lib/util.js (3)

159-161: Missing writable and configurable in defineProperty for arrays.

When only value is specified in Object.defineProperty and the property already exists as a data descriptor, writable and configurable default to false only for new property definitions. For existing properties being redefined, they default to the existing values. Explicitly setting writable: false, configurable: false here (matching the other branches) would make the intent clear and avoid subtle inconsistencies.

Proposed fix

         Object.defineProperty(object, propertyName, {
-          value: Object.freeze(value)
+          value: Object.freeze(value),
+          writable: false,
+          configurable: false
         });

---

167-190: Proxy get trap uses hasOwnProperty — consider Object.hasOwn or Object.prototype.hasOwnProperty.call.

Line 171 uses target.hasOwnProperty(property). If the target object was created with Object.create(null), it won't have hasOwnProperty. Config objects are unlikely to hit this, but defensive coding would use Object.prototype.hasOwnProperty.call(target, property) or the more modern Object.hasOwn(target, property).

---

913-918: Load.clone() double-merges the env object.

The constructor new Load(this.options, newEnv) sets copy.env = newEnv (already cloned). Then Util.extendDeep(copy, this) iterates this's enumerable properties including env, which merges the original's env data into the already-cloned copy. This is redundant (same data) but wasteful. Consider excluding env from the extend, or simplifying:

Alternative approach

   clone() {
     const newEnv = this.env.clone();
-    const copy = new Load(this.options, newEnv);
-
-    return Util.extendDeep(copy, this);
+    const copy = new Load(this.options, newEnv);
+    copy.config = Util.cloneDeep(this.config);
+    copy.sources = this.sources ? [...this.sources] : undefined;
+    copy.defaults = this.defaults ? Util.cloneDeep(this.defaults) : undefined;
+    copy.unmerged = this.unmerged ? Util.cloneDeep(this.unmerged) : undefined;
+    return copy;
   }

lib/config.js (4)

294-309: Double Object.preventExtensions call.

Util.makeImmutable(object) at line 304 already calls Object.preventExtensions(object) at the end (lib/util.js line 205). Line 305 calls it again. Harmless but redundant.

Remove the redundant call

     } else {
       Util.makeImmutable(object);
-      Object.preventExtensions(object);

       return object;
     }

---

342-429: Significant code duplication between makeImmutablePartial and Util.makeImmutable.

The proxy creation logic, descriptor checks, array handling, and RawConfig handling in makeImmutablePartial (lines 360-422) are near-identical to Util.makeImmutable (lib/util.js lines 142-203). The only difference is that makeImmutablePartial operates on a subset of properties rather than all keys.

Consider extracting the shared per-property immutability logic into a helper on Util that both paths can call, reducing the maintenance burden of keeping two copies in sync.

---

382-392: Unnecessary array spread and O(n) includes in proxy get trap.

Line 384-386 creates a new array from Object.getOwnPropertyNames(target) via spread, then uses includes() for lookup — both are O(n) per property access. In contrast, Util.makeImmutable uses target.hasOwnProperty(property) which is O(1). For consistency and performance:

Align with Util.makeImmutable

             get(target, property, receiver) {
-              const ownProps = [
-                ...Object.getOwnPropertyNames(target),
-              ]
-
-              // Bypass proxy receiver for properties directly on the target (e.g., RegExp.prototype.source)
-              // or properties that are not functions to prevent errors related to internal object methods.
-              if (ownProps.includes(property) || (property in target && typeof target[property] !== 'function')) {
+              if (Object.prototype.hasOwnProperty.call(target, property) || (property in target && typeof target[property] !== 'function')) {
                 return Reflect.get(target, property);
               }

---

540-567: attachProtoDeep silently skips attaching if a property with the same name exists.

Line 553: if (!toObject[fnName]) — if a config key happens to be named get, has, or util, the prototype method won't be attached and that sub-object's .get() / .has() will silently behave differently. This is pre-existing behavior, but worth noting as a potential footgun for users with these config key names.

lib/util.js (3)

167-173: Avoid calling hasOwnProperty directly on the target object.

target.hasOwnProperty(property) can throw or return incorrect results if the target has a null prototype or overrides hasOwnProperty. Use Object.prototype.hasOwnProperty.call(target, property) or Object.hasOwn(target, property) (Node ≥ 16.9).

Proposed fix

-              if (target.hasOwnProperty(property) || (property in target && typeof target[property] !== 'function')) {
+              if (Object.hasOwn(target, property) || (property in target && typeof target[property] !== 'function')) {

---

753-760: errorOnce looks correct; minor style nit.

new Error; on line 756 works but parentheses (new Error()) are conventional. Otherwise, the one-time logging approach is sound for its intended purpose.

---

909-918: Load.clone() — cloned env gets re-merged by extendDeep.

extendDeep(copy, this) will recursively merge this.env into copy.env, even though copy was already constructed with a fresh newEnv. The deep-merge effectively duplicates the work of this.env.clone(). This isn't buggy today because extendDeep merges object properties rather than replacing the reference, but it's fragile — if Env ever gains non-plain-object state (methods storing closures, symbols, etc.), the merge could introduce subtle issues.

Consider explicitly skipping env in the extend, or simplifying to only extend the fields that need copying (config, sources, defaults, unmerged).

lib/util.js (1)

207-207: Nit: missing semicolon.

Consistent with the rest of the codebase, consider adding a semicolon after Object.preventExtensions(object).

Proposed fix

-    Object.preventExtensions(object)
+    Object.preventExtensions(object);