js-toml duplicate-key detection bypasses falsy values
js-toml's duplicate-key detection uses truthy checks (`if (object[key])`) instead of the `in` operator, allowing falsy primitives (`false`, `0`, `0n`, `0.
What changed
js-toml's duplicate-key detection uses truthy checks (`if (object[key])`) instead of the `in` operator, allowing falsy primitives (`false`, `0`, `0n`, `0.0`, `-0`, `""`) to be silently overwritten by later sub-tables, dotted-key sub-tables, or array-of-tables. This violates the TOML 1.0.0 spec and causes structural type confusion.
Who it affects
All users of js-toml who parse TOML input that may contain duplicate keys with falsy initial values. Applications that rely on truthy checks of parsed values (e.g., `if (config.flag)`) are vulnerable to logic bypass.
What to do today
Update js-toml to a patched version once available, or apply the suggested fix in `src/load/interpreter.ts` by replacing `if (object[key])` with `if (key in object)` and `if (object[first] && !Array.isArray(object[first]))` with `if (first in object && !Array.isArray(object[first]))`.