fix: the layout engine functions updatenodepropertie... in layout.js

[orbisai0security]

Summary

Fix high severity security issue in src/layout/layout.js.

Vulnerability

Field	Value
ID	V-002
Severity	HIGH
Scanner	multi_agent_ai
Rule	V-002
File	src/layout/layout.js:1271

Description: The layout engine functions updateNodeProperties() and updateNodeTimingParams() accept user-supplied animation configuration objects and pass them directly to node property assignment routines. If these functions use Object.assign() or for...in iteration without filtering prototype-polluting keys such as proto, constructor, or prototype, an attacker can craft an animation configuration that modifies the global Object prototype. Because this vulnerability exists in the distributed npm bundle (anime.esm.js), it affects every web application that consumes this library and passes user-controlled data to the anime.js API.

Changes

• src/layout/layout.js

Verification

• Build passes
• Scanner re-scan confirms fix
• LLM code review passed

---

Automated security fix by OrbisAI Security