fix: fix security warnings

Author: Justin Kimbrell

src/helpers/css.ts

@@ -24,6 +24,11 @@ export function mergeCss<TSource extends CSSProperties, TTarget extends CSSPrope
     target: TTarget
 ): TSource {
     for (const key in target) {
+        if (!Object.prototype.hasOwnProperty.call(target, key) || 
+            key === '__proto__' || key === 'constructor' || key === 'prototype') {
+            continue;
+        }
+        
         const targetVal = target[key];
         const sourceVal = source[key];
 

src/helpers/functions.ts

@@ -1,11 +1,12 @@
 export function parseDuration(duration: string | null | undefined): number {
-    const match = duration?.trim().split(',')[0]?.match(/^([+-]?(?:\d+\.?\d*|\.\d+))\s*(ms|s|m|h)$/i);
+    // const match = duration?.trim().split(',')[0]?.match(/^([+-]?(?:\d+\.?\d*|\.\d+))\s*(ms|s|m|h)$/i);
+    const match = duration?.trim().split(',')[0]?.match(/^([+-]?)(\d+(?:\.\d+)?|\.\d+)\s*(ms|s|m|h)$/i);
 
     if (!match) {
         return 0;
     }
 
-    const [, val, unit] = match;
+    const [,, val, unit] = match;
 
     return parseFloat(val!) * {
         ms: 1,