@orpc/client 1.13.5 → 1.13.6

package/dist/adapters/fetch/index.mjs

@@ -1,8 +1,8 @@
 import { toArray, intercept } from '@orpc/shared';
 import { toFetchRequest, toStandardLazyResponse } from '@orpc/standard-server-fetch';
-import { C as CompositeStandardLinkPlugin, c as StandardRPCLink } from '../../shared/client.BcDRUyT-.mjs';
+import { C as CompositeStandardLinkPlugin, c as StandardRPCLink } from '../../shared/client.vZdLqpTj.mjs';
 import '@orpc/standard-server';
-import '../../shared/client.BF1R3smX.mjs';
+import '../../shared/client.BKHdcV-f.mjs';
 import '../../shared/client.BLtwTQUg.mjs';
 
 class CompositeLinkFetchPlugin extends CompositeStandardLinkPlugin {

package/dist/adapters/message-port/index.mjs

@@ -1,8 +1,8 @@
 import { value, isObject } from '@orpc/shared';
 import { experimental_ClientPeerWithoutCodec, serializeRequestMessage, encodeRequestMessage, deserializeResponseMessage, decodeResponseMessage } from '@orpc/standard-server-peer';
-import { c as StandardRPCLink } from '../../shared/client.BcDRUyT-.mjs';
+import { c as StandardRPCLink } from '../../shared/client.vZdLqpTj.mjs';
 import '@orpc/standard-server';
-import '../../shared/client.BF1R3smX.mjs';
+import '../../shared/client.BKHdcV-f.mjs';
 import '@orpc/standard-server-fetch';
 import '../../shared/client.BLtwTQUg.mjs';
 

package/dist/adapters/standard/index.mjs

@@ -1,6 +1,6 @@
-export { C as CompositeStandardLinkPlugin, a as STANDARD_RPC_JSON_SERIALIZER_BUILT_IN_TYPES, S as StandardLink, b as StandardRPCJsonSerializer, c as StandardRPCLink, d as StandardRPCLinkCodec, e as StandardRPCSerializer, g as getMalformedResponseErrorCode, t as toHttpPath, f as toStandardHeaders } from '../../shared/client.BcDRUyT-.mjs';
+export { C as CompositeStandardLinkPlugin, a as STANDARD_RPC_JSON_SERIALIZER_BUILT_IN_TYPES, S as StandardLink, b as StandardRPCJsonSerializer, c as StandardRPCLink, d as StandardRPCLinkCodec, e as StandardRPCSerializer, g as getMalformedResponseErrorCode, t as toHttpPath, f as toStandardHeaders } from '../../shared/client.vZdLqpTj.mjs';
 import '@orpc/shared';
 import '@orpc/standard-server';
-import '../../shared/client.BF1R3smX.mjs';
+import '../../shared/client.BKHdcV-f.mjs';
 import '@orpc/standard-server-fetch';
 import '../../shared/client.BLtwTQUg.mjs';

package/dist/adapters/websocket/index.mjs

@@ -1,8 +1,8 @@
 import { readAsBuffer } from '@orpc/shared';
 import { ClientPeer } from '@orpc/standard-server-peer';
-import { c as StandardRPCLink } from '../../shared/client.BcDRUyT-.mjs';
+import { c as StandardRPCLink } from '../../shared/client.vZdLqpTj.mjs';
 import '@orpc/standard-server';
-import '../../shared/client.BF1R3smX.mjs';
+import '../../shared/client.BKHdcV-f.mjs';
 import '@orpc/standard-server-fetch';
 import '../../shared/client.BLtwTQUg.mjs';
 

package/dist/index.d.mts

@@ -207,7 +207,7 @@ type SafeClient<T extends NestedClient<any>> = T extends Client<infer UContext,
 declare function createSafeClient<T extends NestedClient<any>>(client: T): SafeClient<T>;
 
 declare const ORPC_CLIENT_PACKAGE_NAME = "@orpc/client";
-declare const ORPC_CLIENT_PACKAGE_VERSION = "1.13.5";
+declare const ORPC_CLIENT_PACKAGE_VERSION = "1.13.6";
 
 /**
  * DynamicLink provides a way to dynamically resolve and delegate calls to other ClientLinks

package/dist/index.d.ts

@@ -207,7 +207,7 @@ type SafeClient<T extends NestedClient<any>> = T extends Client<infer UContext,
 declare function createSafeClient<T extends NestedClient<any>>(client: T): SafeClient<T>;
 
 declare const ORPC_CLIENT_PACKAGE_NAME = "@orpc/client";
-declare const ORPC_CLIENT_PACKAGE_VERSION = "1.13.5";
+declare const ORPC_CLIENT_PACKAGE_VERSION = "1.13.6";
 
 /**
  * DynamicLink provides a way to dynamically resolve and delegate calls to other ClientLinks

package/dist/index.mjs

@@ -1,7 +1,7 @@
 import { preventNativeAwait, isTypescriptObject } from '@orpc/shared';
 export { AsyncIteratorClass, EventPublisher, asyncIteratorToStream as eventIteratorToStream, asyncIteratorToUnproxiedDataStream as eventIteratorToUnproxiedDataStream, onError, onFinish, onStart, onSuccess, streamToAsyncIteratorClass as streamToEventIterator } from '@orpc/shared';
-import { i as isDefinedError } from './shared/client.BF1R3smX.mjs';
-export { C as COMMON_ORPC_ERROR_DEFS, c as ORPCError, O as ORPC_CLIENT_PACKAGE_NAME, a as ORPC_CLIENT_PACKAGE_VERSION, g as createORPCErrorFromJson, b as fallbackORPCErrorMessage, f as fallbackORPCErrorStatus, e as isORPCErrorJson, d as isORPCErrorStatus, t as toORPCError } from './shared/client.BF1R3smX.mjs';
+import { i as isDefinedError } from './shared/client.BKHdcV-f.mjs';
+export { C as COMMON_ORPC_ERROR_DEFS, c as ORPCError, O as ORPC_CLIENT_PACKAGE_NAME, a as ORPC_CLIENT_PACKAGE_VERSION, g as createORPCErrorFromJson, b as fallbackORPCErrorMessage, f as fallbackORPCErrorStatus, e as isORPCErrorJson, d as isORPCErrorStatus, t as toORPCError } from './shared/client.BKHdcV-f.mjs';
 export { m as mapEventIterator } from './shared/client.BLtwTQUg.mjs';
 export { ErrorEvent } from '@orpc/standard-server';
 

package/dist/plugins/index.mjs

@@ -1,7 +1,7 @@
 import { isAsyncIteratorObject, defer, value, splitInHalf, toArray, stringifyJSON, overlayProxy, AsyncIteratorClass } from '@orpc/shared';
 import { toBatchRequest, parseBatchResponse, toBatchAbortSignal } from '@orpc/standard-server/batch';
 import { replicateStandardLazyResponse, getEventMeta, flattenHeader } from '@orpc/standard-server';
-import { C as COMMON_ORPC_ERROR_DEFS } from '../shared/client.BF1R3smX.mjs';
+import { C as COMMON_ORPC_ERROR_DEFS } from '../shared/client.BKHdcV-f.mjs';
 
 class BatchLinkPlugin {
   groups;

package/dist/shared/{client.BF1R3smX.mjs → client.BKHdcV-f.mjs}

@@ -1,7 +1,7 @@
 import { resolveMaybeOptionalOptions, getConstructor, isObject } from '@orpc/shared';
 
 const ORPC_CLIENT_PACKAGE_NAME = "@orpc/client";
-const ORPC_CLIENT_PACKAGE_VERSION = "1.13.5";
+const ORPC_CLIENT_PACKAGE_VERSION = "1.13.6";
 
 const COMMON_ORPC_ERROR_DEFS = {
   BAD_REQUEST: {

package/dist/shared/{client.BcDRUyT-.mjs → client.vZdLqpTj.mjs}

@@ -1,6 +1,6 @@
 import { toArray, runWithSpan, ORPC_NAME, isAsyncIteratorObject, asyncIteratorWithSpan, intercept, getGlobalOtelConfig, isObject, value, stringifyJSON } from '@orpc/shared';
 import { mergeStandardHeaders, ErrorEvent } from '@orpc/standard-server';
-import { C as COMMON_ORPC_ERROR_DEFS, d as isORPCErrorStatus, e as isORPCErrorJson, g as createORPCErrorFromJson, c as ORPCError, t as toORPCError } from './client.BF1R3smX.mjs';
+import { C as COMMON_ORPC_ERROR_DEFS, d as isORPCErrorStatus, e as isORPCErrorJson, g as createORPCErrorFromJson, c as ORPCError, t as toORPCError } from './client.BKHdcV-f.mjs';
 import { toStandardHeaders as toStandardHeaders$1 } from '@orpc/standard-server-fetch';
 import { m as mapEventIterator } from './client.BLtwTQUg.mjs';
 
@@ -172,6 +172,9 @@ class StandardRPCJsonSerializer {
         segments.forEach((segment) => {
           currentRef = currentRef[preSegment];
           preSegment = segment;
+          if (!Object.hasOwn(currentRef, preSegment)) {
+            throw new Error(`Security error: accessing non-existent path during deserialization. Path segment: ${preSegment}`);
+          }
         });
         currentRef[preSegment] = getBlob(i);
       });
@@ -183,6 +186,9 @@ class StandardRPCJsonSerializer {
       for (let i = 1; i < item.length; i++) {
         currentRef = currentRef[preSegment];
         preSegment = item[i];
+        if (!Object.hasOwn(currentRef, preSegment)) {
+          throw new Error(`Security error: accessing non-existent path during deserialization. Path segment: ${preSegment}`);
+        }
       }
       for (const custom of this.customSerializers) {
         if (custom.type === type) {

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@orpc/client",
   "type": "module",
-  "version": "1.13.5",
+  "version": "1.13.6",
   "license": "MIT",
   "homepage": "https://orpc.dev",
   "repository": {
@@ -48,10 +48,10 @@
     "dist"
   ],
   "dependencies": {
-    "@orpc/shared": "1.13.5",
-    "@orpc/standard-server-fetch": "1.13.5",
-    "@orpc/standard-server-peer": "1.13.5",
-    "@orpc/standard-server": "1.13.5"
+    "@orpc/shared": "1.13.6",
+    "@orpc/standard-server-fetch": "1.13.6",
+    "@orpc/standard-server-peer": "1.13.6",
+    "@orpc/standard-server": "1.13.6"
   },
   "devDependencies": {
     "zod": "^4.3.6"