Bump 2.6.1

Yomguithereal · Jan 26, 2021 · a115031 · a115031
1 parent 1dbe71c
commit a115031
Show file tree

Hide file tree

Showing 6 changed files with 12 additions and 8 deletions.
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -1,5 +1,9 @@
 # Changelog
 
+## v2.6.1
+
+* Fixing prototype pollution issue ([@arjunshibu](https://github.com/arjunshibu)).
+
 ## v2.6.0
 
 * Adding TypeScript declaration files.

diff --git a/build/baobab.js b/build/baobab.js
@@ -2,7 +2,7 @@
  * Baobab
  *
  * Homepage: https://github.com/Yomguithereal/baobab
- * Version: 2.6.0
+ * Version: 2.6.1
  * Author: Yomguithereal (Guillaume Plique)
  * License: MIT
  */
@@ -1108,7 +1108,7 @@ exports.dynamic = dynamic;
 /**
  * Version.
  */
-Baobab.VERSION = '2.6.0';
+Baobab.VERSION = '2.6.1';
 var VERSION = Baobab.VERSION;
 /**
  * Exporting.
@@ -2364,7 +2364,7 @@ function merger(deep) {
     t = objects[i];
 
     for (k in t) {
-      if (deep && _type["default"].object(t[k]) && !(t[k] instanceof _monkey.Monkey)) {
+      if (deep && _type["default"].object(t[k]) && !(t[k] instanceof _monkey.Monkey) && k !== '__proto__' && k !== 'constructor' && k !== 'prototype') {
         o[k] = merger(true, o[k] || {}, t[k]);
       } else {
         o[k] = t[k];

diff --git a/build/baobab.min.js b/build/baobab.min.js
diff --git a/package-lock.json b/package-lock.json
diff --git a/package.json b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "baobab",
-  "version": "2.6.0",
+  "version": "2.6.1",
   "description": "JavaScript persistent data tree with cursors.",
   "main": "./dist/baobab.js",
   "dependencies": {

diff --git a/src/baobab.js b/src/baobab.js
@@ -582,7 +582,7 @@ export {Cursor, MonkeyDefinition, Monkey, type, helpers};
 /**
  * Version.
  */
-Baobab.VERSION = '2.6.0';
+Baobab.VERSION = '2.6.1';
 export const VERSION = Baobab.VERSION;
 
 /**