Skip to content

Preserve tasks named __proto__ in auto and autoInject - #2129

Open
Sskift wants to merge 2 commits into
caolan:masterfrom
Sskift:fix/auto-special-task-keys
Open

Sskift wants to merge 2 commits into
caolan:masterfrom
Sskift:fix/auto-special-task-keys

Conversation

@Sskift

@Sskift Sskift commented Nov 2, 2026

Copy link
Copy Markdown

auto currently reports a recursive dependency when a task named __proto__ has a dependency, even for a valid acyclic graph. A task with that name can also lose its own property in successful and partial-error results. autoInject drops the same task name while constructing the task map passed to auto.

For example, this graph is rejected before either task runs:

async.auto({
    start: callback => callback(null, 1),
    ['__proto__']: ['start', (results, callback) => callback(null, results.start + 1)]
}, callback);

The dependency counts and autoInject task map now use null-prototype objects, and __proto__ results are stored as own data properties. The public results object keeps its usual prototype and property attributes, including when a task fails.

Twelve regression tests cover independent task values, a dependent task and downstream consumer, partial-error results, the Promise API, and explicit or inferred dependency injection. All 715 Node tests and ESLint pass. A separate agent also checked ordinary and null-prototype task maps, real cycles, and cancellation.

Prepared by a Codex agent and independently reviewed by another agent.

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant