From a75e5321cafa550b54e9f27089f9be15308a2a74 Mon Sep 17 00:00:00 2001
From: Aras Abbasi <aras.abbasi@googlemail.com>
Date: Wed, 30 Jul 2025 05:50:00 +0200
Subject: [PATCH 1/2] chore: avoid Object.assign

---
 src/types.ts              | 5 ++++-
 src/verify-and-receive.ts | 9 +++++----
 2 files changed, 9 insertions(+), 5 deletions(-)

diff --git a/src/types.ts b/src/types.ts
index 5716b8e7..867f90ab 100644
--- a/src/types.ts
+++ b/src/types.ts
@@ -68,7 +68,10 @@ export interface State extends Options<any> {
 /**
  * Error object with optional properties coming from `octokit.request` errors
  */
-export type WebhookError = Error & Partial<RequestError>;
+export type WebhookError = Error &
+  Partial<RequestError> & {
+    event?: EmitterWebhookEventWithStringPayloadAndSignature;
+  };
 
 export interface AggregateWebhookError extends AggregateError {
   errors: WebhookError[];
diff --git a/src/verify-and-receive.ts b/src/verify-and-receive.ts
index f89ae19e..31ef5edb 100644
--- a/src/verify-and-receive.ts
+++ b/src/verify-and-receive.ts
@@ -23,11 +23,12 @@ export async function verifyAndReceive(
   if (!matchesSignature) {
     const error = new Error(
       "[@octokit/webhooks] signature does not match event payload and secret",
-    );
+    ) as WebhookError;
 
-    return state.eventHandler.receive(
-      Object.assign(error, { event, status: 400 }) as WebhookError,
-    );
+    error.event = event;
+    error.status = 400;
+
+    return state.eventHandler.receive(error);
   }
 
   let payload: EmitterWebhookEvent["payload"];

From d33b4113a3a9453dc8634309167051151a81fe4e Mon Sep 17 00:00:00 2001
From: wolfy1339 <4595477+wolfy1339@users.noreply.github.com>
Date: Thu, 31 Jul 2025 14:33:23 -0400
Subject: [PATCH 2/2] add explicit undefined

---
 src/types.ts | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/types.ts b/src/types.ts
index 867f90ab..d177850f 100644
--- a/src/types.ts
+++ b/src/types.ts
@@ -70,7 +70,7 @@ export interface State extends Options<any> {
  */
 export type WebhookError = Error &
   Partial<RequestError> & {
-    event?: EmitterWebhookEventWithStringPayloadAndSignature;
+    event?: EmitterWebhookEventWithStringPayloadAndSignature | undefined;
   };
 
 export interface AggregateWebhookError extends AggregateError {