Summary by cubic

Prevents authentication bypass via prototype pollution by replacing in checks in mergeConfig with utils.hasOwnProp, so validateStatus cannot be inherited from Object.prototype. Adds targeted tests to ensure 4xx/5xx responses are still rejected under polluted Object.prototype.validateStatus (AXI-207, GHSA-w9j2-pvgh-6h63).

Description

• Summary of changes: Swapped in for utils.hasOwnProp in mergeConfig direct key merging; added focused tests for validateStatus inheritance and behavior.
• Reasoning: in traverses the prototype chain, letting a polluted validateStatus override config and accept all responses.
• Additional context: Addresses AXI-207 and aligns with GHSA-w9j2-pvgh-6h63.

Docs

• Suggest updating /docs/ to state mergeConfig only merges own properties and note protection against prototype pollution (e.g., validateStatus cannot be inherited).

Testing

• Added tests in tests/unit/prototypePollution.test.js:
  • Ensures merged validateStatus comes from defaults when Object.prototype.validateStatus is set.
  • End-to-end check that 4xx/5xx responses remain rejected even if Object.prototype.validateStatus is polluted.
  • Test teardown now cleans up Object.prototype.validateStatus to avoid cross-test leakage.
• No other tests changed; coverage is sufficient for the fix.

Semantic version impact

• Patch: security bug fix; no API changes or behavior changes for valid inputs.

^{Written for commit 2f1f96a. Summary will update on new commits.}