This release delivers prototype-pollution hardening for the Node HTTP adapter, adds an opt-in allowedSocketPaths allowlist to mitigate SSRF via Unix domain sockets, fixes a keep-alive socket memory leak, and ships supply-chain hardening across CI and security docs.
🔒 Security Fixes
- Prototype Pollution Hardening (HTTP Adapter): Hardened the Node HTTP adapter and
resolveConfig/mergeConfig/validator paths to read only own properties and use null-prototype config objects, preventing polluted , , , , and from influencing requests. ()