Under the hood
Useful2 Signal1
A key named __proto__ in input can no longer tamper with the sanitized result.
What's wrong with this entry?
Anonymous. No account, no email.
What
The recursive sanitizer now creates its result with Object.create(null) and takes the per-string transform as an argument, so an input key like __proto__ cannot alter the object it produces.
Evidence
Object.create(null)
Strings lifted out of the shipped bundle, so the claim above can be checked against them.