- workflow/plugins/ts/dict: Fix prototype pollution by adding key
validation and safeAssign wrapper to reject __proto__, constructor,
prototype keys in DictSet, DictDelete, DictPick, DictInvert classes
- pastebin/quality-validator: Fix regex injection by escaping regex
metacharacters before creating RegExp from user input in matchesPattern
- postgres/generate-password: Fix biased cryptographic random by using
crypto.randomInt() instead of modulo operation
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
- Python: class extending NodeExecutor + factory.py (80+ plugins)
- TypeScript: class implements NodeExecutor + factory.ts (7 groups, 116 classes)
- Go: struct with methods + factory.go (36 plugins)
- Rust: struct impl NodeExecutor trait + factory.rs (54 plugins)
- Mojo: struct + factory.mojo (11 plugins)
All package.json files now include:
- files array listing source files
- metadata.class/struct field
- metadata.entrypoint field
This enables a unified plugin loading system across all languages
with no import side effects (Spring-style DI pattern).
Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
