From d0dc7b799241ce4e9780f551dd37b73e5f36fbcb Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Wed, 1 Apr 2026 10:49:17 +0000
Subject: [PATCH 1/2] Bump config from 4.3.0 to 4.4.1

Bumps [config](https://github.com/node-config/node-config) from 4.3.0 to 4.4.1.
- [Release notes](https://github.com/node-config/node-config/releases)
- [Changelog](https://github.com/node-config/node-config/blob/master/History.md)
- [Commits](https://github.com/node-config/node-config/compare/v4.3.0...v4.4.1)

---
updated-dependencies:
- dependency-name: config
  dependency-version: 4.4.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
---
 package.json | 2 +-
 yarn.lock    | 8 ++++----
 2 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/package.json b/package.json
index 2a32c7faea3..72797d90617 100644
--- a/package.json
+++ b/package.json
@@ -170,7 +170,7 @@
     "classnames": "2.5.1",
     "common-tags": "1.8.2",
     "compression": "1.8.1",
-    "config": "4.3.0",
+    "config": "4.4.1",
     "core-js": "3.49.0",
     "deep-eql": "4.1.3",
     "deepcopy": "2.1.0",
diff --git a/yarn.lock b/yarn.lock
index 003397e1af8..f114cf272d2 100644
--- a/yarn.lock
+++ b/yarn.lock
@@ -3813,10 +3813,10 @@ concurrently@^9.2.1:
     tree-kill "1.2.2"
     yargs "17.7.2"
 
-config@4.3.0:
-  version "4.3.0"
-  resolved "https://registry.yarnpkg.com/config/-/config-4.3.0.tgz#3310b972ac785e8124ec891d1cce81f767bf4561"
-  integrity sha512-nY/JbYPBxOCTC+Kj9dUf21t49VxwsL6GXRsAxlTY9N6MBTx/6TBQgT2t5PsAY+XUCMCNudARJPevUZeN3NhyHQ==
+config@4.4.1:
+  version "4.4.1"
+  resolved "https://registry.yarnpkg.com/config/-/config-4.4.1.tgz#01e3f6bdd261ccf211a4fdb2f1b319aa5a2928ad"
+  integrity sha512-XfN4Q4+wBKkGtgMyQ+5ayjepdb0MrdiGKfBr0G1PTLx9rnqsX+Xiw03LEUtSALZU0UVfcFp6+xYV0NL8HLF94g==
   dependencies:
     json5 "^2.2.3"
 

From 5f62c5df6fbffd1b95b57570091b21d2aff205b7 Mon Sep 17 00:00:00 2001
From: William Durand <will+git@drnd.me>
Date: Tue, 2 Jun 2026 11:01:09 +0200
Subject: [PATCH 2/2] Fix how we construct our fake config object

---
 tests/unit/helpers_node.js | 13 ++++++++++++-
 1 file changed, 12 insertions(+), 1 deletion(-)

diff --git a/tests/unit/helpers_node.js b/tests/unit/helpers_node.js
index d7ccdb116b6..341c114b2d1 100644
--- a/tests/unit/helpers_node.js
+++ b/tests/unit/helpers_node.js
@@ -73,7 +73,18 @@ export const getFakeConfig = (
       );
     }
   }
-  return Object.assign(Util.cloneDeep(config), params);
+  // `Util.cloneDeep` walks enumerable string keys via `for...in`, which skips
+  // node-config's private symbol (used internally by `.get()`) and the
+  // non-enumerable `util` property. Copy both so `.get()` works on the clone.
+  const fakeConfig = Util.cloneDeep(config);
+  for (const sym of Object.getOwnPropertySymbols(config)) {
+    fakeConfig[sym] = config[sym];
+  }
+  const utilDescriptor = Object.getOwnPropertyDescriptor(config, 'util');
+  if (utilDescriptor) {
+    Object.defineProperty(fakeConfig, 'util', utilDescriptor);
+  }
+  return Object.assign(fakeConfig, params);
 };
 
 export const getFakeLogger = (params = {}) => {