[xiehuanyi]

Both parse('__proto__=value') and its fast-parser variant silently omit the entry, because assigning the key to a new ordinary object reaches its inherited accessor. The same issue affects populate()'s target and returned record, and therefore config({ processEnv: {} }).

Store a previously absent __proto__ key as an own writable, enumerable and configurable data property. Keep ordinary assignments and existing own-property updates on their current paths, preserving override behavior and the objects' normal prototypes. Use the helper in both parsers and populate's target/result assignments.

Regressions cover both parsers, repeated keys, actual file-based config with custom targets, populate's return value, and first-wins/override behavior. These tests use string environment values.

Validation: the new regressions fail 19 of 29 assertions on unchanged master. npm test passes 1224 assertions with one existing skip, including the build, Standard lint and declaration checks. npm run test:perf passes the required 1.5x threshold: 2.02x for Buffers and 2.03x for strings. git diff --check passes. Tested on Node 22.23.1/Linux; Windows and the other CI Node versions were not exercised. Generated distributions are excluded from the change.

AI disclosure: OpenAI Codex assisted with investigation, implementation, regression tests, and this description.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

[motdotla]

appreciate this but this is ai thinking... this is just not a real edge case in the history of .env files. no one uses proto as a key name. not worth the added complexity to support such a non-existent edge case.