GHSA-3r53-75j5-3g7j: Quasar: Prototype pollution in the extend() utility

quasar@2.20.1, the latest published version at the time of testing, appears to be vulnerable to prototype pollution through the public extend() utility exported from the package root.

When extend(true, target, source) is used for a deep merge, attacker-controlled object keys are recursively copied into the target object without blocking prototype-pollution primitives such as __proto__, constructor, or prototype.

This can allow attacker-controlled properties to be written to Object.prototype.