Skip to content

fix(linter/plugins): correctly handle object with __proto__ keys in options merging#16928

Merged
graphite-app[bot] merged 1 commit intomainfrom
12-16-fix_linter_plugins_correctly_handle_object_with___proto___keys_in_options_merging
Dec 16, 2025
Merged

fix(linter/plugins): correctly handle object with __proto__ keys in options merging#16928
graphite-app[bot] merged 1 commit intomainfrom
12-16-fix_linter_plugins_correctly_handle_object_with___proto___keys_in_options_merging

Conversation

@overlookmotel
Copy link
Member

@overlookmotel overlookmotel commented Dec 16, 2025

Fix a tiny bug in options merging where options object has a key __proto__.

@github-actions github-actions bot added A-linter Area - Linter A-cli Area - CLI A-linter-plugins Area - Linter JS plugins C-bug Category - Bug labels Dec 16, 2025
Copy link
Member Author

overlookmotel commented Dec 16, 2025


How to use the Graphite Merge Queue

Add either label to this PR to merge it via the merge queue:

  • 0-merge - adds this PR to the back of the merge queue
  • hotfix - for urgent hot fixes, skip the queue and merge this PR next

You must have a Graphite account in order to use the merge queue. Sign up using this link.

An organization admin has enabled the Graphite Merge Queue in this repository.

Please do not merge from GitHub as this will restart CI on PRs being processed by the merge queue.

This stack of pull requests is managed by Graphite. Learn more about stacking.

Copy link
Contributor

Copilot AI left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

This PR fixes a subtle bug in the options merging logic where an object with a __proto__ key would be handled incorrectly. The fix ensures that when checking if a property exists in the config object, it uses Object.hasOwn() instead of the in operator to avoid prototype chain lookups that would incorrectly handle the literal string "__proto__" as a property name.

Key changes:

  • Added hasOwn to the destructured Object properties
  • Replaced key in configValue with hasOwn(configValue, key) in the mergeValues function

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

@overlookmotel overlookmotel self-assigned this Dec 16, 2025
@graphite-app graphite-app bot added the 0-merge Merge with Graphite Merge Queue label Dec 16, 2025
@graphite-app
Copy link
Contributor

graphite-app bot commented Dec 16, 2025

Merge activity

… options merging (#16928)

Fix a tiny bug in options merging where options object has a key `__proto__`.
@graphite-app graphite-app bot force-pushed the 12-15-refactor_linter_plugins_rename_var branch from d72972b to f99aa13 Compare December 16, 2025 03:41
@graphite-app graphite-app bot force-pushed the 12-16-fix_linter_plugins_correctly_handle_object_with___proto___keys_in_options_merging branch from 69d41c5 to b845871 Compare December 16, 2025 03:41
Base automatically changed from 12-15-refactor_linter_plugins_rename_var to main December 16, 2025 03:47
@graphite-app graphite-app bot merged commit b845871 into main Dec 16, 2025
19 checks passed
@graphite-app graphite-app bot deleted the 12-16-fix_linter_plugins_correctly_handle_object_with___proto___keys_in_options_merging branch December 16, 2025 03:47
@graphite-app graphite-app bot removed the 0-merge Merge with Graphite Merge Queue label Dec 16, 2025
overlookmotel added a commit that referenced this pull request Dec 19, 2025
# Oxlint
### 🚀 Features

- 6cc3fdf linter/no-inferrable-types: Implement fixer (#17090) (camc314)
- 2067997 linter/no-negation-in-equality-check: Implement suggestion
(#17084) (camc314)
- 552f9ef vscode: Auto-generate VSCode README configuration from
package.json (#16970) (Copilot)
- 9190c4b linter/no-unnecessary-array-flat-depth: Implement fixer
(#17057) (camc314)
- ed789de linter/misrefactored-assign-op: Implement fixer (#17056)
(camc314)
- a0f74a0 linter/config: Allow aliasing plugin names to allow names the
same as builtin plugins (#15569) (Cameron)
- a43d251 linter/plugins: `RuleTester` support `languageOptions.globals`
(#17009) (overlookmotel)
- 35070d9 linter/bad-bitwise-operator: Implement fixer (#17006)
(camc314)
- 322d995 linter/prefer-enum-initializers: Implement fixer (#17004)
(camc314)
- ae1e5bc vscode: Add support for tsgolint binary configuration (#16921)
(ColemanDunn)
- 3bfe31e linter/eslint-plugin-vitest: Add prefer-called-with as vitest
compatible jest rule (#16993) (Said Atrahouch)
- 0cd075f linter/eslint-plugin-jest: Add fix capabilities to
prefer-called-with rule (#16987) (Said Atrahouch)
- 357564b linter: Add options for
`typescript/require-array-sort-compare` rule. (#16980) (connorshea)
- 2b0ffba linter: Add options for
`typescript/no-meaningless-void-operator` rule. (#16981) (connorshea)
- 8bc4287 linter/plugins: Validate options against schema (#16974)
(overlookmotel)
- fdc7d08 linter: Implement eslint/capitalized-comments (#16896) (Tu
Shaokun)
- f8b6561 linter: Add support for `test.for` in vitest (#16925)
(camchenry)
- 7ee0379 linter/eslint-plugin-vitest: Implement prefer-spy-on (#16426)
(Said Atrahouch)
- fc96ee0 linter: Implement jest/prefer-to-have-been-called-times
(#16938) (秦宇航)
- 291b57b ast_tools: Generate TS declaration files for deserializer and
walk files (#16912) (camc314)
- e31da2a linter: Implement jest/perfer-to-have-been-called (#16899)
(秦宇航)
- 1a31306 linter/eslint-plugin-vitest: Add require-hook as vitest
compatible jest rule (#16880) (Said Atrahouch)
- cd3db21 linter: Add ignoredTypeNames option to no-base-to-string rule
(#16898) (camc314)
- 763b25a linter: Implement eslint/no-inline-comments (#16885) (Tu
Shaokun)

### 🐛 Bug Fixes

- fb9e193 linter: OOM problems with custom plugins (#17082)
(overlookmotel)
- 005ec25 linter: Permit `$schema` `.oxlintrc.json` struct (#17060)
(Copilot)
- fd03131 linter/plugins: Handle plugin names containing slashes
(#17073) (overlookmotel)
- b2a4fac linter/plugins: Error if plugin name alias is not normalized
(#17071) (overlookmotel)
- e046c4e linter/no-misused-spread: Add rule options support (#17054)
(camc314)
- 5c1a9e0 linter/no-deprecated: Add rule options support (#17053)
(camc314)
- 8c9cafe linter: `import/consistent-type-specifier-style`: add support
for declaration files (#16979) (camchenry)
- dab4780 linter/no-empty-pattern: Misleading help message for arrays
(#17039) (Copilot)
- 67f8c5d linter/plugins: Get correct plugin name in all cases (#17033)
(overlookmotel)
- 674dab9 linter/plugins: Fix indentation in error message (#17018)
(overlookmotel)
- 6524f72 linter/plugins: Add `@types/node` dev dependency to `oxlint`
package (#17016) (overlookmotel)
- 7a35513 linter/plugins: Better error for `null` in `globals` in
`RuleTester` (#17011) (overlookmotel)
- 42603ba linter/plugins: Always define `languageOptions.globals`
(#17008) (overlookmotel)
- 4cdc2f8 linter: Fix VITEST override rule list and add test for
alphabetizing the two lists (#16975) (Connor Shea)
- e466562 linter/consistent-type-definitions: Handle parenthesized types
in rule (#16998) (camc314)
- fce267c linter: Correct vitest plugin source to be
`@vitest/eslint-plugin` (#16976) (connorshea)
- 477bb57 linter: Fix `vitest/no-restricted-vi-methods` and add tests
for it. (#16971) (connorshea)
- 7d6974d linter: Ignore oxlint directive comments in
capitalized-comments (#16989) (Tu Shaokun)
- 23ac6b1 linter/plugins: Apply defaults from `meta.schema` to options
(#16930) (overlookmotel)
- 2f946cf linter/plugins: Error if `defaultOptions` is not
JSON-serializable (#16959) (overlookmotel)
- d8b8a57 linter/plugins: Freeze whole of merged options (#16958)
(overlookmotel)
- d446c43 linter: Prevent extra fields from being present on oxlint
config file (#16874) (connorshea)
- b845871 linter/plugins: Correctly handle object with `__proto__` keys
in options merging (#16928) (overlookmotel)
- c897794 linter: Fix eslint/sort-imports allowSeparatedGroups not
working with single empty line (#16012) (Duc Nghiem Xuan)
- 0c347a1 linter/array-type: Handle satisfies expression (#16903)
(camc314)

### ⚡ Performance

- 70d853c linter: Avoid cloning source text when cloning AST into
fixed-size allocator (#17088) (overlookmotel)
- 4d389f7 linter: Less bounds checks in `normalize_plugin_name` (#17030)
(overlookmotel)
- fd8e9c6 linter/plugins: Speed up cloning JSON objects (#16997)
(overlookmotel)
- d77e22d linter/plugins: Use `DEFAULT_OPTIONS` for rules with empty
array as default options (#16913) (overlookmotel)

### 📚 Documentation

- 6d053b4 linter: Fix typo in doc comment (#17091) (overlookmotel)
- b5f3c91 linter: Document intentional exclusion of ignoreCase option in
jsx-no-duplicate-props (#17046) (Copilot)
- a0bf5d8 linter: Fix the config option docs for no-inline-comments
rule. (#16983) (connorshea)
- ca26a11 linter/plugins: Fix typo in doc comment (#16966)
(overlookmotel)
- 3183bf8 linter/plugins: Fix typo in JSDoc comment (#16900)
(overlookmotel)
# Oxfmt
### 🚀 Features

- 15dfb55 oxfmt: Respect single nearest `.editorconfig` (#17043)
(leaysgur)
- 8c33ff4 oxfmt: Expose Node.js API: `format(fileName, sourceText,
options?)` (#16939) (leaysgur)

### 🐛 Bug Fixes

- d340c87 oxfmt: Update api `FormatOptions` type with `& Record<string,
unknown>` (#17036) (leaysgur)
- 827a256 oxfmt: Place ignorePatterns at bottom of JSON in --migrate
prettier (#16926) (Boshen)

Co-authored-by: overlookmotel <[email protected]>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

A-cli Area - CLI A-linter Area - Linter A-linter-plugins Area - Linter JS plugins C-bug Category - Bug

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant

Comments