fix(deps): update dependency flatted to ^3.4.2 [security] - abandoned

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
flatted	^3.4.1 → ^3.4.2

GitHub Vulnerability Alerts

CVE-2026-33228

---

Summary

The parse() function in flatted can use attacker-controlled string values from the parsed JSON as direct array index
keys, without validating that they are numeric. Since the internal input buffer is a JavaScript Array, accessing it
with the key "__proto__" returns Array.prototype via the inherited getter. This object is then treated as a legitimate
parsed value and assigned as a property of the output object, effectively leaking a live reference to Array.prototype
to the consumer. Any code that subsequently writes to that property will pollute the global prototype.

---

Root Cause

File: esm/index.js:29 (identical in cjs/index.js)

  const resolver = (input, lazy, parsed, $) => output => {
    for (let ke = keys(output), {length} = ke, y = 0; y < length; y++) {
      const k = ke[y];
      const value = output[k];    
      if (value instanceof Primitive) {
        const tmp = input[value];      // Bug is here

No validation that value is a safe numeric index input is built as a plain Array. JavaScript's property lookup on arrays traverses the prototype chain for non-numeric keys. The key "__proto__" resolves to Array.prototype, which:

• has type "object" → passes the typeof tmp === object guard at line 30
• is not in the parsed Set yet → passes the !parsed.has(tmp) guard.
• The reference to Array.prototype is then enqueued in lazy and later unconditionally assigned to the output object.

---

Replication Steps

  const Flatted = require('flatted'); 
  const parsed = Flatted.parse('[{"x":"__proto__"}]');
  parsed.x.polluted = 'pwned';
  console.log([].polluted);  // Returns true

---

Impact
An attacker can supply a crafted flatted string to parse() that causes the returned object to hold a live reference to Array.prototype, enabling any downstream code that writes to that property to pollute the global prototype chain, potentially causing denial of service or code execution.

Recommended solution
Validate that the index string represents an integer within the bounds of input before accessing it:

// Before (vulnerable)
const tmp = input[value];

// After (safe)
const idx = +value; // coerce boxed String → number
const tmp = (Number.isInteger(idx) && idx >= 0 && idx < input.length)
? input[idx]
: undefined;

---

Release Notes

WebReflection/flatted (flatted)

v3.4.2

Compare Source

---

Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[github-actions]

Coverage Report for packages/configs/vitest-config

Status	Category	Percentage	Covered / Total
🔵	Lines	78.19%	1732 / 2215
🔵	Statements	77.14%	1822 / 2362
🔵	Functions	74.33%	524 / 705
🔵	Branches	65.79%	1148 / 1745

File Coverage

No changed files found.

Generated in workflow #547 for commit 0f1e72b by the Vitest Coverage Report Action

[renovate]

Edited/Blocked Notification

Renovate will not automatically rebase this PR, because it does not recognize the last commit author and assumes somebody else may have edited the PR.

You can manually request rebase by checking the rebase/retry box above.

⚠️ Warning: custom changes will be lost.

[renovate]

Autoclosing Skipped

This PR has been flagged for autoclosing. However, it is being skipped due to the branch being already modified. Please close/delete it manually or report a bug if you think this is in error.