Summary

The recursive _.merge helper in packages/feathers/src/commons.ts iterates Object.keys(source). When the source object came from JSON.parse('{"__proto__":...}'), __proto__ is returned as an own-enumerable key (unlike the object-literal form), so the recursive call resolves target['__proto__'] to Object.prototype and writes onto it.

This adds the standard guard to skip __proto__, constructor, and prototype keys during iteration — the same remediation lodash applies in baseSet.

Changes

• commons.ts: skip the three prototype-mutating keys in the merge loop.
• commons.test.ts: regression test confirming a JSON-parsed __proto__/constructor.prototype source no longer mutates Object.prototype, fresh objects, or the target.

Notes

• No public API change — merge still works for all documented input shapes.
• Reported by Andrew Ridings (@ridingsa). This is the v6 counterpart of the same fix for the published @feathersjs/commons package (see fix(commons): skip prototype-polluting keys in _.merge #3690, which supersedes fix(commons): skip __proto__ / constructor / prototype keys in _.merge #3687).

Reported-by: Andrew Ridings (@ridingsa)