Greptile Summary

This PR replaces the in operator with Object.hasOwn() in hasExplicitProviderAccountConfig to close a prototype-pollution bypass where an attacker-controlled accountId (e.g. __proto__, constructor, toString) would be found on the prototype chain and cause the function to incorrectly return true, potentially misclassifying an account as explicitly configured.

• The fix is minimal, correct, and well-scoped — the accounts object is already guarded by a typeof accounts !== "object" null-check immediately before the changed line, so Object.hasOwn receives a valid object.
• Object.hasOwn() is the idiomatic modern alternative to both the in operator (which walks the prototype chain) and .hasOwnProperty() (which can be shadowed by own properties on the target object); it works correctly on Object.create(null) maps as well.
• No breaking changes are introduced: legitimate account IDs are always own properties of the parsed config object, so all previously-passing lookups still return true.

Confidence Score: 5/5

• This PR is safe to merge — it is a minimal, well-reasoned security hardening with no breaking changes.
• The change is a single-line substitution with a clearly superior alternative. The surrounding null/type guard ensures Object.hasOwn always receives a valid object, the fix is backward-compatible for all real account IDs, and the motivation (prototype-chain lookup bypass) is legitimate and accurately described.
• No files require special attention.

_{Last reviewed commit: 4d7ba95}

Hello @manusjs,

thank you very much for your contribution. I really appreciate your work. Since we already have another pull request that was opened earlier (#34929) addressing this issue, I recommend commenting on the other pull request if you would like to suggest any changes. Thank you very much nevertheless.

cc @shakkernerd, could you please close this so that we don’t run into confusion with multiple PRs? Thanks!

Thanks for the work, @manusjs. This issue has been addressed by maintainer-selected PR #34982 (tracking issue #34926).\n\nTo keep the queue clean, I’m closing this as a duplicate.