Merge pull request #57 from Open-Tech-Foundation/changeset-release/main

Version Packages (beta)

Author: Thanga-Ganapathy

.changeset/pre.json

@@ -7,6 +7,7 @@
     "playground": "0.0.0"
   },
   "changesets": [
+    "good-cars-begin",
     "large-baboons-kiss"
   ]
 }

packages/std/CHANGELOG.md

@@ -1,5 +1,19 @@
 # @opentf/std
 
+## 1.0.0-beta.2
+
+### Minor Changes
+
+- 37a1df8: 🛡️ Security Fixes Implemented:
+
+  Performed a security audit of all object-manipulation utilities and implemented strict key filtering to block access to sensitive keys (**proto**, constructor, prototype). The following utilities are now secured:
+
+  set.ts: Prevented path-based pollution of the global prototype.
+  unset.ts: Blocked the ability to delete properties from the global prototype (preventing DoS attacks).
+  merge.ts & mergeAll.ts: Added guards to prevent deep-merging from traversing into internal object properties.
+  clone.ts: Ensured that cloning an object cannot inadvertently modify the prototype of the new instance.
+  mapKeys.ts: Protected against transformation mappers that return sensitive key names.
+
 ## 1.0.0-beta.1
 
 ### Patch Changes

packages/std/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@opentf/std",
-  "version": "1.0.0-beta.1",
+  "version": "1.0.0-beta.2",
   "description": "The Modern JavaScript Standard Library. A lightweight, high-accuracy, and cross-runtime collection of essential utilities.",
   "keywords": [
     "collection",