fix: possible prototype pollution within merge

[n1ru4l]

Rather than everyone abandoning dset, why not just fix the security vulnerability... 😓

Hey @lukeed, can you review and release this? ☺️

---

Related:

• Security Issue - CVE-2022-25645 - Node module dset graphql/graphiql#2256

[maraisr]

Probably you can filter this in the user code?

[spratt]

While you probably can filter this in the user code, this function is flagged by security scans for a dangerous prototype pollution vulnerability. I have to justify how I'm not creating a liability to my security team every time dset gets pulled in by a dependency. Please fix this function so I can keep using dset.

[n1ru4l]

Since this is already properly addressed within dset:

dset/src/index.js

Line 6 in 56923fe

if (k === '__proto__' || k === 'constructor' || k === 'prototype') break;

dset/src/merge.js

Line 22 in 56923fe

if (k === '__proto__' || k === 'constructor' || k === 'prototype') break;

I don't see why it should not be addressed within the merge function 🤔