fix: tally landscape category and maturity counts on null-prototype objects

scripts/collect-metrics.mjs

@@ -32,8 +32,14 @@ try {
     stdio: 'ignore',
   });
   const projects = [];
-  const categoryCounts = {};
-  const maturityCounts = {};
+  // Null-prototype tallies: the keys below are upstream landscape.yml strings
+  // (category.name, project.project), so on a plain object a category named
+  // "constructor" would read Object.prototype's function through `|| 0` and
+  // publish a string where a count belongs, and one named "__proto__" would be
+  // dropped by the setter without an error. Same reason the lookup tables in
+  // generate-members.mjs use Object.create(null).
+  const categoryCounts = Object.create(null);
+  const maturityCounts = Object.create(null);
   for (const category of source.landscape || []) {
     for (const subcategory of category.subcategories || []) {
       for (const item of subcategory.items || []) {

tests/collect-metrics.test.mjs

@@ -600,3 +600,33 @@ test('collect-metrics files projects from an unnamed category under "Other"', ()
     { name: 'Other', value: 1 },
   ]);
 });
+
+test('collect-metrics counts a category or maturity named after an inherited Object property', () => {
+  const data = metricsFrom(
+    run({
+      landscape: `landscape:
+  - name: __proto__
+    subcategories:
+      - name: Scheduling
+        items:
+          - name: Kubernetes
+            project: constructor
+  - name: constructor
+    subcategories:
+      - name: Scheduling
+        items:
+          - name: Linkerd
+            project: toString
+`,
+    }),
+  );
+
+  assert.deepEqual(data.breakdowns.projectCategories.values, [
+    { name: '__proto__', value: 1 },
+    { name: 'constructor', value: 1 },
+  ]);
+  assert.deepEqual(data.breakdowns.projectMaturity.values, [
+    { name: 'constructor', value: 1 },
+    { name: 'tostring', value: 1 },
+  ]);
+});