umt 2.13.0 → 2.15.0

package/module/es5/Object/getObjectsCommon.js

@@ -34,6 +34,16 @@ function _toPrimitive(t, r) { if ("object" != _typeof(t) || !t) return t; var e
  * @param {...Record<string, unknown>[]} objects - Additional objects to compare.
  * @returns {Partial<T>} Object containing only the key-value pairs shared by all inputs.
  *
+ * @remarks
+ * **Prototype pollution warning:** This function does not filter out
+ * prototype-polluting keys (`__proto__`, `constructor`, `prototype`).
+ * If processing user-controlled input, sanitize with the appropriate
+ * `removePrototype*` helper before calling this function:
+ * - `removePrototype` — shallow sanitization of a single object
+ * - `removePrototypeDeep` — recursive sanitization of a single object (for deeply nested data)
+ * - `removePrototypeMap` — shallow sanitization of an array of objects
+ * - `removePrototypeMapDeep` — recursive sanitization of an array of objects (for deeply nested data)
+ *
  * @example
  * ```typescript
  * getObjectsCommon({ a: 1, b: 2 }, { a: 1, c: 3 });

package/module/es5/Object/getObjectsDiff.d.ts

@@ -13,6 +13,16 @@
  * @param {...Record<string, unknown>[]} objects - Additional objects to compare.
  * @returns {Partial<T>} Object containing only key-value pairs unique to one input.
  *
+ * @remarks
+ * **Prototype pollution warning:** This function does not filter out
+ * prototype-polluting keys (`__proto__`, `constructor`, `prototype`).
+ * If processing user-controlled input, sanitize with the appropriate
+ * `removePrototype*` helper before calling this function:
+ * - `removePrototype` — shallow sanitization of a single object
+ * - `removePrototypeDeep` — recursive sanitization of a single object (for deeply nested data)
+ * - `removePrototypeMap` — shallow sanitization of an array of objects
+ * - `removePrototypeMapDeep` — recursive sanitization of an array of objects (for deeply nested data)
+ *
  * @example
  * ```typescript
  * getObjectsDiff({ a: 1, b: 2 }, { b: 2, c: 3 });

package/module/es5/Object/getObjectsDiff.js

@@ -37,6 +37,16 @@ function _toPrimitive(t, r) { if ("object" != _typeof(t) || !t) return t; var e
  * @param {...Record<string, unknown>[]} objects - Additional objects to compare.
  * @returns {Partial<T>} Object containing only key-value pairs unique to one input.
  *
+ * @remarks
+ * **Prototype pollution warning:** This function does not filter out
+ * prototype-polluting keys (`__proto__`, `constructor`, `prototype`).
+ * If processing user-controlled input, sanitize with the appropriate
+ * `removePrototype*` helper before calling this function:
+ * - `removePrototype` — shallow sanitization of a single object
+ * - `removePrototypeDeep` — recursive sanitization of a single object (for deeply nested data)
+ * - `removePrototypeMap` — shallow sanitization of an array of objects
+ * - `removePrototypeMapDeep` — recursive sanitization of an array of objects (for deeply nested data)
+ *
  * @example
  * ```typescript
  * getObjectsDiff({ a: 1, b: 2 }, { b: 2, c: 3 });
@@ -111,27 +121,32 @@ var _getObjectsDiff = exports.getObjectsDiff = function getObjectsDiff(object) {
       }
       var lastUniqueValue = void 0;
       var hasUnique = false;
+
+      // Count occurrences in a single pass using a Map — O(n) instead of O(n²).
+      // Map keys use SameValueZero which matches === for all values except NaN,
+      // an acceptable trade-off for object-diff use cases.
+      var valueCounts = new Map();
       for (var _i2 = 0, _values = values; _i2 < _values.length; _i2++) {
+        var _valueCounts$get;
         var value = _values[_i2];
-        var count = 0;
-        var _iterator4 = _createForOfIteratorHelper(values),
-          _step4;
-        try {
-          for (_iterator4.s(); !(_step4 = _iterator4.n()).done;) {
-            var other = _step4.value;
-            if (value === other) {
-              count++;
-            }
+        valueCounts.set(value, ((_valueCounts$get = valueCounts.get(value)) !== null && _valueCounts$get !== void 0 ? _valueCounts$get : 0) + 1);
+      }
+      var _iterator4 = _createForOfIteratorHelper(valueCounts),
+        _step4;
+      try {
+        for (_iterator4.s(); !(_step4 = _iterator4.n()).done;) {
+          var _step4$value = _slicedToArray(_step4.value, 2),
+            _value = _step4$value[0],
+            count = _step4$value[1];
+          if (count === 1) {
+            lastUniqueValue = _value;
+            hasUnique = true;
           }
-        } catch (err) {
-          _iterator4.e(err);
-        } finally {
-          _iterator4.f();
-        }
-        if (count === 1) {
-          lastUniqueValue = value;
-          hasUnique = true;
         }
+      } catch (err) {
+        _iterator4.e(err);
+      } finally {
+        _iterator4.f();
       }
       if (hasUnique) {
         result[_key2] = lastUniqueValue;

package/module/es5/Object/has.d.ts

@@ -6,6 +6,16 @@
  * @example has({ a: { b: 1 } }, "a.b"); // true
  * has({ a: { b: 1 } }, ["a", "b"]); // true
  * has({ a: { b: 1 } }, "a.c"); // false
+ *
+ * @remarks
+ * **Prototype pollution warning:** This function does not filter out
+ * prototype-polluting keys (`__proto__`, `constructor`, `prototype`).
+ * If processing user-controlled input, sanitize with the appropriate
+ * `removePrototype*` helper before calling this function:
+ * - `removePrototype` — shallow sanitization of a single object
+ * - `removePrototypeDeep` — recursive sanitization of a single object (for deeply nested data)
+ * - `removePrototypeMap` — shallow sanitization of an array of objects
+ * - `removePrototypeMapDeep` — recursive sanitization of an array of objects (for deeply nested data)
  */
 export declare const has: <T extends {
     [key: string]: unknown;

package/module/es5/Object/has.js

@@ -21,6 +21,16 @@ function _toPrimitive(t, r) { if ("object" != _typeof(t) || !t) return t; var e
  * @example has({ a: { b: 1 } }, "a.b"); // true
  * has({ a: { b: 1 } }, ["a", "b"]); // true
  * has({ a: { b: 1 } }, "a.c"); // false
+ *
+ * @remarks
+ * **Prototype pollution warning:** This function does not filter out
+ * prototype-polluting keys (`__proto__`, `constructor`, `prototype`).
+ * If processing user-controlled input, sanitize with the appropriate
+ * `removePrototype*` helper before calling this function:
+ * - `removePrototype` — shallow sanitization of a single object
+ * - `removePrototypeDeep` — recursive sanitization of a single object (for deeply nested data)
+ * - `removePrototypeMap` — shallow sanitization of an array of objects
+ * - `removePrototypeMapDeep` — recursive sanitization of an array of objects (for deeply nested data)
  */
 var has = exports.has = function has(object, path) {
   var localPath = typeof path === "string" ? path.split(".") : path;

package/module/es5/Object/index.d.ts

@@ -12,3 +12,7 @@ export * from "./mergeDeep";
 export * from "./omit";
 export * from "./pick";
 export * from "./pickDeep";
+export * from "./removePrototype";
+export * from "./removePrototypeDeep";
+export * from "./removePrototypeMap";
+export * from "./removePrototypeMapDeep";

package/module/es5/Object/index.js

@@ -156,4 +156,48 @@ Object.keys(_pickDeep).forEach(function (key) {
       return _pickDeep[key];
     }
   });
+});
+var _removePrototype = require("./removePrototype");
+Object.keys(_removePrototype).forEach(function (key) {
+  if (key === "default" || key === "__esModule") return;
+  if (key in exports && exports[key] === _removePrototype[key]) return;
+  Object.defineProperty(exports, key, {
+    enumerable: true,
+    get: function get() {
+      return _removePrototype[key];
+    }
+  });
+});
+var _removePrototypeDeep = require("./removePrototypeDeep");
+Object.keys(_removePrototypeDeep).forEach(function (key) {
+  if (key === "default" || key === "__esModule") return;
+  if (key in exports && exports[key] === _removePrototypeDeep[key]) return;
+  Object.defineProperty(exports, key, {
+    enumerable: true,
+    get: function get() {
+      return _removePrototypeDeep[key];
+    }
+  });
+});
+var _removePrototypeMap = require("./removePrototypeMap");
+Object.keys(_removePrototypeMap).forEach(function (key) {
+  if (key === "default" || key === "__esModule") return;
+  if (key in exports && exports[key] === _removePrototypeMap[key]) return;
+  Object.defineProperty(exports, key, {
+    enumerable: true,
+    get: function get() {
+      return _removePrototypeMap[key];
+    }
+  });
+});
+var _removePrototypeMapDeep = require("./removePrototypeMapDeep");
+Object.keys(_removePrototypeMapDeep).forEach(function (key) {
+  if (key === "default" || key === "__esModule") return;
+  if (key in exports && exports[key] === _removePrototypeMapDeep[key]) return;
+  Object.defineProperty(exports, key, {
+    enumerable: true,
+    get: function get() {
+      return _removePrototypeMapDeep[key];
+    }
+  });
 });

package/module/es5/Object/keyBy.d.ts

@@ -5,6 +5,16 @@ type Iteratee<T> = IterateeFunction<T> | keyof T;
  * Creates an object composed of keys generated from the results of running each element of collection through iteratee
  * @param collection The collection to iterate over
  * @param iteratee The iteratee function or property name to generate the key
+ *
+ * @remarks
+ * **Prototype pollution warning:** This function does not filter out
+ * prototype-polluting keys (`__proto__`, `constructor`, `prototype`).
+ * If processing user-controlled input, sanitize with the appropriate
+ * `removePrototype*` helper before calling this function:
+ * - `removePrototype` — shallow sanitization of a single object
+ * - `removePrototypeDeep` — recursive sanitization of a single object (for deeply nested data)
+ * - `removePrototypeMap` — shallow sanitization of an array of objects
+ * - `removePrototypeMapDeep` — recursive sanitization of an array of objects (for deeply nested data)
  */
 export declare function keyBy<T>(collection: T[] | Record<PropertyName, T>, iteratee?: Iteratee<T>): Record<PropertyName, T>;
 export {};

package/module/es5/Object/keyBy.js

@@ -11,6 +11,16 @@ function _arrayLikeToArray(r, a) { (null == a || a > r.length) && (a = r.length)
  * Creates an object composed of keys generated from the results of running each element of collection through iteratee
  * @param collection The collection to iterate over
  * @param iteratee The iteratee function or property name to generate the key
+ *
+ * @remarks
+ * **Prototype pollution warning:** This function does not filter out
+ * prototype-polluting keys (`__proto__`, `constructor`, `prototype`).
+ * If processing user-controlled input, sanitize with the appropriate
+ * `removePrototype*` helper before calling this function:
+ * - `removePrototype` — shallow sanitization of a single object
+ * - `removePrototypeDeep` — recursive sanitization of a single object (for deeply nested data)
+ * - `removePrototypeMap` — shallow sanitization of an array of objects
+ * - `removePrototypeMapDeep` — recursive sanitization of an array of objects (for deeply nested data)
  */
 function keyBy(collection, iteratee) {
   var getKey = normalizeIteratee(iteratee);

package/module/es5/Object/mapKeys.d.ts

@@ -6,6 +6,16 @@
  * @param function_ - The function invoked per key. Receives (value, key).
  * @returns A new object with transformed keys.
  *
+ * @remarks
+ * **Prototype pollution warning:** This function does not filter out
+ * prototype-polluting keys (`__proto__`, `constructor`, `prototype`).
+ * If processing user-controlled input, sanitize with the appropriate
+ * `removePrototype*` helper before calling this function:
+ * - `removePrototype` — shallow sanitization of a single object
+ * - `removePrototypeDeep` — recursive sanitization of a single object (for deeply nested data)
+ * - `removePrototypeMap` — shallow sanitization of an array of objects
+ * - `removePrototypeMapDeep` — recursive sanitization of an array of objects (for deeply nested data)
+ *
  * @example
  * ```typescript
  * mapKeys({ a: 1, b: 2 }, (_value, key) => key.toUpperCase());

package/module/es5/Object/mapKeys.js

@@ -12,6 +12,16 @@ exports.mapKeys = void 0;
  * @param function_ - The function invoked per key. Receives (value, key).
  * @returns A new object with transformed keys.
  *
+ * @remarks
+ * **Prototype pollution warning:** This function does not filter out
+ * prototype-polluting keys (`__proto__`, `constructor`, `prototype`).
+ * If processing user-controlled input, sanitize with the appropriate
+ * `removePrototype*` helper before calling this function:
+ * - `removePrototype` — shallow sanitization of a single object
+ * - `removePrototypeDeep` — recursive sanitization of a single object (for deeply nested data)
+ * - `removePrototypeMap` — shallow sanitization of an array of objects
+ * - `removePrototypeMapDeep` — recursive sanitization of an array of objects (for deeply nested data)
+ *
  * @example
  * ```typescript
  * mapKeys({ a: 1, b: 2 }, (_value, key) => key.toUpperCase());
@@ -26,7 +36,8 @@ var mapKeys = exports.mapKeys = function mapKeys(object, function_) {
   while (index < length) {
     var key = keys[index];
     var value = object[key];
-    result[function_(value, key)] = value;
+    var newKey = function_(value, key);
+    result[newKey] = value;
     index += 1;
   }
   return result;

package/module/es5/Object/mapValues.d.ts

@@ -6,6 +6,16 @@
  * @param function_ - The function invoked per value. Receives (value, key).
  * @returns A new object with transformed values.
  *
+ * @remarks
+ * **Prototype pollution warning:** This function does not filter out
+ * prototype-polluting keys (`__proto__`, `constructor`, `prototype`).
+ * If processing user-controlled input, sanitize with the appropriate
+ * `removePrototype*` helper before calling this function:
+ * - `removePrototype` — shallow sanitization of a single object
+ * - `removePrototypeDeep` — recursive sanitization of a single object (for deeply nested data)
+ * - `removePrototypeMap` — shallow sanitization of an array of objects
+ * - `removePrototypeMapDeep` — recursive sanitization of an array of objects (for deeply nested data)
+ *
  * @example
  * ```typescript
  * mapValues({ a: 1, b: 2 }, (value) => value * 2);

package/module/es5/Object/mapValues.js

@@ -12,6 +12,16 @@ exports.mapValues = void 0;
  * @param function_ - The function invoked per value. Receives (value, key).
  * @returns A new object with transformed values.
  *
+ * @remarks
+ * **Prototype pollution warning:** This function does not filter out
+ * prototype-polluting keys (`__proto__`, `constructor`, `prototype`).
+ * If processing user-controlled input, sanitize with the appropriate
+ * `removePrototype*` helper before calling this function:
+ * - `removePrototype` — shallow sanitization of a single object
+ * - `removePrototypeDeep` — recursive sanitization of a single object (for deeply nested data)
+ * - `removePrototypeMap` — shallow sanitization of an array of objects
+ * - `removePrototypeMapDeep` — recursive sanitization of an array of objects (for deeply nested data)
+ *
  * @example
  * ```typescript
  * mapValues({ a: 1, b: 2 }, (value) => value * 2);

package/module/es5/Object/merge.d.ts

@@ -4,5 +4,15 @@ import type { UnionToIntersection } from "../types/logic/unionToIntersection";
  * @param target - The target object to merge into
  * @param sources - The source objects to merge from
  * @returns The merged object
+ *
+ * @remarks
+ * **Prototype pollution warning:** This function does not filter out
+ * prototype-polluting keys (`__proto__`, `constructor`, `prototype`).
+ * If processing user-controlled input, sanitize with the appropriate
+ * `removePrototype*` helper before calling this function:
+ * - `removePrototype` — shallow sanitization of a single object
+ * - `removePrototypeDeep` — recursive sanitization of a single object (for deeply nested data)
+ * - `removePrototypeMap` — shallow sanitization of an array of objects
+ * - `removePrototypeMapDeep` — recursive sanitization of an array of objects (for deeply nested data)
  */
 export declare const merge: <T extends Record<string, unknown>, U extends Record<string, unknown>[]>(target: T, ...sources: U) => T & UnionToIntersection<U[number]>;

package/module/es5/Object/merge.js

@@ -9,10 +9,28 @@ exports.merge = void 0;
  * @param target - The target object to merge into
  * @param sources - The source objects to merge from
  * @returns The merged object
+ *
+ * @remarks
+ * **Prototype pollution warning:** This function does not filter out
+ * prototype-polluting keys (`__proto__`, `constructor`, `prototype`).
+ * If processing user-controlled input, sanitize with the appropriate
+ * `removePrototype*` helper before calling this function:
+ * - `removePrototype` — shallow sanitization of a single object
+ * - `removePrototypeDeep` — recursive sanitization of a single object (for deeply nested data)
+ * - `removePrototypeMap` — shallow sanitization of an array of objects
+ * - `removePrototypeMapDeep` — recursive sanitization of an array of objects (for deeply nested data)
  */
 var merge = exports.merge = function merge(target) {
+  var result = {};
   for (var _len = arguments.length, sources = new Array(_len > 1 ? _len - 1 : 0), _key = 1; _key < _len; _key++) {
     sources[_key - 1] = arguments[_key];
   }
-  return Object.assign.apply(Object, [{}, target].concat(sources));
+  for (var _i = 0, _arr = [target].concat(sources); _i < _arr.length; _i++) {
+    var object = _arr[_i];
+    for (var _i2 = 0, _Object$keys = Object.keys(object); _i2 < _Object$keys.length; _i2++) {
+      var key = _Object$keys[_i2];
+      result[key] = object[key];
+    }
+  }
+  return result;
 };

package/module/es5/Object/mergeDeep.d.ts

@@ -4,5 +4,15 @@ import type { UnionToIntersection } from "../types/logic/unionToIntersection";
  * @param target - The target object to merge into
  * @param sources - The source objects to merge from
  * @returns The deeply merged object
+ *
+ * @remarks
+ * **Prototype pollution warning:** This function does not filter out
+ * prototype-polluting keys (`__proto__`, `constructor`, `prototype`).
+ * If processing user-controlled input, sanitize with the appropriate
+ * `removePrototype*` helper before calling this function:
+ * - `removePrototype` — shallow sanitization of a single object
+ * - `removePrototypeDeep` — recursive sanitization of a single object (for deeply nested data)
+ * - `removePrototypeMap` — shallow sanitization of an array of objects
+ * - `removePrototypeMapDeep` — recursive sanitization of an array of objects (for deeply nested data)
  */
 export declare const mergeDeep: <T extends Record<string, unknown>, U extends Record<string, unknown>[]>(target: T, ...sources: U) => T & UnionToIntersection<U[number]>;

package/module/es5/Object/mergeDeep.js

@@ -11,33 +11,49 @@ function _objectSpread(e) { for (var r = 1; r < arguments.length; r++) { var t =
 function _defineProperty(e, r, t) { return (r = _toPropertyKey(r)) in e ? Object.defineProperty(e, r, { value: t, enumerable: !0, configurable: !0, writable: !0 }) : e[r] = t, e; }
 function _toPropertyKey(t) { var i = _toPrimitive(t, "string"); return "symbol" == _typeof(i) ? i : i + ""; }
 function _toPrimitive(t, r) { if ("object" != _typeof(t) || !t) return t; var e = t[Symbol.toPrimitive]; if (void 0 !== e) { var i = e.call(t, r || "default"); if ("object" != _typeof(i)) return i; throw new TypeError("@@toPrimitive must return a primitive value."); } return ("string" === r ? String : Number)(t); }
-/**
- * Deeply merges multiple objects into a single object
- * @param target - The target object to merge into
- * @param sources - The source objects to merge from
- * @returns The deeply merged object
- */
-var _mergeDeep = exports.mergeDeep = function mergeDeep(target) {
-  for (var _len = arguments.length, sources = new Array(_len > 1 ? _len - 1 : 0), _key = 1; _key < _len; _key++) {
-    sources[_key - 1] = arguments[_key];
-  }
-  if (sources.length === 0) {
+// Performance: use an index parameter instead of Array.shift() to advance
+// through sources. shift() is O(n) because it re-indexes every remaining
+// element, making the overall merge O(n²) in the number of sources.
+// An index makes each step O(1) and avoids mutating the sources array.
+var _mergeDeepInternal = function mergeDeepInternal(target, sources, depth) {
+  var sourceIndex = arguments.length > 3 && arguments[3] !== undefined ? arguments[3] : 0;
+  if (sourceIndex >= sources.length) {
     return target;
   }
-  var source = sources.shift();
+  var source = sources[sourceIndex];
   if ((0, _isPlainObject.isPlainObject)(target) && (0, _isPlainObject.isPlainObject)(source)) {
     var result = _objectSpread({}, target);
     for (var key in source) {
-      if (key === "__proto__" || key === "constructor" || key === "prototype") {
-        continue;
-      }
       if (Object.hasOwn(source, key)) {
         var sourceValue = source[key];
         var targetValue = result[key];
-        result[key] = (0, _isPlainObject.isPlainObject)(targetValue) && (0, _isPlainObject.isPlainObject)(sourceValue) ? _mergeDeep(targetValue, sourceValue) : sourceValue;
+        result[key] = (0, _isPlainObject.isPlainObject)(targetValue) && (0, _isPlainObject.isPlainObject)(sourceValue) ? _mergeDeepInternal(targetValue, [sourceValue], depth + 1) : sourceValue;
       }
     }
-    return _mergeDeep.apply(void 0, [result].concat(sources));
+    return _mergeDeepInternal(result, sources, depth + 1, sourceIndex + 1);
+  }
+  return _mergeDeepInternal(source, sources, depth + 1, sourceIndex + 1);
+};
+
+/**
+ * Deeply merges multiple objects into a single object
+ * @param target - The target object to merge into
+ * @param sources - The source objects to merge from
+ * @returns The deeply merged object
+ *
+ * @remarks
+ * **Prototype pollution warning:** This function does not filter out
+ * prototype-polluting keys (`__proto__`, `constructor`, `prototype`).
+ * If processing user-controlled input, sanitize with the appropriate
+ * `removePrototype*` helper before calling this function:
+ * - `removePrototype` — shallow sanitization of a single object
+ * - `removePrototypeDeep` — recursive sanitization of a single object (for deeply nested data)
+ * - `removePrototypeMap` — shallow sanitization of an array of objects
+ * - `removePrototypeMapDeep` — recursive sanitization of an array of objects (for deeply nested data)
+ */
+var mergeDeep = exports.mergeDeep = function mergeDeep(target) {
+  for (var _len = arguments.length, sources = new Array(_len > 1 ? _len - 1 : 0), _key = 1; _key < _len; _key++) {
+    sources[_key - 1] = arguments[_key];
   }
-  return _mergeDeep.apply(void 0, [source].concat(sources));
+  return _mergeDeepInternal(target, sources, 0);
 };

package/module/es5/Object/pickDeep.d.ts

@@ -9,6 +9,16 @@ import type { PickDeepKey } from "../types/object/pickDeepKey";
  * @param {...K[]} keys - Property keys to extract. Can use dot notation for nested properties.
  * @returns {PickDeep<T, K>} A new object containing only the specified properties.
  *
+ * @remarks
+ * **Prototype pollution warning:** This function does not filter out
+ * prototype-polluting keys (`__proto__`, `constructor`, `prototype`).
+ * If processing user-controlled input, sanitize with the appropriate
+ * `removePrototype*` helper before calling this function:
+ * - `removePrototype` — shallow sanitization of a single object
+ * - `removePrototypeDeep` — recursive sanitization of a single object (for deeply nested data)
+ * - `removePrototypeMap` — shallow sanitization of an array of objects
+ * - `removePrototypeMapDeep` — recursive sanitization of an array of objects (for deeply nested data)
+ *
  * @example
  * ```typescript
  * const obj = { a: { b: { c: 1, d: 2 }, e: 3 }, f: 4 };

package/module/es5/Object/pickDeep.js

@@ -21,6 +21,16 @@ function _arrayLikeToArray(r, a) { (null == a || a > r.length) && (a = r.length)
  * @param {...K[]} keys - Property keys to extract. Can use dot notation for nested properties.
  * @returns {PickDeep<T, K>} A new object containing only the specified properties.
  *
+ * @remarks
+ * **Prototype pollution warning:** This function does not filter out
+ * prototype-polluting keys (`__proto__`, `constructor`, `prototype`).
+ * If processing user-controlled input, sanitize with the appropriate
+ * `removePrototype*` helper before calling this function:
+ * - `removePrototype` — shallow sanitization of a single object
+ * - `removePrototypeDeep` — recursive sanitization of a single object (for deeply nested data)
+ * - `removePrototypeMap` — shallow sanitization of an array of objects
+ * - `removePrototypeMapDeep` — recursive sanitization of an array of objects (for deeply nested data)
+ *
  * @example
  * ```typescript
  * const obj = { a: { b: { c: 1, d: 2 }, e: 3 }, f: 4 };
@@ -48,9 +58,6 @@ var pickDeep = exports.pickDeep = function pickDeep(object) {
         var _step$value = _slicedToArray(_step.value, 2),
           index = _step$value[0],
           part = _step$value[1];
-        if (part === "__proto__" || part === "constructor" || part === "prototype") {
-          continue;
-        }
         if (current && _typeof(current) === "object" && part in current) {
           if (index === parts.length - 1) {
             target[part] = current[part];

package/module/es5/Object/removePrototype.d.ts

@@ -0,0 +1,15 @@
+/**
+ * Creates a new object with the same properties as the given object, but with the prototype polluting properties removed.
+ * ("__proto__", "constructor", "prototype" are excluded from the shallow copy)
+ *
+ * @param object - The object to remove the prototype polluting properties from.
+ * @returns A new object with the prototype polluting properties removed.
+ *
+ * @example
+ * ```typescript
+ * const obj = JSON.parse('{"__proto__":{"polluted":true},"a":1,"b":2}');
+ * const safeObj = removePrototype(obj);
+ * // safeObj is { a: 1, b: 2 } and "__proto__" is removed
+ * ```
+ */
+export declare const removePrototype: <T extends Record<string, unknown>>(object: T) => Omit<T, "__proto__" | "constructor" | "prototype">;

package/module/es5/Object/removePrototype.js

@@ -0,0 +1,31 @@
+"use strict";
+
+Object.defineProperty(exports, "__esModule", {
+  value: true
+});
+exports.removePrototype = void 0;
+/**
+ * Creates a new object with the same properties as the given object, but with the prototype polluting properties removed.
+ * ("__proto__", "constructor", "prototype" are excluded from the shallow copy)
+ *
+ * @param object - The object to remove the prototype polluting properties from.
+ * @returns A new object with the prototype polluting properties removed.
+ *
+ * @example
+ * ```typescript
+ * const obj = JSON.parse('{"__proto__":{"polluted":true},"a":1,"b":2}');
+ * const safeObj = removePrototype(obj);
+ * // safeObj is { a: 1, b: 2 } and "__proto__" is removed
+ * ```
+ */
+var removePrototype = exports.removePrototype = function removePrototype(object) {
+  var result = Object.create(null);
+  var keys = Object.keys(object);
+  for (var _i = 0, _keys = keys; _i < _keys.length; _i++) {
+    var key = _keys[_i];
+    if (key !== "__proto__" && key !== "constructor" && key !== "prototype") {
+      result[key] = object[key];
+    }
+  }
+  return result;
+};

package/module/es5/Object/removePrototypeDeep.d.ts

@@ -0,0 +1,11 @@
+/**
+ * Creates a new object with the same properties as the given object, but with
+ * the prototype polluting properties removed recursively.
+ * ("__proto__", "constructor", "prototype" are excluded from nested objects
+ * and objects inside arrays)
+ *
+ * @param object - The object to remove the prototype polluting properties from.
+ * @returns A new object with the prototype polluting properties removed
+ * recursively.
+ */
+export declare const removePrototypeDeep: <T extends Record<string, unknown>>(object: T) => T;

package/module/es5/Object/removePrototypeDeep.js

@@ -0,0 +1,81 @@
+"use strict";
+
+Object.defineProperty(exports, "__esModule", {
+  value: true
+});
+exports.removePrototypeDeep = void 0;
+var _isPlainObject = require("../Object/isPlainObject");
+function _createForOfIteratorHelper(r, e) { var t = "undefined" != typeof Symbol && r[Symbol.iterator] || r["@@iterator"]; if (!t) { if (Array.isArray(r) || (t = _unsupportedIterableToArray(r)) || e && r && "number" == typeof r.length) { t && (r = t); var _n = 0, F = function F() {}; return { s: F, n: function n() { return _n >= r.length ? { done: !0 } : { done: !1, value: r[_n++] }; }, e: function e(r) { throw r; }, f: F }; } throw new TypeError("Invalid attempt to iterate non-iterable instance.\nIn order to be iterable, non-array objects must have a [Symbol.iterator]() method."); } var o, a = !0, u = !1; return { s: function s() { t = t.call(r); }, n: function n() { var r = t.next(); return a = r.done, r; }, e: function e(r) { u = !0, o = r; }, f: function f() { try { a || null == t["return"] || t["return"](); } finally { if (u) throw o; } } }; }
+function _slicedToArray(r, e) { return _arrayWithHoles(r) || _iterableToArrayLimit(r, e) || _unsupportedIterableToArray(r, e) || _nonIterableRest(); }
+function _nonIterableRest() { throw new TypeError("Invalid attempt to destructure non-iterable instance.\nIn order to be iterable, non-array objects must have a [Symbol.iterator]() method."); }
+function _unsupportedIterableToArray(r, a) { if (r) { if ("string" == typeof r) return _arrayLikeToArray(r, a); var t = {}.toString.call(r).slice(8, -1); return "Object" === t && r.constructor && (t = r.constructor.name), "Map" === t || "Set" === t ? Array.from(r) : "Arguments" === t || /^(?:Ui|I)nt(?:8|16|32)(?:Clamped)?Array$/.test(t) ? _arrayLikeToArray(r, a) : void 0; } }
+function _arrayLikeToArray(r, a) { (null == a || a > r.length) && (a = r.length); for (var e = 0, n = Array(a); e < a; e++) n[e] = r[e]; return n; }
+function _iterableToArrayLimit(r, l) { var t = null == r ? null : "undefined" != typeof Symbol && r[Symbol.iterator] || r["@@iterator"]; if (null != t) { var e, n, i, u, a = [], f = !0, o = !1; try { if (i = (t = t.call(r)).next, 0 === l) { if (Object(t) !== t) return; f = !1; } else for (; !(f = (e = i.call(t)).done) && (a.push(e.value), a.length !== l); f = !0); } catch (r) { o = !0, n = r; } finally { try { if (!f && null != t["return"] && (u = t["return"](), Object(u) !== u)) return; } finally { if (o) throw n; } } return a; } }
+function _arrayWithHoles(r) { if (Array.isArray(r)) return r; }
+/**
+ * Creates a new object with the same properties as the given object, but with
+ * the prototype polluting properties removed recursively.
+ * ("__proto__", "constructor", "prototype" are excluded from nested objects
+ * and objects inside arrays)
+ *
+ * @param object - The object to remove the prototype polluting properties from.
+ * @returns A new object with the prototype polluting properties removed
+ * recursively.
+ */
+var removePrototypeDeep = exports.removePrototypeDeep = function removePrototypeDeep(object) {
+  var result = Object.create(null);
+  var stack = [[object, result]];
+  while (stack.length > 0) {
+    // biome-ignore lint/style/noNonNullAssertion: stack.length > 0 guarantees pop() returns a value
+    var _ref = stack.pop(),
+      _ref2 = _slicedToArray(_ref, 2),
+      source = _ref2[0],
+      destination = _ref2[1];
+    if (Array.isArray(source)) {
+      var array = destination;
+      var _iterator = _createForOfIteratorHelper(source),
+        _step;
+      try {
+        for (_iterator.s(); !(_step = _iterator.n()).done;) {
+          var value = _step.value;
+          if (Array.isArray(value)) {
+            var child = [];
+            array.push(child);
+            stack.push([value, child]);
+          } else if ((0, _isPlainObject.isPlainObject)(value)) {
+            var _child = Object.create(null);
+            array.push(_child);
+            stack.push([value, _child]);
+          } else {
+            array.push(value);
+          }
+        }
+      } catch (err) {
+        _iterator.e(err);
+      } finally {
+        _iterator.f();
+      }
+      continue;
+    }
+    var target = destination;
+    for (var _i = 0, _Object$keys = Object.keys(source); _i < _Object$keys.length; _i++) {
+      var key = _Object$keys[_i];
+      if (key === "__proto__" || key === "constructor" || key === "prototype") {
+        continue;
+      }
+      var _value = source[key];
+      if (Array.isArray(_value)) {
+        var _child2 = [];
+        target[key] = _child2;
+        stack.push([_value, _child2]);
+      } else if ((0, _isPlainObject.isPlainObject)(_value)) {
+        var _child3 = Object.create(null);
+        target[key] = _child3;
+        stack.push([_value, _child3]);
+      } else {
+        target[key] = _value;
+      }
+    }
+  }
+  return result;
+};