@speclynx/apidom-ns-openapi-2 5.1.0 → 5.1.1

package/CHANGELOG.md

@@ -3,6 +3,10 @@
 All notable changes to this project will be documented in this file.
 See [Conventional Commits](https://conventionalcommits.org) for commit guidelines.
 
+## [5.1.1](https://github.com/speclynx/apidom/compare/v5.1.0...v5.1.1) (2026-08-19)
+
+**Note:** Version bump only for package @speclynx/apidom-ns-openapi-2
+
 # [5.1.0](https://github.com/speclynx/apidom/compare/v5.0.2...v5.1.0) (2026-08-09)
 
 ### Bug Fixes

package/dist/apidom-ns-openapi-2.browser.js

@@ -22681,6 +22681,7 @@ const resolveSpecification = specification => {
 __webpack_require__.r(__webpack_exports__);
 /* harmony import */ var _speclynx_apidom_datamodel__WEBPACK_IMPORTED_MODULE_0__ = __webpack_require__(5162);
 /* harmony import */ var _speclynx_apidom_datamodel__WEBPACK_IMPORTED_MODULE_1__ = __webpack_require__(6911);
+/* harmony import */ var _util_mjs__WEBPACK_IMPORTED_MODULE_2__ = __webpack_require__(977);
 
 
 /**
@@ -22708,7 +22709,7 @@ const serializer = element => {
       node.forEach((value, key) => {
         const k = serialize(key);
         const v = serialize(value);
-        if (typeof k === 'string') obj[k] = v;
+        if (typeof k === 'string') (0,_util_mjs__WEBPACK_IMPORTED_MODULE_2__["default"])(obj, k, v);
       });
       return obj;
     }
@@ -22733,6 +22734,38 @@ const serializer = element => {
 /* harmony export */ ]);
 
 
+/***/ },
+
+/***/ 977
+(__unused_webpack___webpack_module__, __webpack_exports__, __webpack_require__) {
+
+__webpack_require__.r(__webpack_exports__);
+/**
+ * Defines a key on a plain object being built from an ApiDOM element tree.
+ *
+ * A "__proto__" key must be defined rather than assigned: assignment invokes
+ * the prototype setter, which drops the member from the result and hands
+ * document content to consumers as the object's prototype. Every other key
+ * takes the plain assignment fast path.
+ */
+const setProperty = (target, key, value) => {
+  if (key === '__proto__') {
+    Object.defineProperty(target, key, {
+      value,
+      enumerable: true,
+      writable: true,
+      configurable: true
+    });
+  } else {
+    target[key] = value;
+  }
+};
+/* harmony default export */ const __WEBPACK_DEFAULT_EXPORT__ = (setProperty);
+/* harmony export */ __webpack_require__.d(__webpack_exports__, [
+/* harmony export */   "default", 0, /* export default binding */ __WEBPACK_DEFAULT_EXPORT__
+/* harmony export */ ]);
+
+
 /***/ },
 
 /***/ 6663
@@ -22778,6 +22811,8 @@ class KeyValuePair {
 
 __webpack_require__.r(__webpack_exports__);
 /* harmony import */ var ramda__WEBPACK_IMPORTED_MODULE_0__ = __webpack_require__(8138);
+/* harmony import */ var _util_mjs__WEBPACK_IMPORTED_MODULE_1__ = __webpack_require__(4883);
+
 
 /**
  * Lightweight meta container for Element metadata.
@@ -22794,7 +22829,7 @@ class Metadata {
     return this[name];
   }
   set(name, value) {
-    this[name] = value;
+    ;(0,_util_mjs__WEBPACK_IMPORTED_MODULE_1__["default"])(this, name, value);
   }
   hasKey(name) {
     return Object.hasOwn(this, name);
@@ -22827,7 +22862,19 @@ class Metadata {
    */
   cloneShallow() {
     const clone = new Metadata();
-    Object.assign(clone, this);
+
+    // Object.assign is the fast path but invokes the prototype setter for a
+    // "__proto__" key, hijacking the clone's prototype. That key can only come
+    // from untrusted input, so check for it once and fall back to a guarded
+    // copy. Copying property descriptors instead would carry writable:false
+    // over from a frozen source and hand back an unmodifiable clone.
+    if (!Object.hasOwn(this, '__proto__')) {
+      Object.assign(clone, this);
+    } else {
+      for (const key of Object.keys(this)) {
+        (0,_util_mjs__WEBPACK_IMPORTED_MODULE_1__["default"])(clone, key, this[key]);
+      }
+    }
     return clone;
   }
 
@@ -25312,6 +25359,8 @@ __webpack_require__.r(__webpack_exports__);
 /* harmony import */ var _CollectionElement_mjs__WEBPACK_IMPORTED_MODULE_0__ = __webpack_require__(4536);
 /* harmony import */ var _MemberElement_mjs__WEBPACK_IMPORTED_MODULE_1__ = __webpack_require__(1770);
 /* harmony import */ var _ObjectSlice_mjs__WEBPACK_IMPORTED_MODULE_2__ = __webpack_require__(8504);
+/* harmony import */ var _util_mjs__WEBPACK_IMPORTED_MODULE_3__ = __webpack_require__(4883);
+
 
 
 
@@ -25336,7 +25385,7 @@ class ObjectElement extends _CollectionElement_mjs__WEBPACK_IMPORTED_MODULE_0__[
   }
   toValue() {
     return this._content.reduce((results, el) => {
-      results[el.key.toValue()] = el.value ? el.value.toValue() : undefined;
+      ;(0,_util_mjs__WEBPACK_IMPORTED_MODULE_3__["default"])(results, el.key.toValue(), el.value ? el.value.toValue() : undefined);
       return results;
     }, {});
   }
@@ -25700,6 +25749,8 @@ _Metadata_mjs__WEBPACK_IMPORTED_MODULE_18__["default"].prototype.cloneDeepElemen
 __webpack_require__.r(__webpack_exports__);
 /* harmony import */ var _elements_SourceMap_mjs__WEBPACK_IMPORTED_MODULE_0__ = __webpack_require__(5810);
 /* harmony import */ var _elements_Style_mjs__WEBPACK_IMPORTED_MODULE_1__ = __webpack_require__(9686);
+/* harmony import */ var _util_mjs__WEBPACK_IMPORTED_MODULE_2__ = __webpack_require__(4883);
+
 
 
 /**
@@ -25887,12 +25938,12 @@ class JSONSerialiser {
     let hasEntries = false;
     for (const [key, value] of Object.entries(element.meta)) {
       if (value instanceof this.namespace.elements.Element) {
-        meta[key] = this.serialise(value);
+        (0,_util_mjs__WEBPACK_IMPORTED_MODULE_2__["default"])(meta, key, this.serialise(value));
         hasEntries = true;
       } else if (value !== undefined) {
         // refract primitives to maintain JSON Refract spec compatibility
         const refracted = element.refract(value);
-        meta[key] = this.serialise(refracted);
+        (0,_util_mjs__WEBPACK_IMPORTED_MODULE_2__["default"])(meta, key, this.serialise(refracted));
         rawKeys.push(key);
         hasEntries = true;
       }
@@ -25906,7 +25957,7 @@ class JSONSerialiser {
     const result = {};
     obj.forEach((value, key) => {
       if (value) {
-        result[key.toValue()] = this.serialise(value);
+        (0,_util_mjs__WEBPACK_IMPORTED_MODULE_2__["default"])(result, key.toValue(), this.serialise(value));
       }
     });
     if (Object.keys(result).length === 0) {
@@ -25926,6 +25977,38 @@ class JSONSerialiser {
 /* harmony export */ ]);
 
 
+/***/ },
+
+/***/ 4883
+(__unused_webpack___webpack_module__, __webpack_exports__, __webpack_require__) {
+
+__webpack_require__.r(__webpack_exports__);
+/**
+ * Defines a key on a plain object or class instance built from untrusted input.
+ *
+ * A "__proto__" key must be defined rather than assigned: assignment invokes the
+ * prototype setter, which drops the member from the result and replaces the
+ * target's prototype with the incoming value. Every other key takes the plain
+ * assignment fast path.
+ */
+const setProperty = (target, key, value) => {
+  if (key === '__proto__') {
+    Object.defineProperty(target, key, {
+      value,
+      enumerable: true,
+      writable: true,
+      configurable: true
+    });
+  } else {
+    target[key] = value;
+  }
+};
+/* harmony default export */ const __WEBPACK_DEFAULT_EXPORT__ = (setProperty);
+/* harmony export */ __webpack_require__.d(__webpack_exports__, [
+/* harmony export */   "default", 0, /* export default binding */ __WEBPACK_DEFAULT_EXPORT__
+/* harmony export */ ]);
+
+
 /***/ },
 
 /***/ 3437