Verify each finding against the current code and only fix it if needed.

Inline comments:
In `@packages/core/test/integration/data-types/data-types.test.ts`:
- Around line 1916-1926: The test is not creating an own "__proto__" property
because object literal __proto__ is treated specially; update the payloads
passed to testSimpleInOut (the input and the expected object) to use computed
property syntax so the "__proto__" key is an actual own property (e.g., use
['__proto__'] as the property name) when constructing the objects passed to
testSimpleInOut for vars.User and 'attr', and leave the subsequent expect(({} as
any).__proto__).to.equal(Object.prototype) check unchanged.
- Around line 1857-1868: The test is not actually creating an own "__proto__"
property because `{ __proto__: 'polluted' }` sets the prototype; update the test
that calls testSimpleInOut(vars.User, 'jsonObject', ...) to pass an object with
an actual own property by using computed property syntax (e.g., create the input
and expected objects as something equivalent to const polluted = {
['__proto__']: 'polluted' } and pass polluted for both input and expected), so
the round-trip truly tests prototype pollution protection while keeping the
final assertion that ({} as any).__proto__ equals Object.prototype; modify the
call sites referring to that literal in this test accordingly (testSimpleInOut
and its input/expected values).

---

Nitpick comments:
In `@packages/postgres/src/_internal/hstore.ts`:
- Around line 34-38: Rename the local function unescape to a clearer
non-shadowing name (e.g., unescapeHstoreValue) and update every local call site
in this module that currently invokes unescape (for example the usage inside the
hstore parsing logic) to call the new name; keep the implementation identical
but change the function identifier and any references so you no longer shadow
the global deprecated unescape.

Verify each finding against the current code and only fix it if needed.

Inline comments:
In `@packages/postgres/src/_internal/hstore.ts`:
- Around line 12-18: The valueToString function currently only sanitizes when
typeof value === 'string', so non-string inputs (number/boolean/object) are
stringified with String(value) and not escaped; change valueToString to handle
null explicitly and to run sanitize on the stringified result for all non-null
inputs (i.e., call sanitize(String(value)) for numbers/booleans/objects) so
objects with custom toString() are properly escaped; keep the sanitize call for
string inputs but unify logic so sanitize is always applied before returning a
non-null string.

Verify each finding against the current code and only fix it if needed.

Nitpick comments:
In `@packages/postgres/src/_internal/hstore.ts`:
- Around line 49-55: The loop iterating over matches (for (let i = 0; i <
matches.length; i += 2)) assumes pairs and can drop a trailing unmatched token;
add a defensive bounds check inside the loop (or adjust the loop condition) to
ensure matches[i + 1] exists before using rawValue, and skip or log the
incomplete pair so unescapeHstoreValue and assignment to result only run on
complete key/value pairs.