chore(deps): bump @o3co/ts.hocon from 1.8.0 to 1.11.0 in the production-minor-patch group

[dependabot]

Bumps the production-minor-patch group with 1 update: @o3co/ts.hocon.

Updates @o3co/ts.hocon from 1.8.0 to 1.11.0

Release notes

Sourced from @​o3co/ts.hocon's releases.

v1.11.0

Changed (behavior) — read this before upgrading

Several fixes below change what previously "worked", always by refusing or reshaping input that was being mangled silently. In brief:

What changed	Before	Now
JSONC 1/*c*/2, tr/*c*/ue	parsed as 12 / true	SyntaxError
JSONC // comment ending at CR	ate the rest of the line, dropping keys with no error	ends at the CR
JSONC/YAML integer past 2^53	silently rounded	exact via getString; past int64 it errors
JSONC integer past 2^53 with no JSON.parse source access	silently rounded	ConfigError
APP_FOO.BAR (env)	nested as foo → bar	one key "foo.bar"; coexists with APP_FOO__BAR
env key case folding	full Unicode (İ → i̇)	ASCII-only (İ unchanged)
__proto__/constructor/prototype keys from properties, env, YAML, TOML	silently dropped	preserved, so toObject() output now contains them
Leading BOM	became part of the first key (properties) or a syntax error (JSONC/TOML)	stripped
-0 from an adapter	"0"	"-0"

The __proto__ one deserves a second look if you hand toObject() output to other code: Object.assign({}, data) and naive deep merges are unsafe with such a key present (the hazard is the destination's prototype, not this library's output). Use spread or structuredClone, or the new toObject({ nullPrototype: true }). See SECURITY.md.

Fixed — CJS entrypoints threw at load, then ESM include package(...) broke

• require('@o3co/ts.hocon') (and all six other subpath exports) crashed with ERR_INVALID_ARG_VALUE in 1.10.0. The include loader evaluated createRequire(import.meta.url) at module scope, and the CJS bundle shims import.meta to {}, so every require() of the package executed createRequire(undefined) before any user code ran.
• The first fix for that guarded on typeof require === 'function', which broke include package(...) in the ESM bundle: esbuild rewrites a bare require in ESM output into a Proxy whose typeof is "function" but whose .resolve is undefined, so every package include failed with a misleading "module not found". The loader now probes for .resolve itself and falls back to createRequire(import.meta.url), with a cwd anchor as a last resort. Both formats load and resolve package includes; verified against a packed tarball, not just the sources.
• The smoke gate now uses each entrypoint, not just loads it (pnpm smoke, tools/smoke-entrypoints.mjs): it resolves a real include package(...) through both bundles, parses a document with every adapter, and checks the declaration files each condition points at. It runs on PRs and in the release workflow, which previously published with no smoke step at all.

Fixed — CJS TypeScript consumers could not compile (TS1479)

• Every subpath pointed both module conditions at one dist/*.d.ts. The package is "type": "module", so TypeScript read those declarations as ESM and

... (truncated)

Changelog

Sourced from @​o3co/ts.hocon's changelog.

[1.11.0] - 2026-07-26

Changed (behavior) — read this before upgrading

Several fixes below change what previously "worked", always by refusing or reshaping input that was being mangled silently. In brief:

What changed	Before	Now
JSONC 1/*c*/2, tr/*c*/ue	parsed as 12 / true	SyntaxError
JSONC // comment ending at CR	ate the rest of the line, dropping keys with no error	ends at the CR
JSONC/YAML integer past 2^53	silently rounded	exact via getString; past int64 it errors
JSONC integer past 2^53 with no JSON.parse source access	silently rounded	ConfigError
APP_FOO.BAR (env)	nested as foo → bar	one key "foo.bar"; coexists with APP_FOO__BAR
env key case folding	full Unicode (İ → i̇)	ASCII-only (İ unchanged)
__proto__/constructor/prototype keys from properties, env, YAML, TOML	silently dropped	preserved, so toObject() output now contains them
Leading BOM	became part of the first key (properties) or a syntax error (JSONC/TOML)	stripped
-0 from an adapter	"0"	"-0"

The __proto__ one deserves a second look if you hand toObject() output to other code: Object.assign({}, data) and naive deep merges are unsafe with such a key present (the hazard is the destination's prototype, not this library's output). Use spread or structuredClone, or the new toObject({ nullPrototype: true }). See SECURITY.md.

Fixed — CJS entrypoints threw at load, then ESM include package(...) broke

• require('@o3co/ts.hocon') (and all six other subpath exports) crashed with ERR_INVALID_ARG_VALUE in 1.10.0. The include loader evaluated createRequire(import.meta.url) at module scope, and the CJS bundle shims import.meta to {}, so every require() of the package executed createRequire(undefined) before any user code ran.
• The first fix for that guarded on typeof require === 'function', which broke include package(...) in the ESM bundle: esbuild rewrites a bare require in ESM output into a Proxy whose typeof is "function" but whose .resolve is undefined, so every package include failed with a misleading "module not found". The loader now probes for .resolve itself and falls back to createRequire(import.meta.url), with a cwd anchor as a last resort. Both formats load and resolve package includes; verified against a packed tarball, not just the sources.
• The smoke gate now uses each entrypoint, not just loads it (pnpm smoke, tools/smoke-entrypoints.mjs): it resolves a real include package(...) through both bundles, parses a document with every adapter, and checks the declaration files each condition points at. It runs on PRs and in the release workflow, which previously published with no smoke step at all.

Fixed — CJS TypeScript consumers could not compile (TS1479)

• Every subpath pointed both module conditions at one dist/*.d.ts. The package is "type": "module", so TypeScript read those declarations as ESM and

... (truncated)

Commits

• 344184e chore(release): 1.11.0
• a92551e test(conformance): dispatch the properties format in the ingestion harness
• e31894f fix: unloadable CommonJS entrypoints, prototype-key loss, and silent number r...
• 7ed9c7e chore(release): 1.10.0
• d1012b8 feat(adapters): format adapters via subpath exports + fix .properties syntax ...
• f2c7fdf fix(lexer,parser,tests): Copilot review — plus-handling comment, error wordin...
• 7b17359 fix(parser,lexer): reject empty key-path segments (S11.7) and backtick in unq...
• 5ff636c fix(readme): reword path-traversal example to clear npm malware-scanner false...
• b5c7b0d ci(release): revert to OIDC trusted publishing (npm confirmed outage, not con...
• 24ce458 Update release.yml
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[dependabot]

Looks like @o3co/ts.hocon is updatable in another way, so this is no longer needed.