@naturalcycles/nodejs-lib 15.106.1 → 15.106.3

package/dist/validation/ajv/jSchema.d.ts

@@ -634,7 +634,7 @@ type HasAllowExtraKeys<T> = T extends {
 type IsAny<T> = 0 extends 1 & T ? true : false;
 type IsAssignableRelaxed<A, B> = IsAny<RelaxIndexSignature<A>> extends true ? true : [RelaxIndexSignature<A>] extends [B] ? true : false;
 type ExactMatchBase<A, B> = (<T>() => T extends A ? 1 : 2) extends <T>() => (T extends B ? 1 : 2) ? (<T>() => T extends B ? 1 : 2) extends <T>() => (T extends A ? 1 : 2) ? true : false : false;
-type ExactMatch<A, B> = HasAllowExtraKeys<B> extends true ? IsAssignableRelaxed<B, A> : ExactMatchBase<Expand<A>, Expand<B>> extends true ? true : ExactMatchBase<Expand<StripIndexSignatureDeep<A>>, Expand<StripIndexSignatureDeep<B>>>;
+type ExactMatch<A, B> = HasAllowExtraKeys<B> extends true ? IsAssignableRelaxed<B, A> : ExactMatchBase<Expand<A>, Expand<B>> extends true ? true : ExactMatchBase<Expand<StripIndexSignatureDeep<A>>, Expand<StripIndexSignatureDeep<B>>> extends true ? true : ExactMatchBase<keyof Expand<A>, keyof Expand<B>> extends true ? [Expand<A>] extends [Expand<B>] ? [Expand<B>] extends [Expand<A>] ? true : false : false : false;
 type BuilderOutUnion<B extends readonly JSchema<any, any>[]> = {
     [K in keyof B]: B[K] extends JSchema<infer O, any> ? O : never;
 }[number];

package/dist/validation/ajv/jsonSchemaBuilder.util.js

@@ -47,6 +47,8 @@ export function mergeJsonSchemaObjects(schema1, schema2) {
     const s1 = schema1;
     const s2 = schema2;
     // Merge `properties`
+    // Not vulnerable to prototype pollution: writes to s1.properties (a nested object),
+    // where __proto__ assignment only changes that object's prototype, not Object.prototype.
     Object.entries(s2.properties).forEach(([k, v]) => {
         s1.properties[k] = v;
     });

package/dist/validation/timezones.js

@@ -600,6 +600,7 @@ const TIMEZONES_FROM_WIKI = [
     'WET',
     'Zulu',
 ];
+// oxlint-disable-next-line no-restricted-globals
 const TIMEZONES_FROM_JS = Intl.supportedValuesOf('timeZone');
 /**
  * A complicated merge of timezones from the underlying Javascript engine

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@naturalcycles/nodejs-lib",
   "type": "module",
-  "version": "15.106.1",
+  "version": "15.106.3",
   "dependencies": {
     "@naturalcycles/js-lib": "^15",
     "@standard-schema/spec": "^1",

package/src/validation/ajv/jSchema.ts

@@ -2141,7 +2141,21 @@ type ExactMatch<A, B> =
     ? IsAssignableRelaxed<B, A>
     : ExactMatchBase<Expand<A>, Expand<B>> extends true
       ? true
-      : ExactMatchBase<Expand<StripIndexSignatureDeep<A>>, Expand<StripIndexSignatureDeep<B>>>
+      : ExactMatchBase<
+            Expand<StripIndexSignatureDeep<A>>,
+            Expand<StripIndexSignatureDeep<B>>
+          > extends true
+        ? true
+        : // Fallback for types that are structurally identical but have different internal
+          // representations (e.g. enum values from T[keyof T] vs direct enum references).
+          // Keys must match exactly; then check mutual structural assignability.
+          ExactMatchBase<keyof Expand<A>, keyof Expand<B>> extends true
+          ? [Expand<A>] extends [Expand<B>]
+            ? [Expand<B>] extends [Expand<A>]
+              ? true
+              : false
+            : false
+          : false
 
 type BuilderOutUnion<B extends readonly JSchema<any, any>[]> = {
   [K in keyof B]: B[K] extends JSchema<infer O, any> ? O : never

package/src/validation/ajv/jsonSchemaBuilder.util.ts

@@ -55,6 +55,8 @@ export function mergeJsonSchemaObjects<T1 extends AnyObject, T2 extends AnyObjec
   const s2 = schema2 as any
 
   // Merge `properties`
+  // Not vulnerable to prototype pollution: writes to s1.properties (a nested object),
+  // where __proto__ assignment only changes that object's prototype, not Object.prototype.
   Object.entries(s2.properties).forEach(([k, v]) => {
     s1.properties[k] = v
   })

package/src/validation/timezones.ts

@@ -603,6 +603,7 @@ const TIMEZONES_FROM_WIKI = [
   'Zulu',
 ] as IANATimezone[]
 
+// oxlint-disable-next-line no-restricted-globals
 const TIMEZONES_FROM_JS = Intl.supportedValuesOf('timeZone') as IANATimezone[]
 
 /**