Bug#1141449: trixie-pu: package node-lodash/4.17.21+dfsg+~cs8.31.198.20210220-9+deb13u1

Control: tag -1 moreinfo

Hi,

JavaScript is not my forte, so I may be up the wrong tree here. But in:

| if (key === '__proto__' &&
|     !hasOwnProperty.call(object, '__proto__')) {
|   return false;
}

Could it be that `object` here is always the original object, rather than
the object at the current point in the path, allowing a later `__proto__`
to slip through?

Thanks,