Under the hoodTier: how much it should matter to you
2Useful: my rating, 1 to 5
1Signal: worth watching, 1 to 5
ElsewhereArea: what it touches
Internal ChangesKind: in v2.1.234,
Internal ChangesSection of the release
What
The recursive sanitizer now creates its result with Object.create(null) and takes the per-string transform as an argument, so an input key like __proto__ cannot alter the object it produces.
Evidence
Object.create(null)
Strings lifted out of the shipped bundle, so the claim above can be checked against them.
