fix(res.render): do not mutate the options object

lib/response.js

@@ -907,8 +907,8 @@ res.render = function render(view, options, callback) {
     opts = {};
   }
 
-  // merge res.locals
-  opts._locals = self.locals;
+  // merge res.locals (into a copy, so the caller's options are not mutated)
+  opts = { ...opts, _locals: self.locals };
 
   // default callback to respond
   done = done || function (err, str) {

test/res.render.js

@@ -1,5 +1,6 @@
 'use strict'
 
+var assert = require('node:assert')
 var express = require('..');
 var path = require('node:path')
 var request = require('supertest');
@@ -295,6 +296,41 @@ describe('res', function(){
       .get('/')
       .expect('<p>jane</p>', done);
     })
+
+    it('should not mutate the options object', function(done){
+      var app = createApp();
+
+      app.set('views', path.join(__dirname, 'fixtures'))
+      var options = { user: { name: 'tobi' } };
+
+      app.use(function(req, res){
+        res.locals.foo = 'bar';
+        res.render('user.tmpl', options);
+      });
+
+      request(app)
+      .get('/')
+      .expect('<p>tobi</p>', function (err) {
+        if (err) return done(err)
+        assert.deepStrictEqual(Object.keys(options), ['user'])
+        done()
+      })
+    })
+
+    it('should support frozen options object', function(done){
+      var app = createApp();
+
+      app.set('views', path.join(__dirname, 'fixtures'))
+      var options = Object.freeze({ user: { name: 'tobi' } });
+
+      app.use(function(req, res){
+        res.render('user.tmpl', options);
+      });
+
+      request(app)
+      .get('/')
+      .expect(200, '<p>tobi</p>', done);
+    })
   })
 
   describe('.render(name, options, fn)', function(){