fix: avoid mass assignment

src/HasChildren.php

@@ -254,6 +254,12 @@ protected function getChildModel(array $attributes)
             $attributes[$this->getInheritanceColumn()]
         );
 
-        return new $className((array) $attributes);
+        $childModel = new $className();
+
+        foreach ($attributes as $key => $value) {
+            $childModel->setAttribute($key, $value);
+        }
+
+        return $childModel;
     }
 }