chore(release): 4.0.2 [skip ci]

## [4.0.2](v4.0.1...v4.0.2) (2022-03-31) ### Bug Fixes * protect against prototype pollution ([d637db7](d637db7))
RebeccaStevens · Mar 31, 2022 · ff72202 · ff72202
1 parent b39f1a9
commit ff72202
Show file tree

Hide file tree

Showing 4 changed files with 39 additions and 3 deletions.
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -1,6 +1,13 @@
 # Changelog
 All notable changes to this project will be documented in this file. Dates are displayed in UTC.
 
+## [4.0.2](https://github.com/RebeccaStevens/deepmerge-ts/compare/v4.0.1...v4.0.2) (2022-03-31)
+
+
+### Bug Fixes
+
+* protect against prototype pollution ([d637db7](https://github.com/RebeccaStevens/deepmerge-ts/commit/d637db7e4fb2bfb113cb4bc1c85a125936d7081b))
+
 ## [4.0.1](https://github.com/RebeccaStevens/deepmerge-ts/compare/v4.0.0...v4.0.1) (2022-03-14)
 
 

diff --git a/dist/deno/deepmerge.ts b/dist/deno/deepmerge.ts
@@ -438,7 +438,16 @@ function defaultMergeRecords<
       continue;
     }
 
-    result[key] = propertyResult;
+    if (key === "__proto__") {
+      Object.defineProperty(result, key, {
+        value: propertyResult,
+        configurable: true,
+        enumerable: true,
+        writable: true,
+      });
+    } else {
+      result[key] = propertyResult;
+    }
   }
 
   /* eslint-enable functional/no-loop-statement, functional/no-conditional-statement */

diff --git a/dist/node/index.cjs b/dist/node/index.cjs
@@ -275,7 +275,17 @@ function defaultMergeRecords(values, utils, meta) {
         if (propertyResult === actions.skip) {
             continue;
         }
-        result[key] = propertyResult;
+        if (key === "__proto__") {
+            Object.defineProperty(result, key, {
+                value: propertyResult,
+                configurable: true,
+                enumerable: true,
+                writable: true,
+            });
+        }
+        else {
+            result[key] = propertyResult;
+        }
     }
     /* eslint-enable functional/no-loop-statement, functional/no-conditional-statement */
     return result;

diff --git a/dist/node/index.mjs b/dist/node/index.mjs
@@ -271,7 +271,17 @@ function defaultMergeRecords(values, utils, meta) {
         if (propertyResult === actions.skip) {
             continue;
         }
-        result[key] = propertyResult;
+        if (key === "__proto__") {
+            Object.defineProperty(result, key, {
+                value: propertyResult,
+                configurable: true,
+                enumerable: true,
+                writable: true,
+            });
+        }
+        else {
+            result[key] = propertyResult;
+        }
     }
     /* eslint-enable functional/no-loop-statement, functional/no-conditional-statement */
     return result;