Fix code scanning alert no. 2: Prototype-polluting function

[lindluni]

Fixes https://github.com/github/safe-settings/security/code-scanning/2

To fix the prototype pollution vulnerability, we need to ensure that properties like __proto__ and constructor are not merged into the modifications, additions, or deletions objects. This can be achieved by adding checks to skip these properties during the merge process.

The best way to fix the problem without changing existing functionality is to add a condition to skip these properties in the compareDeep method. Specifically, we will add a check before processing each key to ensure it is not __proto__ or constructor.

Suggested fixes powered by Copilot Autofix. Review carefully before merging.

[Copilot]

Copilot reviewed 1 out of 1 changed files in this pull request and generated no comments.

Comments suppressed due to low confidence (1)

lib/mergeDeep.js:95

• The added condition correctly prevents prototype pollution by skipping the __proto__ and constructor properties during the merge process.

if (key === "__proto__" || key === "constructor") {

Tip: Copilot only keeps its highest confidence comments to reduce noise and keep you focused. Learn more

[decyjphr]

Thanks @lindluni