umt 2.14.0 → 2.16.0

package/module/Object/removePrototypeDeep.d.ts

@@ -0,0 +1,11 @@
+/**
+ * Creates a new object with the same properties as the given object, but with
+ * the prototype polluting properties removed recursively.
+ * ("__proto__", "constructor", "prototype" are excluded from nested objects
+ * and objects inside arrays)
+ *
+ * @param object - The object to remove the prototype polluting properties from.
+ * @returns A new object with the prototype polluting properties removed
+ * recursively.
+ */
+export declare const removePrototypeDeep: <T extends Record<string, unknown>>(object: T) => T;

package/module/Object/removePrototypeDeep.js

@@ -0,0 +1,60 @@
+import { isPlainObject } from "../Object/isPlainObject";
+/**
+ * Creates a new object with the same properties as the given object, but with
+ * the prototype polluting properties removed recursively.
+ * ("__proto__", "constructor", "prototype" are excluded from nested objects
+ * and objects inside arrays)
+ *
+ * @param object - The object to remove the prototype polluting properties from.
+ * @returns A new object with the prototype polluting properties removed
+ * recursively.
+ */
+export const removePrototypeDeep = (object) => {
+    const result = Object.create(null);
+    const stack = [[object, result]];
+    while (stack.length > 0) {
+        // biome-ignore lint/style/noNonNullAssertion: stack.length > 0 guarantees pop() returns a value
+        const [source, destination] = stack.pop();
+        if (Array.isArray(source)) {
+            const array = destination;
+            for (const value of source) {
+                if (Array.isArray(value)) {
+                    const child = [];
+                    array.push(child);
+                    stack.push([value, child]);
+                }
+                else if (isPlainObject(value)) {
+                    const child = Object.create(null);
+                    array.push(child);
+                    stack.push([value, child]);
+                }
+                else {
+                    array.push(value);
+                }
+            }
+            continue;
+        }
+        const target = destination;
+        for (const key of Object.keys(source)) {
+            if (key === "__proto__" || key === "constructor" || key === "prototype") {
+                continue;
+            }
+            const value = source[key];
+            if (Array.isArray(value)) {
+                const child = [];
+                target[key] = child;
+                stack.push([value, child]);
+            }
+            else if (isPlainObject(value)) {
+                const child = Object.create(null);
+                target[key] = child;
+                stack.push([value, child]);
+            }
+            else {
+                target[key] = value;
+            }
+        }
+    }
+    return result;
+};
+//# sourceMappingURL=removePrototypeDeep.js.map

package/module/Object/removePrototypeDeep.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"removePrototypeDeep.js","sourceRoot":"","sources":["../../src/Object/removePrototypeDeep.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AAEvD;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,CACjC,MAAS,EACN,EAAE;IACL,MAAM,MAAM,GAA4B,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAC5D,MAAM,KAAK,GAGL,CAAC,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IAEzB,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxB,gGAAgG;QAChG,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,GAAG,KAAK,CAAC,GAAG,EAAG,CAAC;QAE3C,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;YAC1B,MAAM,KAAK,GAAG,WAAwB,CAAC;YACvC,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;gBAC3B,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;oBACzB,MAAM,KAAK,GAAc,EAAE,CAAC;oBAC5B,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;oBAClB,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC;gBAC7B,CAAC;qBAAM,IAAI,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC;oBAChC,MAAM,KAAK,GAA4B,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;oBAC3D,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;oBAClB,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC;gBAC7B,CAAC;qBAAM,CAAC;oBACN,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;gBACpB,CAAC;YACH,CAAC;YACD,SAAS;QACX,CAAC;QAED,MAAM,MAAM,GAAG,WAAsC,CAAC;QACtD,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;YACtC,IAAI,GAAG,KAAK,WAAW,IAAI,GAAG,KAAK,aAAa,IAAI,GAAG,KAAK,WAAW,EAAE,CAAC;gBACxE,SAAS;YACX,CAAC;YACD,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;YAC1B,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;gBACzB,MAAM,KAAK,GAAc,EAAE,CAAC;gBAC5B,MAAM,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;gBACpB,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC;YAC7B,CAAC;iBAAM,IAAI,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC;gBAChC,MAAM,KAAK,GAA4B,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;gBAC3D,MAAM,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;gBACpB,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC;YAC7B,CAAC;iBAAM,CAAC;gBACN,MAAM,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;YACtB,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,MAAW,CAAC;AACrB,CAAC,CAAC"}

package/module/Object/removePrototypeMap.d.ts

@@ -0,0 +1,9 @@
+/**
+ * Creates a new array of objects with prototype polluting properties removed
+ * from each item.
+ *
+ * @param objects - The objects to remove the prototype polluting properties
+ * from.
+ * @returns A new array with shallowly sanitized objects.
+ */
+export declare const removePrototypeMap: <T extends Record<string, unknown>>(objects: readonly T[]) => Omit<T, "__proto__" | "constructor" | "prototype">[];

package/module/Object/removePrototypeMap.js

@@ -0,0 +1,13 @@
+import { removePrototype } from "../Object/removePrototype";
+/**
+ * Creates a new array of objects with prototype polluting properties removed
+ * from each item.
+ *
+ * @param objects - The objects to remove the prototype polluting properties
+ * from.
+ * @returns A new array with shallowly sanitized objects.
+ */
+export const removePrototypeMap = (objects) => {
+    return objects.map((object) => removePrototype(object));
+};
+//# sourceMappingURL=removePrototypeMap.js.map

package/module/Object/removePrototypeMap.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"removePrototypeMap.js","sourceRoot":"","sources":["../../src/Object/removePrototypeMap.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,0BAA0B,CAAC;AAE3D;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAChC,OAAqB,EACiC,EAAE;IACxD,OAAO,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC,CAAC;AAC1D,CAAC,CAAC"}

package/module/Object/removePrototypeMapDeep.d.ts

@@ -0,0 +1,9 @@
+/**
+ * Creates a new array of objects with prototype polluting properties removed
+ * recursively from each item.
+ *
+ * @param objects - The objects to remove the prototype polluting properties
+ * from recursively.
+ * @returns A new array with deeply sanitized objects.
+ */
+export declare const removePrototypeMapDeep: <T extends Record<string, unknown>>(objects: readonly T[]) => T[];

package/module/Object/removePrototypeMapDeep.js

@@ -0,0 +1,13 @@
+import { removePrototypeDeep } from "../Object/removePrototypeDeep";
+/**
+ * Creates a new array of objects with prototype polluting properties removed
+ * recursively from each item.
+ *
+ * @param objects - The objects to remove the prototype polluting properties
+ * from recursively.
+ * @returns A new array with deeply sanitized objects.
+ */
+export const removePrototypeMapDeep = (objects) => {
+    return objects.map((object) => removePrototypeDeep(object));
+};
+//# sourceMappingURL=removePrototypeMapDeep.js.map

package/module/Object/removePrototypeMapDeep.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"removePrototypeMapDeep.js","sourceRoot":"","sources":["../../src/Object/removePrototypeMapDeep.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mBAAmB,EAAE,MAAM,8BAA8B,CAAC;AAEnE;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,CACpC,OAAqB,EAChB,EAAE;IACP,OAAO,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,mBAAmB,CAAC,MAAM,CAAC,CAAC,CAAC;AAC9D,CAAC,CAAC"}

package/module/String/escapeHtml.js

@@ -1,5 +1,12 @@
 /**
- * HTML entities map for escaping
+ * HTML entities map for escaping.
+ *
+ * Security: The backtick (`) is included because it can be used as an HTML
+ * attribute delimiter in older browsers (e.g. IE), enabling XSS via
+ * constructs like <img src=`javascript:alert(1)`>. The forward slash (/)
+ * is included per OWASP XSS prevention recommendations to mitigate tag-
+ * closing injection (e.g. "</script>") when user input is embedded inside
+ * HTML elements.
  */
 const htmlEscapeMap = {
     "&": "&amp;",
@@ -7,6 +14,8 @@ const htmlEscapeMap = {
     ">": "&gt;",
     '"': "&quot;",
     "'": "&#39;",
+    "`": "&#x60;",
+    "/": "&#x2F;",
 };
 /**
  * Escapes HTML special characters in a string
@@ -14,6 +23,6 @@ const htmlEscapeMap = {
  * @returns The escaped string
  */
 export const escapeHtml = (string_) => {
-    return string_.replaceAll(/["&'<>]/g, (match) => htmlEscapeMap[match]);
+    return string_.replaceAll(/["&'/<>`]/g, (match) => htmlEscapeMap[match]);
 };
 //# sourceMappingURL=escapeHtml.js.map

package/module/String/escapeHtml.js.map

@@ -1 +1 @@
-{"version":3,"file":"escapeHtml.js","sourceRoot":"","sources":["../../src/String/escapeHtml.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH,MAAM,aAAa,GAA2B;IAC5C,GAAG,EAAE,OAAO;IACZ,GAAG,EAAE,MAAM;IACX,GAAG,EAAE,MAAM;IACX,GAAG,EAAE,QAAQ;IACb,GAAG,EAAE,OAAO;CACb,CAAC;AAEF;;;;GAIG;AACH,MAAM,CAAC,MAAM,UAAU,GAAG,CAAC,OAAe,EAAU,EAAE;IACpD,OAAO,OAAO,CAAC,UAAU,CAAC,UAAU,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,CAAC;AACzE,CAAC,CAAC"}
+{"version":3,"file":"escapeHtml.js","sourceRoot":"","sources":["../../src/String/escapeHtml.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,MAAM,aAAa,GAA2B;IAC5C,GAAG,EAAE,OAAO;IACZ,GAAG,EAAE,MAAM;IACX,GAAG,EAAE,MAAM;IACX,GAAG,EAAE,QAAQ;IACb,GAAG,EAAE,OAAO;IACZ,GAAG,EAAE,QAAQ;IACb,GAAG,EAAE,QAAQ;CACd,CAAC;AAEF;;;;GAIG;AACH,MAAM,CAAC,MAAM,UAAU,GAAG,CAAC,OAAe,EAAU,EAAE;IACpD,OAAO,OAAO,CAAC,UAAU,CAAC,YAAY,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,CAAC;AAC3E,CAAC,CAAC"}

package/module/String/formatString/applyFormatter.js

@@ -41,7 +41,7 @@ export function applyFormatter(value, formatterString, formatters) {
  */
 function parseArguments(argumentsString) {
     const arguments_ = [];
-    let current = "";
+    const chars = [];
     let inQuotes = false;
     let quoteChar = "";
     for (const char of argumentsString) {
@@ -56,15 +56,15 @@ function parseArguments(argumentsString) {
             continue;
         }
         if (!inQuotes && char === ",") {
-            const trimmed = current.trim();
+            const trimmed = chars.join("").trim();
             arguments_.push(trimmed === "" ? " " : trimmed);
-            current = "";
+            chars.length = 0;
             continue;
         }
-        current += char;
+        chars.push(char);
     }
     // Handle last argument
-    const trimmed = current.trim();
+    const trimmed = chars.join("").trim();
     arguments_.push(trimmed === "" ? " " : trimmed);
     return arguments_;
 }

package/module/String/formatString/applyFormatter.js.map

@@ -1 +1 @@
-{"version":3,"file":"applyFormatter.js","sourceRoot":"","sources":["../../../src/String/formatString/applyFormatter.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,UAAU,cAAc,CAC5B,KAAc,EACd,eAAuB,EACvB,UAAqC;IAErC,MAAM,KAAK,GAAG,yBAAyB,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;IAC9D,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC;IACvB,CAAC;IAED,MAAM,CAAC,EAAE,aAAa,EAAE,eAAe,CAAC,GAAG,KAAK,CAAC;IACjD,MAAM,SAAS,GAAG,UAAU,CAAC,aAAa,CAAC,CAAC;IAE5C,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC;IACvB,CAAC;IAED,MAAM,UAAU,GAAG,eAAe,CAAC,CAAC,CAAC,cAAc,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAE1E,OAAO,SAAS,CAAC,KAAK,EAAE,GAAG,UAAU,CAAC,CAAC;AACzC,CAAC;AAED;;;;GAIG;AACH,SAAS,cAAc,CAAC,eAAuB;IAC7C,MAAM,UAAU,GAAa,EAAE,CAAC;IAChC,IAAI,OAAO,GAAG,EAAE,CAAC;IACjB,IAAI,QAAQ,GAAG,KAAK,CAAC;IACrB,IAAI,SAAS,GAAG,EAAE,CAAC;IAEnB,KAAK,MAAM,IAAI,IAAI,eAAe,EAAE,CAAC;QACnC,IAAI,CAAC,QAAQ,IAAI,CAAC,IAAI,KAAK,GAAG,IAAI,IAAI,KAAK,GAAG,CAAC,EAAE,CAAC;YAChD,QAAQ,GAAG,IAAI,CAAC;YAChB,SAAS,GAAG,IAAI,CAAC;YACjB,SAAS;QACX,CAAC;QAED,IAAI,QAAQ,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YACnC,QAAQ,GAAG,KAAK,CAAC;YACjB,SAAS,GAAG,EAAE,CAAC;YACf,SAAS;QACX,CAAC;QAED,IAAI,CAAC,QAAQ,IAAI,IAAI,KAAK,GAAG,EAAE,CAAC;YAC9B,MAAM,OAAO,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC;YAC/B,UAAU,CAAC,IAAI,CAAC,OAAO,KAAK,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;YAChD,OAAO,GAAG,EAAE,CAAC;YACb,SAAS;QACX,CAAC;QAED,OAAO,IAAI,IAAI,CAAC;IAClB,CAAC;IAED,uBAAuB;IACvB,MAAM,OAAO,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC;IAC/B,UAAU,CAAC,IAAI,CAAC,OAAO,KAAK,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;IAEhD,OAAO,UAAU,CAAC;AACpB,CAAC"}
+{"version":3,"file":"applyFormatter.js","sourceRoot":"","sources":["../../../src/String/formatString/applyFormatter.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,UAAU,cAAc,CAC5B,KAAc,EACd,eAAuB,EACvB,UAAqC;IAErC,MAAM,KAAK,GAAG,yBAAyB,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;IAC9D,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC;IACvB,CAAC;IAED,MAAM,CAAC,EAAE,aAAa,EAAE,eAAe,CAAC,GAAG,KAAK,CAAC;IACjD,MAAM,SAAS,GAAG,UAAU,CAAC,aAAa,CAAC,CAAC;IAE5C,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC;IACvB,CAAC;IAED,MAAM,UAAU,GAAG,eAAe,CAAC,CAAC,CAAC,cAAc,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAE1E,OAAO,SAAS,CAAC,KAAK,EAAE,GAAG,UAAU,CAAC,CAAC;AACzC,CAAC;AAED;;;;GAIG;AACH,SAAS,cAAc,CAAC,eAAuB;IAC7C,MAAM,UAAU,GAAa,EAAE,CAAC;IAChC,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,IAAI,QAAQ,GAAG,KAAK,CAAC;IACrB,IAAI,SAAS,GAAG,EAAE,CAAC;IAEnB,KAAK,MAAM,IAAI,IAAI,eAAe,EAAE,CAAC;QACnC,IAAI,CAAC,QAAQ,IAAI,CAAC,IAAI,KAAK,GAAG,IAAI,IAAI,KAAK,GAAG,CAAC,EAAE,CAAC;YAChD,QAAQ,GAAG,IAAI,CAAC;YAChB,SAAS,GAAG,IAAI,CAAC;YACjB,SAAS;QACX,CAAC;QAED,IAAI,QAAQ,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YACnC,QAAQ,GAAG,KAAK,CAAC;YACjB,SAAS,GAAG,EAAE,CAAC;YACf,SAAS;QACX,CAAC;QAED,IAAI,CAAC,QAAQ,IAAI,IAAI,KAAK,GAAG,EAAE,CAAC;YAC9B,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;YACtC,UAAU,CAAC,IAAI,CAAC,OAAO,KAAK,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;YAChD,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC;YACjB,SAAS;QACX,CAAC;QAED,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACnB,CAAC;IAED,uBAAuB;IACvB,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IACtC,UAAU,CAAC,IAAI,CAAC,OAAO,KAAK,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;IAEhD,OAAO,UAAU,CAAC;AACpB,CAAC"}

package/module/String/formatString/getValue.js

@@ -1,3 +1,5 @@
+// Pre-compiled regex pattern for array index notation to avoid recompilation per path segment
+const ARRAY_INDEX_PATTERN = /^(.+?)\[(-?\d+)]$/;
 /**
  * Retrieves a value from an object using a dot-notation path with array index support.
  *
@@ -28,7 +30,7 @@ export function getValue(object, path) {
     const segments = [];
     const parts = path.split(".");
     for (const part of parts) {
-        const arrayMatch = /^(.+?)\[(-?\d+)]$/.exec(part);
+        const arrayMatch = ARRAY_INDEX_PATTERN.exec(part);
         if (arrayMatch) {
             const [, key, indexString] = arrayMatch;
             segments.push({ key, index: Number(indexString) });

package/module/String/formatString/getValue.js.map

@@ -1 +1 @@
-{"version":3,"file":"getValue.js","sourceRoot":"","sources":["../../../src/String/formatString/getValue.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,MAAM,UAAU,QAAQ,CAAC,MAAe,EAAE,IAAY;IACpD,MAAM,QAAQ,GAAsC,EAAE,CAAC;IAEvD,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAE9B,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,UAAU,GAAG,mBAAmB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAClD,IAAI,UAAU,EAAE,CAAC;YACf,MAAM,CAAC,EAAE,GAAG,EAAE,WAAW,CAAC,GAAG,UAAU,CAAC;YACxC,QAAQ,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC;QACrD,CAAC;aAAM,CAAC;YACN,QAAQ,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC;QAC/B,CAAC;IACH,CAAC;IAED,IAAI,OAAO,GAAG,MAAM,CAAC;IAErB,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAC/B,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,IAAI,IAAI,EAAE,CAAC;YACnD,OAAO;QACT,CAAC;QAED,OAAO,GAAI,OAAmC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAE5D,IAAI,OAAO,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;YAChC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;gBAC5B,OAAO;YACT,CAAC;YACD,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC;YAC5B,OAAO,GAAG,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QACzE,CAAC;IACH,CAAC;IAED,OAAO,OAAO,CAAC;AACjB,CAAC"}
+{"version":3,"file":"getValue.js","sourceRoot":"","sources":["../../../src/String/formatString/getValue.ts"],"names":[],"mappings":"AAAA,8FAA8F;AAC9F,MAAM,mBAAmB,GAAG,mBAAmB,CAAC;AAEhD;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,MAAM,UAAU,QAAQ,CAAC,MAAe,EAAE,IAAY;IACpD,MAAM,QAAQ,GAAsC,EAAE,CAAC;IAEvD,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAE9B,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,UAAU,GAAG,mBAAmB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAClD,IAAI,UAAU,EAAE,CAAC;YACf,MAAM,CAAC,EAAE,GAAG,EAAE,WAAW,CAAC,GAAG,UAAU,CAAC;YACxC,QAAQ,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC;QACrD,CAAC;aAAM,CAAC;YACN,QAAQ,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC;QAC/B,CAAC;IACH,CAAC;IAED,IAAI,OAAO,GAAG,MAAM,CAAC;IAErB,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAC/B,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,IAAI,IAAI,EAAE,CAAC;YACnD,OAAO;QACT,CAAC;QAED,OAAO,GAAI,OAAmC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAE5D,IAAI,OAAO,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;YAChC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;gBAC5B,OAAO;YACT,CAAC;YACD,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC;YAC5B,OAAO,GAAG,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QACzE,CAAC;IACH,CAAC;IAED,OAAO,OAAO,CAAC;AACjB,CAAC"}

package/module/String/levenshteinDistance.js

@@ -9,39 +9,56 @@ export const levenshteinDistance = (string1, string2) => {
     if (string1 === string2) {
         return 0;
     }
-    const length1 = string1.length;
-    const length2 = string2.length;
-    if (length1 === 0) {
-        return length2;
+    let short = string1;
+    let long = string2;
+    let shortLength = short.length;
+    let longLength = long.length;
+    if (shortLength === 0) {
+        return longLength;
     }
-    if (length2 === 0) {
-        return length1;
+    if (longLength === 0) {
+        return shortLength;
     }
-    // Ensure string1 is the shorter string to minimize space complexity to O(min(N, M))
-    if (length1 > length2) {
-        return levenshteinDistance(string2, string1);
+    // Ensure short is the shorter string to minimize space complexity to O(min(N, M))
+    if (shortLength > longLength) {
+        short = string2;
+        long = string1;
+        shortLength = short.length;
+        longLength = long.length;
     }
     // Create a single row array to store distances
     // We only need the current row and the previous diagonal value
-    const row = Array.from({ length: length1 + 1 });
-    // Initialize first row (0 to length1)
-    for (let index = 0; index <= length1; index++) {
+    const row = Array.from({ length: shortLength + 1 });
+    // Initialize first row (0 to shortLength)
+    for (let index = 0; index <= shortLength; index++) {
         row[index] = index;
     }
-    // Iterate through each character of string2
-    for (let index = 1; index <= length2; index++) {
-        let previousDiagonal = row[0]; // Stores the value of matrix[i-1][j-1]
-        row[0] = index; // Update first element for the new row (matrix[0][j])
-        const char2 = string2[index - 1];
-        for (let index = 1; index <= length1; index++) {
-            const temporary = row[index]; // Store current value to become prevDiagonal for next iteration
-            const cost = string1[index - 1] === char2 ? 0 : 1;
-            row[index] = Math.min(row[index] + 1, // deletion (value from previous row, same column)
-            row[index - 1] + 1, // insertion (value from current row, previous column)
-            previousDiagonal + cost);
+    // Iterate through each character of the longer string (rows)
+    for (let rowIndex = 1; rowIndex <= longLength; rowIndex++) {
+        let previousDiagonal = row[0];
+        row[0] = rowIndex;
+        // eslint-disable-next-line unicorn/prefer-code-point
+        const charCode = long.charCodeAt(rowIndex - 1);
+        for (let colIndex = 1; colIndex <= shortLength; colIndex++) {
+            const temporary = row[colIndex];
+            // eslint-disable-next-line unicorn/prefer-code-point
+            const cost = short.charCodeAt(colIndex - 1) === charCode ? 0 : 1;
+            // Inline min of three values instead of Math.min() call to avoid
+            // function-call overhead in this hot loop
+            const deletion = row[colIndex] + 1;
+            const insertion = row[colIndex - 1] + 1;
+            const substitution = previousDiagonal + cost;
+            let value = deletion;
+            if (insertion < value) {
+                value = insertion;
+            }
+            if (substitution < value) {
+                value = substitution;
+            }
+            row[colIndex] = value;
             previousDiagonal = temporary;
         }
     }
-    return row[length1];
+    return row[shortLength];
 };
 //# sourceMappingURL=levenshteinDistance.js.map

package/module/String/levenshteinDistance.js.map

@@ -1 +1 @@
-{"version":3,"file":"levenshteinDistance.js","sourceRoot":"","sources":["../../src/String/levenshteinDistance.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,CACjC,OAAe,EACf,OAAe,EACP,EAAE;IACV,IAAI,OAAO,KAAK,OAAO,EAAE,CAAC;QACxB,OAAO,CAAC,CAAC;IACX,CAAC;IAED,MAAM,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC;IAC/B,MAAM,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC;IAE/B,IAAI,OAAO,KAAK,CAAC,EAAE,CAAC;QAClB,OAAO,OAAO,CAAC;IACjB,CAAC;IACD,IAAI,OAAO,KAAK,CAAC,EAAE,CAAC;QAClB,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,oFAAoF;IACpF,IAAI,OAAO,GAAG,OAAO,EAAE,CAAC;QACtB,OAAO,mBAAmB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IAC/C,CAAC;IAED,+CAA+C;IAC/C,+DAA+D;IAC/D,MAAM,GAAG,GAAa,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,OAAO,GAAG,CAAC,EAAE,CAAC,CAAC;IAE1D,sCAAsC;IACtC,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,IAAI,OAAO,EAAE,KAAK,EAAE,EAAE,CAAC;QAC9C,GAAG,CAAC,KAAK,CAAC,GAAG,KAAK,CAAC;IACrB,CAAC;IAED,4CAA4C;IAC5C,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,IAAI,OAAO,EAAE,KAAK,EAAE,EAAE,CAAC;QAC9C,IAAI,gBAAgB,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,uCAAuC;QACtE,GAAG,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,CAAC,sDAAsD;QAEtE,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;QAEjC,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,IAAI,OAAO,EAAE,KAAK,EAAE,EAAE,CAAC;YAC9C,MAAM,SAAS,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,gEAAgE;YAC9F,MAAM,IAAI,GAAG,OAAO,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YAElD,GAAG,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,GAAG,CACnB,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,kDAAkD;YAClE,GAAG,CAAC,KAAK,GAAG,CAAC,CAAC,GAAG,CAAC,EAAE,sDAAsD;YAC1E,gBAAgB,GAAG,IAAI,CACxB,CAAC;YAEF,gBAAgB,GAAG,SAAS,CAAC;QAC/B,CAAC;IACH,CAAC;IAED,OAAO,GAAG,CAAC,OAAO,CAAC,CAAC;AACtB,CAAC,CAAC"}
+{"version":3,"file":"levenshteinDistance.js","sourceRoot":"","sources":["../../src/String/levenshteinDistance.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,CACjC,OAAe,EACf,OAAe,EACP,EAAE;IACV,IAAI,OAAO,KAAK,OAAO,EAAE,CAAC;QACxB,OAAO,CAAC,CAAC;IACX,CAAC;IAED,IAAI,KAAK,GAAG,OAAO,CAAC;IACpB,IAAI,IAAI,GAAG,OAAO,CAAC;IACnB,IAAI,WAAW,GAAG,KAAK,CAAC,MAAM,CAAC;IAC/B,IAAI,UAAU,GAAG,IAAI,CAAC,MAAM,CAAC;IAE7B,IAAI,WAAW,KAAK,CAAC,EAAE,CAAC;QACtB,OAAO,UAAU,CAAC;IACpB,CAAC;IACD,IAAI,UAAU,KAAK,CAAC,EAAE,CAAC;QACrB,OAAO,WAAW,CAAC;IACrB,CAAC;IAED,kFAAkF;IAClF,IAAI,WAAW,GAAG,UAAU,EAAE,CAAC;QAC7B,KAAK,GAAG,OAAO,CAAC;QAChB,IAAI,GAAG,OAAO,CAAC;QACf,WAAW,GAAG,KAAK,CAAC,MAAM,CAAC;QAC3B,UAAU,GAAG,IAAI,CAAC,MAAM,CAAC;IAC3B,CAAC;IAED,+CAA+C;IAC/C,+DAA+D;IAC/D,MAAM,GAAG,GAAa,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,WAAW,GAAG,CAAC,EAAE,CAAC,CAAC;IAE9D,0CAA0C;IAC1C,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,IAAI,WAAW,EAAE,KAAK,EAAE,EAAE,CAAC;QAClD,GAAG,CAAC,KAAK,CAAC,GAAG,KAAK,CAAC;IACrB,CAAC;IAED,6DAA6D;IAC7D,KAAK,IAAI,QAAQ,GAAG,CAAC,EAAE,QAAQ,IAAI,UAAU,EAAE,QAAQ,EAAE,EAAE,CAAC;QAC1D,IAAI,gBAAgB,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC;QAC9B,GAAG,CAAC,CAAC,CAAC,GAAG,QAAQ,CAAC;QAElB,qDAAqD;QACrD,MAAM,QAAQ,GAAG,IAAI,CAAC,UAAU,CAAC,QAAQ,GAAG,CAAC,CAAC,CAAC;QAE/C,KAAK,IAAI,QAAQ,GAAG,CAAC,EAAE,QAAQ,IAAI,WAAW,EAAE,QAAQ,EAAE,EAAE,CAAC;YAC3D,MAAM,SAAS,GAAG,GAAG,CAAC,QAAQ,CAAC,CAAC;YAChC,qDAAqD;YACrD,MAAM,IAAI,GAAG,KAAK,CAAC,UAAU,CAAC,QAAQ,GAAG,CAAC,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YAEjE,iEAAiE;YACjE,0CAA0C;YAC1C,MAAM,QAAQ,GAAG,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;YACnC,MAAM,SAAS,GAAG,GAAG,CAAC,QAAQ,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC;YACxC,MAAM,YAAY,GAAG,gBAAgB,GAAG,IAAI,CAAC;YAE7C,IAAI,KAAK,GAAG,QAAQ,CAAC;YACrB,IAAI,SAAS,GAAG,KAAK,EAAE,CAAC;gBACtB,KAAK,GAAG,SAAS,CAAC;YACpB,CAAC;YACD,IAAI,YAAY,GAAG,KAAK,EAAE,CAAC;gBACzB,KAAK,GAAG,YAAY,CAAC;YACvB,CAAC;YAED,GAAG,CAAC,QAAQ,CAAC,GAAG,KAAK,CAAC;YACtB,gBAAgB,GAAG,SAAS,CAAC;QAC/B,CAAC;IACH,CAAC;IAED,OAAO,GAAG,CAAC,WAAW,CAAC,CAAC;AAC1B,CAAC,CAAC"}

package/module/String/slugify.js

@@ -8,14 +8,16 @@
  * slugify("Japanese: こんにちは"); // "japanese"
  */
 export const slugify = (string_) => {
-    return string_
+    return (string_
         .normalize("NFD")
+        // Strip combining diacritical marks (e.g. accents)
         .replaceAll(/[\u0300-\u036F]/g, "")
         .toLowerCase()
-        .replaceAll(/[^\s\w-]/g, "-")
-        .replaceAll(/\s+/g, "-")
-        .replaceAll(/_+/g, "-")
+        // Consolidate non-word chars, whitespace, and underscores into a single
+        // hyphen in one pass instead of three separate regex scans
+        .replaceAll(/[^\w-]+|_+/g, "-")
+        // Collapse consecutive hyphens and strip leading/trailing hyphens
         .replaceAll(/-+/g, "-")
-        .replaceAll(/^-+|-+$/g, "");
+        .replaceAll(/^-|-$/g, ""));
 };
 //# sourceMappingURL=slugify.js.map

package/module/String/slugify.js.map

@@ -1 +1 @@
-{"version":3,"file":"slugify.js","sourceRoot":"","sources":["../../src/String/slugify.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,OAAO,GAAG,CAAC,OAAe,EAAU,EAAE;IACjD,OAAO,OAAO;SACX,SAAS,CAAC,KAAK,CAAC;SAChB,UAAU,CAAC,kBAAkB,EAAE,EAAE,CAAC;SAClC,WAAW,EAAE;SACb,UAAU,CAAC,WAAW,EAAE,GAAG,CAAC;SAC5B,UAAU,CAAC,MAAM,EAAE,GAAG,CAAC;SACvB,UAAU,CAAC,KAAK,EAAE,GAAG,CAAC;SACtB,UAAU,CAAC,KAAK,EAAE,GAAG,CAAC;SACtB,UAAU,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;AAChC,CAAC,CAAC"}
+{"version":3,"file":"slugify.js","sourceRoot":"","sources":["../../src/String/slugify.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,OAAO,GAAG,CAAC,OAAe,EAAU,EAAE;IACjD,OAAO,CACL,OAAO;SACJ,SAAS,CAAC,KAAK,CAAC;QACjB,mDAAmD;SAClD,UAAU,CAAC,kBAAkB,EAAE,EAAE,CAAC;SAClC,WAAW,EAAE;QACd,wEAAwE;QACxE,2DAA2D;SAC1D,UAAU,CAAC,aAAa,EAAE,GAAG,CAAC;QAC/B,kEAAkE;SACjE,UAAU,CAAC,KAAK,EAAE,GAAG,CAAC;SACtB,UAAU,CAAC,QAAQ,EAAE,EAAE,CAAC,CAC5B,CAAC;AACJ,CAAC,CAAC"}

package/module/String/trimEndCharacters.js

@@ -12,8 +12,10 @@
  * ```
  */
 export const trimEndCharacters = (string_, chars) => {
+    // Use Set for O(1) character lookups instead of O(m) string.includes()
+    const charSet = new Set(chars);
     let endIndex = string_.length - 1;
-    while (endIndex >= 0 && chars.includes(string_[endIndex])) {
+    while (endIndex >= 0 && charSet.has(string_[endIndex])) {
         endIndex--;
     }
     return string_.slice(0, endIndex + 1);

package/module/String/trimEndCharacters.js.map

@@ -1 +1 @@
-{"version":3,"file":"trimEndCharacters.js","sourceRoot":"","sources":["../../src/String/trimEndCharacters.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,OAAe,EAAE,KAAa,EAAU,EAAE;IAC1E,IAAI,QAAQ,GAAG,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC;IAClC,OAAO,QAAQ,IAAI,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC;QAC1D,QAAQ,EAAE,CAAC;IACb,CAAC;IACD,OAAO,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,QAAQ,GAAG,CAAC,CAAC,CAAC;AACxC,CAAC,CAAC"}
+{"version":3,"file":"trimEndCharacters.js","sourceRoot":"","sources":["../../src/String/trimEndCharacters.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,OAAe,EAAE,KAAa,EAAU,EAAE;IAC1E,uEAAuE;IACvE,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;IAC/B,IAAI,QAAQ,GAAG,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC;IAClC,OAAO,QAAQ,IAAI,CAAC,IAAI,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC;QACvD,QAAQ,EAAE,CAAC;IACb,CAAC;IACD,OAAO,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,QAAQ,GAAG,CAAC,CAAC,CAAC;AACxC,CAAC,CAAC"}

package/module/String/trimStartCharacters.js

@@ -12,8 +12,10 @@
  * ```
  */
 export const trimStartCharacters = (string_, chars) => {
+    // Use Set for O(1) character lookups instead of O(m) string.includes()
+    const charSet = new Set(chars);
     let startIndex = 0;
-    while (startIndex < string_.length && chars.includes(string_[startIndex])) {
+    while (startIndex < string_.length && charSet.has(string_[startIndex])) {
         startIndex++;
     }
     return string_.slice(startIndex);

package/module/String/trimStartCharacters.js.map

@@ -1 +1 @@
-{"version":3,"file":"trimStartCharacters.js","sourceRoot":"","sources":["../../src/String/trimStartCharacters.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,OAAe,EAAE,KAAa,EAAU,EAAE;IAC5E,IAAI,UAAU,GAAG,CAAC,CAAC;IACnB,OAAO,UAAU,GAAG,OAAO,CAAC,MAAM,IAAI,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,EAAE,CAAC;QAC1E,UAAU,EAAE,CAAC;IACf,CAAC;IACD,OAAO,OAAO,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;AACnC,CAAC,CAAC"}
+{"version":3,"file":"trimStartCharacters.js","sourceRoot":"","sources":["../../src/String/trimStartCharacters.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,OAAe,EAAE,KAAa,EAAU,EAAE;IAC5E,uEAAuE;IACvE,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;IAC/B,IAAI,UAAU,GAAG,CAAC,CAAC;IACnB,OAAO,UAAU,GAAG,OAAO,CAAC,MAAM,IAAI,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,EAAE,CAAC;QACvE,UAAU,EAAE,CAAC;IACf,CAAC;IACD,OAAO,OAAO,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;AACnC,CAAC,CAAC"}

package/module/String/unescapeHtml.d.ts

@@ -5,7 +5,7 @@
  * @example
  * ```typescript
  * unescapeHtml("<script>alert("Hello");</script>");
- * // Returns: "<script>alert("Hello");</script>"
+ * // Returns: "<script>alert(\"Hello\");</script>"
  *
  * unescapeHtml("Tom &amp; Jerry");
  * // Returns: "Tom & Jerry"

package/module/String/unescapeHtml.js

@@ -12,6 +12,36 @@ const htmlUnescapeMap = {
     "`": "`",
     "=": "=",
 };
+/**
+ * Security: Checks whether a numeric code point is safe to decode.
+ * Rejects NULL (0), C0 control chars (1-31 except TAB 9, LF 10, CR 13),
+ * DEL (127), C1 control chars (128-159), lone surrogates (0xD800-0xDFFF),
+ * and values beyond the Unicode maximum (>0x10FFFF).
+ */
+const isSafeCodePoint = (codePoint) => {
+    if (codePoint > 0x10_ff_ff) {
+        return false;
+    }
+    if (codePoint === 0) {
+        return false;
+    }
+    if (codePoint >= 0xd8_00 && codePoint <= 0xdf_ff) {
+        return false;
+    }
+    if (codePoint <= 0x1f &&
+        codePoint !== 0x09 &&
+        codePoint !== 0x0a &&
+        codePoint !== 0x0d) {
+        return false;
+    }
+    if (codePoint === 0x7f) {
+        return false;
+    }
+    if (codePoint >= 0x80 && codePoint <= 0x9f) {
+        return false;
+    }
+    return true;
+};
 /**
  * Unescapes HTML entities in a string
  * @param string_ - The string to unescape
@@ -19,7 +49,7 @@ const htmlUnescapeMap = {
  * @example
  * ```typescript
  * unescapeHtml("&lt;script&gt;alert(&quot;Hello&quot;);&lt;/script&gt;");
- * // Returns: "<script>alert("Hello");</script>"
+ * // Returns: "<script>alert(\"Hello\");</script>"
  *
  * unescapeHtml("Tom &amp; Jerry");
  * // Returns: "Tom & Jerry"
@@ -29,15 +59,29 @@ const htmlUnescapeMap = {
  * ```
  */
 export const unescapeHtml = (string_) => {
-    const entityRegex = /&(?:amp|lt|gt|quot|#39|#x27|#x2F|#x60|#x3D);|&#(\d*);|&#x([\dA-Fa-f]*);/g;
+    const entityRegex = /&(?:amp|lt|gt|quot|#39|#x27|#x2F|#x60|#x3D);|&#(\d{1,7});|&#x([\dA-Fa-f]{1,6});/g;
     return string_.replaceAll(entityRegex, (match, dec, hex) => {
         if (dec !== undefined) {
             const codePoint = Number.parseInt(dec, 10);
-            return Number.isNaN(codePoint) ? match : String.fromCodePoint(codePoint);
+            // Security: reject dangerous code points to prevent injection attacks.
+            // NULL bytes (0) enable null-byte injection that can truncate strings in
+            // downstream systems. C0 control chars (1-31 except TAB/LF/CR) and the
+            // DEL char (127) can break parsers. C1 control chars (128-159) are
+            // invalid in HTML. Surrogate code points (0xD800-0xDFFF) produce
+            // malformed strings. Out-of-range values (>0x10FFFF) are not valid
+            // Unicode. Leave these entity references unmodified rather than decoding
+            // them into potentially dangerous characters.
+            if (!isSafeCodePoint(codePoint)) {
+                return match;
+            }
+            return String.fromCodePoint(codePoint);
         }
         if (hex !== undefined) {
             const codePoint = Number.parseInt(hex, 16);
-            return Number.isNaN(codePoint) ? match : String.fromCodePoint(codePoint);
+            if (!isSafeCodePoint(codePoint)) {
+                return match;
+            }
+            return String.fromCodePoint(codePoint);
         }
         return htmlUnescapeMap[match];
     });

package/module/String/unescapeHtml.js.map

@@ -1 +1 @@
-{"version":3,"file":"unescapeHtml.js","sourceRoot":"","sources":["../../src/String/unescapeHtml.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH,MAAM,eAAe,GAA2B;IAC9C,OAAO,EAAE,GAAG;IACZ,MAAM,EAAE,GAAG;IACX,MAAM,EAAE,GAAG;IACX,QAAQ,EAAE,GAAG;IACb,OAAO,EAAE,GAAG;IACZ,QAAQ,EAAE,GAAG;IACb,QAAQ,EAAE,GAAG;IACb,QAAQ,EAAE,GAAG;IACb,QAAQ,EAAE,GAAG;CACd,CAAC;AAEF;;;;;;;;;;;;;;;GAeG;AACH,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,OAAe,EAAU,EAAE;IACtD,MAAM,WAAW,GACf,0EAA0E,CAAC;IAE7E,OAAO,OAAO,CAAC,UAAU,CAAC,WAAW,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QACzD,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;YACtB,MAAM,SAAS,GAAG,MAAM,CAAC,QAAQ,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;YAC3C,OAAO,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC,SAAS,CAAC,CAAC;QAC3E,CAAC;QACD,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;YACtB,MAAM,SAAS,GAAG,MAAM,CAAC,QAAQ,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;YAC3C,OAAO,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC,SAAS,CAAC,CAAC;QAC3E,CAAC;QACD,OAAO,eAAe,CAAC,KAAK,CAAC,CAAC;IAChC,CAAC,CAAC,CAAC;AACL,CAAC,CAAC"}
+{"version":3,"file":"unescapeHtml.js","sourceRoot":"","sources":["../../src/String/unescapeHtml.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH,MAAM,eAAe,GAA2B;IAC9C,OAAO,EAAE,GAAG;IACZ,MAAM,EAAE,GAAG;IACX,MAAM,EAAE,GAAG;IACX,QAAQ,EAAE,GAAG;IACb,OAAO,EAAE,GAAG;IACZ,QAAQ,EAAE,GAAG;IACb,QAAQ,EAAE,GAAG;IACb,QAAQ,EAAE,GAAG;IACb,QAAQ,EAAE,GAAG;CACd,CAAC;AAEF;;;;;GAKG;AACH,MAAM,eAAe,GAAG,CAAC,SAAiB,EAAW,EAAE;IACrD,IAAI,SAAS,GAAG,UAAU,EAAE,CAAC;QAC3B,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,SAAS,KAAK,CAAC,EAAE,CAAC;QACpB,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,SAAS,IAAI,OAAO,IAAI,SAAS,IAAI,OAAO,EAAE,CAAC;QACjD,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IACE,SAAS,IAAI,IAAI;QACjB,SAAS,KAAK,IAAI;QAClB,SAAS,KAAK,IAAI;QAClB,SAAS,KAAK,IAAI,EAClB,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,SAAS,KAAK,IAAI,EAAE,CAAC;QACvB,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,SAAS,IAAI,IAAI,IAAI,SAAS,IAAI,IAAI,EAAE,CAAC;QAC3C,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC,CAAC;AAEF;;;;;;;;;;;;;;;GAeG;AACH,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,OAAe,EAAU,EAAE;IACtD,MAAM,WAAW,GACf,kFAAkF,CAAC;IAErF,OAAO,OAAO,CAAC,UAAU,CAAC,WAAW,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QACzD,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;YACtB,MAAM,SAAS,GAAG,MAAM,CAAC,QAAQ,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;YAC3C,uEAAuE;YACvE,yEAAyE;YACzE,uEAAuE;YACvE,mEAAmE;YACnE,iEAAiE;YACjE,mEAAmE;YACnE,yEAAyE;YACzE,8CAA8C;YAC9C,IAAI,CAAC,eAAe,CAAC,SAAS,CAAC,EAAE,CAAC;gBAChC,OAAO,KAAK,CAAC;YACf,CAAC;YACD,OAAO,MAAM,CAAC,aAAa,CAAC,SAAS,CAAC,CAAC;QACzC,CAAC;QACD,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;YACtB,MAAM,SAAS,GAAG,MAAM,CAAC,QAAQ,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;YAC3C,IAAI,CAAC,eAAe,CAAC,SAAS,CAAC,EAAE,CAAC;gBAChC,OAAO,KAAK,CAAC;YACf,CAAC;YACD,OAAO,MAAM,CAAC,aAAa,CAAC,SAAS,CAAC,CAAC;QACzC,CAAC;QACD,OAAO,eAAe,CAAC,KAAK,CAAC,CAAC;IAChC,CAAC,CAAC,CAAC;AACL,CAAC,CAAC"}

package/module/Tool/parseJson.js

@@ -1,3 +1,10 @@
+// Security: Keys that must be stripped during JSON parsing to prevent
+// prototype pollution. If an attacker controls the JSON input, they can
+// embed keys like "__proto__" which, when the parsed object is later
+// spread or merged (e.g. via Object.assign, spread operator, or any
+// deep-merge utility), can overwrite properties on Object.prototype
+// and affect all objects in the runtime.
+const DANGEROUS_KEYS = new Set(["__proto__", "constructor", "prototype"]);
 /**
  * Parses a JSON string into a typed JavaScript value
  * @template T The expected type of the parsed value (defaults to unknown)
@@ -6,6 +13,11 @@
  * @throws {SyntaxError} If the JSON string is invalid
  */
 export const parseJson = (json) => {
-    return JSON.parse(json);
+    return JSON.parse(json, (key, value) => {
+        if (DANGEROUS_KEYS.has(key)) {
+            return;
+        }
+        return value;
+    });
 };
 //# sourceMappingURL=parseJson.js.map

package/module/Tool/parseJson.js.map

@@ -1 +1 @@
-{"version":3,"file":"parseJson.js","sourceRoot":"","sources":["../../src/Tool/parseJson.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,SAAS,GAAG,CAAc,IAAY,EAAK,EAAE;IACxD,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC,CAAC"}
+{"version":3,"file":"parseJson.js","sourceRoot":"","sources":["../../src/Tool/parseJson.ts"],"names":[],"mappings":"AAAA,sEAAsE;AACtE,wEAAwE;AACxE,qEAAqE;AACrE,oEAAoE;AACpE,oEAAoE;AACpE,yCAAyC;AACzC,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC,CAAC,WAAW,EAAE,aAAa,EAAE,WAAW,CAAC,CAAC,CAAC;AAE1E;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,SAAS,GAAG,CAAc,IAAY,EAAK,EAAE;IACxD,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,GAAG,EAAE,KAAK,EAAE,EAAE;QACrC,IAAI,cAAc,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YAC5B,OAAO;QACT,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC,CAAC,CAAC;AACL,CAAC,CAAC"}

package/module/URL/buildUrl.js

@@ -17,6 +17,10 @@
 export const buildUrl = (base, parameters = {}) => {
     const url = new URL(base);
     for (const key of Object.keys(parameters)) {
+        // Prevent prototype pollution by rejecting dangerous keys
+        if (key === "__proto__" || key === "constructor" || key === "prototype") {
+            continue;
+        }
         url.searchParams.append(key, parameters[key]);
     }
     return url.toString();

package/module/URL/buildUrl.js.map

@@ -1 +1 @@
-{"version":3,"file":"buildUrl.js","sourceRoot":"","sources":["../../src/URL/buildUrl.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AACH,MAAM,CAAC,MAAM,QAAQ,GAAG,CACtB,IAAY,EACZ,aAAqC,EAAE,EAC/B,EAAE;IACV,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,CAAC;IAC1B,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;QAC1C,GAAG,CAAC,YAAY,CAAC,MAAM,CAAC,GAAG,EAAE,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC;IAChD,CAAC;IACD,OAAO,GAAG,CAAC,QAAQ,EAAE,CAAC;AACxB,CAAC,CAAC"}
+{"version":3,"file":"buildUrl.js","sourceRoot":"","sources":["../../src/URL/buildUrl.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AACH,MAAM,CAAC,MAAM,QAAQ,GAAG,CACtB,IAAY,EACZ,aAAqC,EAAE,EAC/B,EAAE;IACV,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,CAAC;IAC1B,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;QAC1C,0DAA0D;QAC1D,IAAI,GAAG,KAAK,WAAW,IAAI,GAAG,KAAK,aAAa,IAAI,GAAG,KAAK,WAAW,EAAE,CAAC;YACxE,SAAS;QACX,CAAC;QACD,GAAG,CAAC,YAAY,CAAC,MAAM,CAAC,GAAG,EAAE,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC;IAChD,CAAC;IACD,OAAO,GAAG,CAAC,QAAQ,EAAE,CAAC;AACxB,CAAC,CAAC"}

package/module/URL/parseQueryString.js

@@ -27,6 +27,10 @@ export const parseQueryString = (query) => {
     const parameters = new URLSearchParams(searchString);
     const result = {};
     for (const [key, value] of parameters) {
+        // Prevent prototype pollution by rejecting dangerous keys
+        if (key === "__proto__" || key === "constructor" || key === "prototype") {
+            continue;
+        }
         result[key] = value;
     }
     return result;

package/module/URL/parseQueryString.js.map

@@ -1 +1 @@
-{"version":3,"file":"parseQueryString.js","sourceRoot":"","sources":["../../src/URL/parseQueryString.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,KAAa,EAA0B,EAAE;IACxE,IAAI,YAAY,GAAG,KAAK,CAAC;IACzB,IAAI,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QAC1B,YAAY,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC;IACvC,CAAC;IAED,MAAM,UAAU,GAAG,IAAI,eAAe,CAAC,YAAY,CAAC,CAAC;IACrD,MAAM,MAAM,GAA2B,EAAE,CAAC;IAC1C,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,UAAU,EAAE,CAAC;QACtC,MAAM,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;IACtB,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC,CAAC"}
+{"version":3,"file":"parseQueryString.js","sourceRoot":"","sources":["../../src/URL/parseQueryString.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,KAAa,EAA0B,EAAE;IACxE,IAAI,YAAY,GAAG,KAAK,CAAC;IACzB,IAAI,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QAC1B,YAAY,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC;IACvC,CAAC;IAED,MAAM,UAAU,GAAG,IAAI,eAAe,CAAC,YAAY,CAAC,CAAC;IACrD,MAAM,MAAM,GAA2B,EAAE,CAAC;IAC1C,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,UAAU,EAAE,CAAC;QACtC,0DAA0D;QAC1D,IAAI,GAAG,KAAK,WAAW,IAAI,GAAG,KAAK,aAAa,IAAI,GAAG,KAAK,WAAW,EAAE,CAAC;YACxE,SAAS;QACX,CAAC;QACD,MAAM,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;IACtB,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC,CAAC"}

package/module/Validate/isDeepEqual.js

@@ -59,12 +59,14 @@ export function isDeepEqual(a, b, options = {}) {
                 }
             }
             else {
-                const yCopy = [...y];
+                // Performance: Use Set<number> to track matched indices instead of
+                // splice(), avoiding O(n) array shifts per removal (O(n²) → O(n)).
+                const usedIndices = new Set();
                 for (const itemX of x) {
                     let found = false;
-                    for (let index = 0; index < yCopy.length; index++) {
-                        if (compare(itemX, yCopy[index])) {
-                            yCopy.splice(index, 1);
+                    for (const [index, itemY] of y.entries()) {
+                        if (!usedIndices.has(index) && compare(itemX, itemY)) {
+                            usedIndices.add(index);
                             found = true;
                             break;
                         }
@@ -73,7 +75,7 @@ export function isDeepEqual(a, b, options = {}) {
                         return false;
                     }
                 }
-                return yCopy.length === 0;
+                return usedIndices.size === y.length;
             }
             return true;
         }