Please drop deprecated __proto__ calls

[guimard]

Hi,

here is a simple patch to do this:

--- a/implementation.js
+++ b/implementation.js
@@ -4,7 +4,7 @@

 var isES5 = typeof Object.defineProperty === 'function';

-var hasProto = [].__proto__ === Array.prototype; // eslint-disable-line no-proto
+var hasProto = Object.getPrototypeOf([]) === Array.prototype

 if (!isES5 || !hasProto) {
        throw new TypeError('util.promisify requires a true ES5 environment, that also supports `__proto__`');
@@ -75,7 +75,7 @@
                });
        };

-       promisified.__proto__ = orig.__proto__; // eslint-disable-line no-proto
+       Object.setPrototypeOf(promisified, orig.__proto__);

        Object.defineProperty(promisified, kCustomPromisifiedSymbol, {
                configurable: true,

[ljharb]

Why? They aren't deprecated at all.

[guimard]

They are deprecated in Node.js and security teams recommends to launch Node.js with --disable-proto=throw

[guimard]

Facebook/jest accepted he same request: jestjs/jest#13256

[ljharb]

No, they are not deprecated in node.js - at all - but fair point that the --disable-proto flag might cause problems.

(I'm not motivated by what other projects do)

[ljharb]

I suppose I could detect when --disable-proto is used, and cache Object.getPrototypeOf in that case, but it adds some complexity for a rare and unadvisable use case.

[guimard]

It seems that for all supported Node.js, hasProto is always true

[guimard]

And Object.setPrototypeOf seems well supported

[ljharb]

I've written up an attempt here (https://github.com/ljharb/util.promisify/actions/runs/3050250295), but it's blocked by https://npmjs.com/graceful-fs.

[ljharb]

Turns out that only applies to nyc, so i can probably get this fixed.