tailwindcss/packages
Adam Wathan 9ded4a23de
Guard object lookups against inherited prototype properties (#19725)
When user-controlled candidate values like "constructor" are used as
keys to look up values in plain objects (staticValues, plugin values,
modifiers, config), they can match inherited Object.prototype properties
instead of returning undefined. This caused crashes like "V.map is not
a function" when scanning source files containing strings like
"row-constructor".

Use Object.hasOwn() checks before all user-keyed object lookups in:
- utilities.ts (staticValues lookup)
- plugin-api.ts (values, modifiers, and variant values lookups)
- plugin-functions.ts (get() config traversal function)

Fixes #19721

https://claude.ai/code/session_011CYSGw3DLh2Z8xnuyoaCgC

---------

Co-authored-by: Claude <noreply@anthropic.com>
Co-authored-by: Robin Malfait <malfait.robin@gmail.com>
2026-02-25 15:16:09 +00:00
..
@tailwindcss-browser 4.2.1 (#19714) 2026-02-23 11:45:12 +01:00
@tailwindcss-cli 4.2.1 (#19714) 2026-02-23 11:45:12 +01:00
@tailwindcss-node 4.2.1 (#19714) 2026-02-23 11:45:12 +01:00
@tailwindcss-postcss 4.2.1 (#19714) 2026-02-23 11:45:12 +01:00
@tailwindcss-standalone 4.2.1 (#19714) 2026-02-23 11:45:12 +01:00
@tailwindcss-upgrade 4.2.1 (#19714) 2026-02-23 11:45:12 +01:00
@tailwindcss-vite 4.2.1 (#19714) 2026-02-23 11:45:12 +01:00
@tailwindcss-webpack 4.2.1 (#19714) 2026-02-23 11:45:12 +01:00
internal-example-plugin Prefix internal modules with internal-* (#14074) 2024-07-29 10:58:07 -04:00
tailwindcss Guard object lookups against inherited prototype properties (#19725) 2026-02-25 15:16:09 +00:00
tsconfig.base.json Improve debug logs (#15303) 2024-12-11 15:27:20 +01:00