merge-anything 6.0.3 → 6.0.5

package/dist/merge.d.ts

@@ -8,9 +8,8 @@ import type { PrettyPrint } from './typeUtils/PrettyPrint.js';
  */
 export type Merge<T, Ts extends unknown[]> = T extends Record<string | number | symbol, unknown> ? Ts extends Record<string | number | symbol, unknown>[] ? PrettyPrint<Assign<T, Ts>> : Pop<Ts> : Pop<Ts>;
 /**
- * Merge anything recursively.
- * Objects get merged, special objects (classes etc.) are re-assigned "as is".
- * Basic types overwrite objects or other basic types.
+ * Merge anything recursively. Objects get merged, special objects (classes etc.) are re-assigned
+ * "as is". Basic types overwrite objects or other basic types.
  */
 export declare function merge<T, const Tn extends unknown[]>(object: T, ...otherObjects: Tn): Merge<T, Tn>;
 export declare function mergeAndCompare<T, const Tn extends unknown[]>(compareFn: (prop1: unknown, prop2: unknown, propName: string | symbol) => any, object: T, ...otherObjects: Tn): Merge<T, Tn>;

package/dist/merge.js

@@ -25,6 +25,9 @@ function mergeRecursively(origin, newComer, compareFn) {
         const props = Object.getOwnPropertyNames(origin);
         const symbols = Object.getOwnPropertySymbols(origin);
         newObject = [...props, ...symbols].reduce((carry, key) => {
+            // Skip __proto__ properties to prevent prototype poisoning
+            if (key === '__proto__')
+                return carry;
             const targetVal = origin[key];
             if ((!isSymbol(key) && !Object.getOwnPropertyNames(newComer).includes(key)) ||
                 (isSymbol(key) && !Object.getOwnPropertySymbols(newComer).includes(key))) {
@@ -37,6 +40,9 @@ function mergeRecursively(origin, newComer, compareFn) {
     const props = Object.getOwnPropertyNames(newComer);
     const symbols = Object.getOwnPropertySymbols(newComer);
     const result = [...props, ...symbols].reduce((carry, key) => {
+        // Skip __proto__ properties to prevent prototype poisoning
+        if (key === '__proto__')
+            return carry;
         // re-define the origin and newComer as targetVal and newVal
         let newVal = newComer[key];
         const targetVal = isPlainObject(origin) ? origin[key] : undefined;
@@ -51,9 +57,8 @@ function mergeRecursively(origin, newComer, compareFn) {
     return result;
 }
 /**
- * Merge anything recursively.
- * Objects get merged, special objects (classes etc.) are re-assigned "as is".
- * Basic types overwrite objects or other basic types.
+ * Merge anything recursively. Objects get merged, special objects (classes etc.) are re-assigned
+ * "as is". Basic types overwrite objects or other basic types.
  */
 export function merge(object, ...otherObjects) {
     return otherObjects.reduce((result, newComer) => {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "merge-anything",
-  "version": "6.0.3",
+  "version": "6.0.5",
   "description": "Merge objects & other types recursively. A simple & small integration.",
   "type": "module",
   "sideEffects": false,
@@ -17,14 +17,14 @@
     "release": "npm run lint && npm run build && np"
   },
   "dependencies": {
-    "is-what": "^5.0.1"
+    "is-what": "^5.2.0"
   },
   "devDependencies": {
-    "del-cli": "^5.1.0",
-    "np": "^10.0.5",
-    "vitest": "^1.6.0",
-    "@cycraft/eslint": "^0.3.0",
-    "@cycraft/tsconfig": "^0.1.2"
+    "@cycraft/eslint": "^0.4.3",
+    "@cycraft/tsconfig": "^0.1.2",
+    "del-cli": "^6.0.0",
+    "np": "^10.2.0",
+    "vitest": "^3.0.6"
   },
   "files": [
     "dist"