Prevent prototype pollution in JSON unflattening

[roncohen]

Summary

• prevent unflattenJSON from traversing unsafe prototype-related path segments
• process only own properties from the flattened input
• add regression coverage for constructor.prototype and __proto__ paths
• add a patch changeset for @reflag/flag-evaluation

The Changesets release flow will also patch dependent packages, including @reflag/node-sdk, so they resolve the fixed evaluation package.

Validation

• @reflag/flag-evaluation: 145 tests passed
• @reflag/node-sdk: 218 tests passed
• TypeScript builds passed for both packages
• lint and formatting checks passed

[Copilot]

Pull request overview

This PR hardens @reflag/flag-evaluation’s unflattenJSON helper against prototype-pollution attacks by ignoring unsafe path segments and by only iterating over own enumerable input keys, with a regression test and a patch changeset to ship the fix.

Changes:

• Skip unflattening for any flattened key path that includes __proto__, constructor, or prototype.
• Iterate input via Object.keys(...) to avoid processing inherited enumerable properties.
• Add a regression test for constructor.prototype.* and __proto__.* paths and include a patch changeset.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 1 comment.

File	Description
packages/flag-evaluation/src/index.ts	Adds unsafe path-segment filtering and switches to own-key iteration in unflattenJSON.
packages/flag-evaluation/test/index.test.ts	Adds a regression test ensuring unflattenJSON cannot pollute Object.prototype.
.changeset/safe-ravens-unflatten.md	Publishes a patch changeset describing the security fix.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.