fix: Revert "prevent prototype pollution via constructor.prototype ac…#1271
Merged
Conversation
Coverage Report for CI Build 29522884378Coverage decreased (-0.4%) to 45.455%Details
Uncovered ChangesNo uncovered changes found. Coverage RegressionsNo coverage regressions found. Coverage Stats
💛 - Coveralls |
Contributor
|
🎉 This PR is included in version 11.1.12 🎉 The release is available on: Your semantic-release bot 📦🚀 |
jonatankruszewski
added a commit
to jonatankruszewski/immer
that referenced
this pull request
Jul 20, 2026
Drafts must stay safe for ecosystem introspection idioms: lodash's isPrototype (used by isEmpty/isEqual/isPlainObject) reads value.constructor.prototype, and fast-deep-equal compares constructor identity. The guard reverted in immerjs#1271 broke these (immerjs#1265, immerjs#1266, immerjs#1268) while its tests still passed, because try/catch made a crash and a successful block indistinguishable. These tests assert observable behavior directly, so they fail on 11.1.9-11.1.11 (verified: constructor.prototype throws, constructor identity and 'in' checks break, writes to own keys named prototype are dropped) and pass on main. setPrototypeOf remains forbidden; the applyPatches-layer pollution guards in patch.js are untouched.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
…cess (CVE-2026-XXXX) (#1259)"
This reverts commit 48fc378. This fixes #1266 and #1268, #1265 while the security reported could not find a reasonable way to show the designated fixes was closing a real vulnerability, nor could I think of anything.