v => assertValidHeaderValue(v, header));
-    return;
+const INVALID_HEADER_VALUE_CHARS_RE = /[^\x09\x20-\x7E\x80-\xFF]/g;
+function trimSPorHTAB(str) {
+  let start = 0;
+  let end = str.length;
+  while (start < end) {
+    const code = str.charCodeAt(start);
+    if (code !== 0x09 && code !== 0x20) {
+      break;
+    }
+    start += 1;
   }
-  if (!isValidHeaderValue(String(value))) {
-    throw new Error(`Invalid character in header content ["${header}"]`);
+  while (end > start) {
+    const code = str.charCodeAt(end - 1);
+    if (code !== 0x09 && code !== 0x20) {
+      break;
+    }
+    end -= 1;
   }
+  return start === 0 && end === str.length ? str : str.slice(start, end);
 }
 function normalizeHeader(header) {
   return header && String(header).trim().toLowerCase();
 }
-function stripTrailingCRLF(str) {
-  let end = str.length;
-  while (end > 0) {
-    const charCode = str.charCodeAt(end - 1);
-    if (charCode !== 10 && charCode !== 13) {
-      break;
-    }
-    end -= 1;
-  }
-  return end === str.length ? str : str.slice(0, end);
+function sanitizeHeaderValue(str) {
+  return trimSPorHTAB(str.replace(INVALID_HEADER_VALUE_CHARS_RE, ''));
 }
 function normalizeValue(value) {
   if (value === false || value == null) {
     return value;
   }
-  return _utils_js__WEBPACK_IMPORTED_MODULE_0__/* ["default"] */ .A.isArray(value) ? value.map(normalizeValue) : stripTrailingCRLF(String(value));
+  return _utils_js__WEBPACK_IMPORTED_MODULE_0__/* ["default"] */ .A.isArray(value) ? value.map(normalizeValue) : sanitizeHeaderValue(String(value));
 }
 function parseTokens(str) {
   const tokens = Object.create(null);
@@ -136957,7 +136968,6 @@ class AxiosHeaders {
       }
       const key = _utils_js__WEBPACK_IMPORTED_MODULE_0__/* ["default"] */ .A.findKey(self, lHeader);
       if (!key || self[key] === undefined || _rewrite === true || _rewrite === undefined && self[key] !== false) {
-        assertValidHeaderValue(_value, _header);
         self[key || _header] = normalizeValue(_value);
       }
     }
@@ -137235,7 +137245,7 @@ class InterceptorManager {
  */
 function buildFullPath(baseURL, requestedURL, allowAbsoluteUrls) {
   let isRelativeUrl = !(0,_helpers_isAbsoluteURL_js__WEBPACK_IMPORTED_MODULE_0__/* ["default"] */ .A)(requestedURL);
-  if (baseURL && (isRelativeUrl || allowAbsoluteUrls == false)) {
+  if (baseURL && (isRelativeUrl || allowAbsoluteUrls === false)) {
     return (0,_helpers_combineURLs_js__WEBPACK_IMPORTED_MODULE_1__/* ["default"] */ .A)(baseURL, requestedURL);
   }
   return requestedURL;
@@ -137348,7 +137358,18 @@ const headersToObject = thing => thing instanceof _AxiosHeaders_js__WEBPACK_IMPO
 function mergeConfig(config1, config2) {
   // eslint-disable-next-line no-param-reassign
   config2 = config2 || {};
-  const config = {};
+
+  // Use a null-prototype object so that downstream reads such as `config.auth`
+  // or `config.baseURL` cannot inherit polluted values from Object.prototype
+  // (see GHSA-q8qp-cvcw-x6jj). `hasOwnProperty` is restored as a non-enumerable
+  // own slot to preserve ergonomics for user code that relies on it.
+  const config = Object.create(null);
+  Object.defineProperty(config, 'hasOwnProperty', {
+    value: Object.prototype.hasOwnProperty,
+    enumerable: false,
+    writable: true,
+    configurable: true
+  });
   function getMergedValue(target, source, prop, caseless) {
     if (_utils_js__WEBPACK_IMPORTED_MODULE_0__/* ["default"] */ .A.isPlainObject(target) && _utils_js__WEBPACK_IMPORTED_MODULE_0__/* ["default"] */ .A.isPlainObject(source)) {
       return _utils_js__WEBPACK_IMPORTED_MODULE_0__/* ["default"] */ .A.merge.call({
@@ -137387,9 +137408,9 @@ function mergeConfig(config1, config2) {
 
   // eslint-disable-next-line consistent-return
   function mergeDirectKeys(a, b, prop) {
-    if (prop in config2) {
+    if (_utils_js__WEBPACK_IMPORTED_MODULE_0__/* ["default"] */ .A.hasOwnProp(config2, prop)) {
       return getMergedValue(a, b);
-    } else if (prop in config1) {
+    } else if (_utils_js__WEBPACK_IMPORTED_MODULE_0__/* ["default"] */ .A.hasOwnProp(config1, prop)) {
       return getMergedValue(undefined, a);
     }
   }
@@ -137420,6 +137441,7 @@ function mergeConfig(config1, config2) {
     httpsAgent: defaultToConfig2,
     cancelToken: defaultToConfig2,
     socketPath: defaultToConfig2,
+    allowedSocketPaths: defaultToConfig2,
     responseEncoding: defaultToConfig2,
     validateStatus: mergeDirectKeys,
     headers: (a, b, prop) => mergeDeepProperties(headersToObject(a), headersToObject(b), prop, true)
@@ -137430,7 +137452,9 @@ function mergeConfig(config1, config2) {
   }), function computeConfigValue(prop) {
     if (prop === '__proto__' || prop === 'constructor' || prop === 'prototype') return;
     const merge = _utils_js__WEBPACK_IMPORTED_MODULE_0__/* ["default"] */ .A.hasOwnProp(mergeMap, prop) ? mergeMap[prop] : mergeDeepProperties;
-    const configValue = merge(config1[prop], config2[prop], prop);
+    const a = _utils_js__WEBPACK_IMPORTED_MODULE_0__/* ["default"] */ .A.hasOwnProp(config1, prop) ? config1[prop] : undefined;
+    const b = _utils_js__WEBPACK_IMPORTED_MODULE_0__/* ["default"] */ .A.hasOwnProp(config2, prop) ? config2[prop] : undefined;
+    const configValue = merge(a, b, prop);
     _utils_js__WEBPACK_IMPORTED_MODULE_0__/* ["default"] */ .A.isUndefined(configValue) && merge !== mergeDirectKeys || (config[prop] = configValue);
   });
   return config;
@@ -137528,6 +137552,7 @@ function transformData(fns, response) {
 
 
 
+const own = (obj, key) => obj != null && _utils_js__WEBPACK_IMPORTED_MODULE_0__/* ["default"] */ .A.hasOwnProp(obj, key) ? obj[key] : undefined;
 
 /**
  * It takes a string, tries to parse it, and if it fails, it returns the stringified version
@@ -137578,14 +137603,16 @@ const defaults = {
     }
     let isFileList;
     if (isObjectPayload) {
+      const formSerializer = own(this, 'formSerializer');
       if (contentType.indexOf('application/x-www-form-urlencoded') > -1) {
-        return (0,_helpers_toURLEncodedForm_js__WEBPACK_IMPORTED_MODULE_4__/* ["default"] */ .A)(data, this.formSerializer).toString();
+        return (0,_helpers_toURLEncodedForm_js__WEBPACK_IMPORTED_MODULE_4__/* ["default"] */ .A)(data, formSerializer).toString();
       }
       if ((isFileList = _utils_js__WEBPACK_IMPORTED_MODULE_0__/* ["default"] */ .A.isFileList(data)) || contentType.indexOf('multipart/form-data') > -1) {
-        const _FormData = this.env && this.env.FormData;
+        const env = own(this, 'env');
+        const _FormData = env && env.FormData;
         return (0,_helpers_toFormData_js__WEBPACK_IMPORTED_MODULE_3__/* ["default"] */ .A)(isFileList ? {
           'files[]': data
-        } : data, _FormData && new _FormData(), this.formSerializer);
+        } : data, _FormData && new _FormData(), formSerializer);
       }
     }
     if (isObjectPayload || hasJSONContentType) {
@@ -137595,21 +137622,22 @@ const defaults = {
     return data;
   }],
   transformResponse: [function transformResponse(data) {
-    const transitional = this.transitional || defaults.transitional;
+    const transitional = own(this, 'transitional') || defaults.transitional;
     const forcedJSONParsing = transitional && transitional.forcedJSONParsing;
-    const JSONRequested = this.responseType === 'json';
+    const responseType = own(this, 'responseType');
+    const JSONRequested = responseType === 'json';
     if (_utils_js__WEBPACK_IMPORTED_MODULE_0__/* ["default"] */ .A.isResponse(data) || _utils_js__WEBPACK_IMPORTED_MODULE_0__/* ["default"] */ .A.isReadableStream(data)) {
       return data;
     }
-    if (data && _utils_js__WEBPACK_IMPORTED_MODULE_0__/* ["default"] */ .A.isString(data) && (forcedJSONParsing && !this.responseType || JSONRequested)) {
+    if (data && _utils_js__WEBPACK_IMPORTED_MODULE_0__/* ["default"] */ .A.isString(data) && (forcedJSONParsing && !responseType || JSONRequested)) {
       const silentJSONParsing = transitional && transitional.silentJSONParsing;
       const strictJSONParsing = !silentJSONParsing && JSONRequested;
       try {
-        return JSON.parse(data, this.parseReviver);
+        return JSON.parse(data, own(this, 'parseReviver'));
       } catch (e) {
         if (strictJSONParsing) {
           if (e.name === 'SyntaxError') {
-            throw _core_AxiosError_js__WEBPACK_IMPORTED_MODULE_1__/* ["default"] */ .A.from(e, _core_AxiosError_js__WEBPACK_IMPORTED_MODULE_1__/* ["default"] */ .A.ERR_BAD_RESPONSE, this, null, this.response);
+            throw _core_AxiosError_js__WEBPACK_IMPORTED_MODULE_1__/* ["default"] */ .A.from(e, _core_AxiosError_js__WEBPACK_IMPORTED_MODULE_1__/* ["default"] */ .A.ERR_BAD_RESPONSE, this, null, own(this, 'response'));
           }
           throw e;
         }
@@ -137670,7 +137698,7 @@ _utils_js__WEBPACK_IMPORTED_MODULE_0__/* ["default"] */ .A.forEach(['delete', 'g
 /* harmony export */ __webpack_require__.d(__webpack_exports__, {
 /* harmony export */   x: () => (/* binding */ VERSION)
 /* harmony export */ });
-const VERSION = "1.15.0";
+const VERSION = "1.15.2";
 
 /***/ },
 
@@ -137700,10 +137728,9 @@ function encode(str) {
     '(': '%28',
     ')': '%29',
     '~': '%7E',
-    '%20': '+',
-    '%00': '\x00'
+    '%20': '+'
   };
-  return encodeURIComponent(str).replace(/[!'()~]|%20|%00/g, function replacer(match) {
+  return encodeURIComponent(str).replace(/[!'()~]|%20/g, function replacer(match) {
     return charMap[match];
   });
 }
@@ -138096,7 +138123,7 @@ function formDataToJSON(formData) {
     name = !name && _utils_js__WEBPACK_IMPORTED_MODULE_0__/* ["default"] */ .A.isArray(target) ? target.length : name;
     if (isLast) {
       if (_utils_js__WEBPACK_IMPORTED_MODULE_0__/* ["default"] */ .A.hasOwnProp(target, name)) {
-        target[name] = [target[name], value];
+        target[name] = _utils_js__WEBPACK_IMPORTED_MODULE_0__/* ["default"] */ .A.isArray(target[name]) ? target[name].concat(value) : [target[name], value];
       } else {
         target[name] = value;
       }
@@ -138291,19 +138318,19 @@ const progressEventReducer = (listener, isDownloadStream, freq = 3) => {
   let bytesNotified = 0;
   const _speedometer = (0,_speedometer_js__WEBPACK_IMPORTED_MODULE_0__/* ["default"] */ .A)(50, 250);
   return (0,_throttle_js__WEBPACK_IMPORTED_MODULE_1__/* ["default"] */ .A)(e => {
-    const loaded = e.loaded;
+    const rawLoaded = e.loaded;
     const total = e.lengthComputable ? e.total : undefined;
-    const progressBytes = loaded - bytesNotified;
+    const loaded = total != null ? Math.min(rawLoaded, total) : rawLoaded;
+    const progressBytes = Math.max(0, loaded - bytesNotified);
     const rate = _speedometer(progressBytes);
-    const inRange = loaded <= total;
-    bytesNotified = loaded;
+    bytesNotified = Math.max(bytesNotified, loaded);
     const data = {
       loaded,
       total,
       progress: total ? loaded / total : undefined,
       bytes: progressBytes,
       rate: rate ? rate : undefined,
-      estimated: rate && total && inRange ? (total - loaded) / rate : undefined,
+      estimated: rate && total ? (total - loaded) / rate : undefined,
       event: e,
       lengthComputable: total != null,
       [isDownloadStream ? 'download' : 'upload']: true
@@ -138347,16 +138374,21 @@ const asyncDecorator = fn => (...args) => _utils_js__WEBPACK_IMPORTED_MODULE_2__
 
 /* harmony default export */ const __WEBPACK_DEFAULT_EXPORT__ = (config => {
   const newConfig = (0,_core_mergeConfig_js__WEBPACK_IMPORTED_MODULE_5__/* ["default"] */ .A)({}, config);
-  let {
-    data,
-    withXSRFToken,
-    xsrfHeaderName,
-    xsrfCookieName,
-    headers,
-    auth
-  } = newConfig;
+
+  // Read only own properties to prevent prototype pollution gadgets
+  // (e.g. Object.prototype.baseURL = 'https://evil.com'). See GHSA-q8qp-cvcw-x6jj.
+  const own = key => _utils_js__WEBPACK_IMPORTED_MODULE_1__/* ["default"] */ .A.hasOwnProp(newConfig, key) ? newConfig[key] : undefined;
+  const data = own('data');
+  let withXSRFToken = own('withXSRFToken');
+  const xsrfHeaderName = own('xsrfHeaderName');
+  const xsrfCookieName = own('xsrfCookieName');
+  let headers = own('headers');
+  const auth = own('auth');
+  const baseURL = own('baseURL');
+  const allowAbsoluteUrls = own('allowAbsoluteUrls');
+  const url = own('url');
   newConfig.headers = headers = _core_AxiosHeaders_js__WEBPACK_IMPORTED_MODULE_6__/* ["default"] */ .A.from(headers);
-  newConfig.url = (0,_buildURL_js__WEBPACK_IMPORTED_MODULE_7__/* ["default"] */ .A)((0,_core_buildFullPath_js__WEBPACK_IMPORTED_MODULE_4__/* ["default"] */ .A)(newConfig.baseURL, newConfig.url, newConfig.allowAbsoluteUrls), config.params, config.paramsSerializer);
+  newConfig.url = (0,_buildURL_js__WEBPACK_IMPORTED_MODULE_7__/* ["default"] */ .A)((0,_core_buildFullPath_js__WEBPACK_IMPORTED_MODULE_4__/* ["default"] */ .A)(baseURL, url, allowAbsoluteUrls), config.params, config.paramsSerializer);
 
   // HTTP basic authentication
   if (auth) {
@@ -138383,9 +138415,15 @@ const asyncDecorator = fn => (...args) => _utils_js__WEBPACK_IMPORTED_MODULE_2__
   // Specifically not if we're in a web worker, or react-native.
 
   if (_platform_index_js__WEBPACK_IMPORTED_MODULE_0__/* ["default"] */ .A.hasStandardBrowserEnv) {
-    withXSRFToken && _utils_js__WEBPACK_IMPORTED_MODULE_1__/* ["default"] */ .A.isFunction(withXSRFToken) && (withXSRFToken = withXSRFToken(newConfig));
-    if (withXSRFToken || withXSRFToken !== false && (0,_isURLSameOrigin_js__WEBPACK_IMPORTED_MODULE_2__/* ["default"] */ .A)(newConfig.url)) {
-      // Add xsrf header
+    if (_utils_js__WEBPACK_IMPORTED_MODULE_1__/* ["default"] */ .A.isFunction(withXSRFToken)) {
+      withXSRFToken = withXSRFToken(newConfig);
+    }
+
+    // Strict boolean check — prevents proto-pollution gadgets (e.g. Object.prototype.withXSRFToken = 1)
+    // and misconfigurations (e.g. "false") from short-circuiting the same-origin check and leaking
+    // the XSRF token cross-origin. See GHSA-xx6v-rp6x-q39c.
+    const shouldSendXSRF = withXSRFToken === true || withXSRFToken == null && (0,_isURLSameOrigin_js__WEBPACK_IMPORTED_MODULE_2__/* ["default"] */ .A)(newConfig.url);
+    if (shouldSendXSRF) {
       const xsrfValue = xsrfHeaderName && xsrfCookieName && _cookies_js__WEBPACK_IMPORTED_MODULE_3__/* ["default"] */ .A.read(xsrfCookieName);
       if (xsrfValue) {
         headers.set(xsrfHeaderName, xsrfValue);
@@ -138650,6 +138688,7 @@ function toFormData(obj, formData, options) {
   const dots = options.dots;
   const indexes = options.indexes;
   const _Blob = options.Blob || typeof Blob !== 'undefined' && Blob;
+  const maxDepth = options.maxDepth === undefined ? 100 : options.maxDepth;
   const useBlob = _Blob && _utils_js__WEBPACK_IMPORTED_MODULE_0__/* ["default"] */ .A.isSpecCompliantForm(formData);
   if (!_utils_js__WEBPACK_IMPORTED_MODULE_0__/* ["default"] */ .A.isFunction(visitor)) {
     throw new TypeError('visitor must be a function');
@@ -138716,8 +138755,11 @@ function toFormData(obj, formData, options) {
     convertValue,
     isVisitable
   });
-  function build(value, path) {
+  function build(value, path, depth = 0) {
     if (_utils_js__WEBPACK_IMPORTED_MODULE_0__/* ["default"] */ .A.isUndefined(value)) return;
+    if (depth > maxDepth) {
+      throw new _core_AxiosError_js__WEBPACK_IMPORTED_MODULE_1__/* ["default"] */ .A('Object is too deeply nested (' + depth + ' levels). Max depth: ' + maxDepth, _core_AxiosError_js__WEBPACK_IMPORTED_MODULE_1__/* ["default"] */ .A.ERR_FORM_DATA_DEPTH_EXCEEDED);
+    }
     if (stack.indexOf(value) !== -1) {
       throw Error('Circular reference detected in ' + path.join('.'));
     }
@@ -138725,7 +138767,7 @@ function toFormData(obj, formData, options) {
     _utils_js__WEBPACK_IMPORTED_MODULE_0__/* ["default"] */ .A.forEach(value, function each(el, key) {
       const result = !(_utils_js__WEBPACK_IMPORTED_MODULE_0__/* ["default"] */ .A.isUndefined(el) || el === null) && visitor.call(formData, el, _utils_js__WEBPACK_IMPORTED_MODULE_0__/* ["default"] */ .A.isString(key) ? key.trim() : key, path, exposedHelpers);
       if (result === true) {
-        build(el, path ? path.concat(key) : [key]);
+        build(el, path ? path.concat(key) : [key], depth + 1);
       }
     });
     stack.pop();
@@ -138935,7 +138977,9 @@ function assertOptions(options, schema, allowUnknown) {
   let i = keys.length;
   while (i-- > 0) {
     const opt = keys[i];
-    const validator = schema[opt];
+    // Use hasOwnProperty so a polluted Object.prototype.<opt> cannot supply
+    // a non-function validator and cause a TypeError. See GHSA-q8qp-cvcw-x6jj.
+    const validator = Object.prototype.hasOwnProperty.call(schema, opt) ? schema[opt] : undefined;
     if (validator) {
       const value = options[opt];
       const result = value === undefined || validator(value, opt, options);
@@ -139342,10 +139386,16 @@ function getGlobal() {
 const G = getGlobal();
 const FormDataCtor = typeof G.FormData !== 'undefined' ? G.FormData : undefined;
 const isFormData = thing => {
-  let kind;
-  return thing && (FormDataCtor && thing instanceof FormDataCtor || isFunction(thing.append) && ((kind = kindOf(thing)) === 'formdata' ||
+  if (!thing) return false;
+  if (FormDataCtor && thing instanceof FormDataCtor) return true;
+  // Reject plain objects inheriting directly from Object.prototype so prototype-pollution gadgets can't spoof FormData (GHSA-6chq-wfr3-2hj9).
+  const proto = getPrototypeOf(thing);
+  if (!proto || proto === Object.prototype) return false;
+  if (!isFunction(thing.append)) return false;
+  const kind = kindOf(thing);
+  return kind === 'formdata' ||
   // detect form-data instance
-  kind === 'object' && isFunction(thing.toString) && thing.toString() === '[object FormData]'));
+  kind === 'object' && isFunction(thing.toString) && thing.toString() === '[object FormData]';
 };
 
 /**