fix(fetch): prevent __proto__ header from corrupting parsed headers object

[dinwwwh]

A request carrying a __proto__ header corrupted the object returned by toStandardHeaders in @standardserver/fetch. Reading standardHeaders['__proto__'] returned the inherited Object.prototype instead of undefined, so the parser took the duplicate-header branch and assigned an array through the inherited __proto__ setter — replacing the parsed object's prototype with that array and silently dropping the header value.

Fixes

• toStandardHeaders now builds the result on a null-prototype object, so __proto__ (and any other inherited name) is stored as a plain own property; the prototype can no longer be swapped out by request input.
• Added a regression test asserting the prototype stays null and the __proto__ header value is preserved as an ordinary entry.

Testing

• All 78 tests in the fetch package pass; tsc --noEmit is clean.

[pkg-pr-new]

• @standardserver/hono-node-playground
• @standardserver/node-http-playground

@standardserver/bun

npm i https://pkg.pr.new/@standardserver/bun@46

@standardserver/core

npm i https://pkg.pr.new/@standardserver/core@46

@standardserver/deno

npm i https://pkg.pr.new/@standardserver/deno@46

@standardserver/fastify

npm i https://pkg.pr.new/@standardserver/fastify@46

@standardserver/fetch

npm i https://pkg.pr.new/@standardserver/fetch@46

@standardserver/node

npm i https://pkg.pr.new/@standardserver/node@46

@standardserver/peer

npm i https://pkg.pr.new/@standardserver/peer@46

@standardserver/shared

npm i https://pkg.pr.new/@standardserver/shared@46

commit: 5db47ea

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

[codspeed-hq]

Merging this PR will not alter performance

✅ 26 untouched benchmarks
⏩ 108 skipped benchmarks¹

---

_{Comparing claude/quirky-lalande-762ce0 (5db47ea) with main (90fa661)}

Footnotes

1. 108 benchmarks were skipped, so the baseline results were used instead. If they were deleted from the codebase, click here and archive them to remove them from the performance reports. ↩