Closes #7306

Fixed prototype pollution vulnerability (issue #7538) in axios's parseHeaders.js by changing parsed = {} to parsed = Object.create(null) to prevent proto/constructor attacks. The fix is committed on branch fix/prototype-pollution-parseHeaders and ready for PR submission.

Summary by cubic

Prevents prototype pollution in header parsing by switching to a prototype-less headers object. Blocks __proto__/constructor attacks and slightly changes the shape of response.headers.

Description

• Summary of changes

  • Use Object.create(null) for the headers map in lib/helpers/parseHeaders.js.
  • Added jsdom to dependencies; updated package-lock.json.

• Reasoning

  • Malicious header names like __proto__ could modify object prototypes. This hardens parsing and closes that vector.

• Additional context

  • response.headers is now prototype-less. Avoid direct response.headers.hasOwnProperty(...); use Object.prototype.hasOwnProperty.call(response.headers, key).
  • Review hint: confirm if jsdom is required at runtime. It may belong in devDependencies.

Docs

• Add a note that response.headers is a plain dictionary (no prototype). Show examples using Object.prototype.hasOwnProperty.call(headers, 'header-name').

Testing

• No tests added.
• Tests needed:
  • Add a regression test ensuring a header named __proto__ does not pollute global prototypes.
  • Verify typical access and iteration over response.headers still work as expected.

^{Written for commit 2574e1c. Summary will update on new commits.}