This makes me think: should other things, like this.cache and app.locals, use Object.create(null) too?

[newkdr]

          This makes me think: should other things, like `this.cache` and `app.locals`, use `Object.create(null)` too?

Originally posted by @EvanHahn in #4835 (comment)

[wesleytodd]

All of these would be breaking changes. This is why it was called out as going into the next major at the time. That has now shipped, so I agree we should do some of this if we keep all those APIs as is for v6, but we should wait a bit to start opening PRs for that until we decide if those are all worth doing.

[EvanHahn]

I did this in #4861. Not sure of the status in v5, though.

[wesleytodd]

Oh right! I forgot about those. Looks like those landed before we pushed v5! Sorry, so much going on I have lost track of some of the details. Glad you remembered.