Fix for Prototype Pollution

[ready-research]

Summary

@xstyled/util is vulnerable to Prototype Pollution. This package allowing for modification of prototype behavior, which may result in Information Disclosure/DoS/RCE.

Test plan

util.merge({}, JSON.parse('{"__proto__":{"polluted":"Yes! Its Polluted"}}'));

Vulnerable line of code: https://github.com/gregberge/xstyled/blob/46145a69a288b695313d20c5c5182939139267d8/packages/util/src/index.ts#L78

[netlify[bot]]

‼️ Deploy request for xstyled rejected. Learn more about Netlify's sensitive variable policy

🔨 Explore the source changes: cb8751f7f36bfe879265eb2a6ea57daf45ec8ab7

[ready-research]

@gregberge Please validate the issue in huntr and confirm the fix. https://www.huntr.dev/bounties/1-gregberge/xstyled/ access using your GitHub login on the top right corner of huntr page. If yor are able to access it, then you can just click on mark as valid, and also you can confirm the fix.