Add JS-CATCH-FALLBACK-01 rule and update npm packages

Add PHP-ALIAS-01 rule: prohibit field aliasing in serialization

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>

node_modules/webpack/lib/DotenvPlugin.js

@@ -54,7 +54,7 @@ const validate = createSchemaValidation(
  * @returns {Env} parsed environment variables object
  */
 function parse(src) {
-	const obj = /** @type {Env} */ ({});
+	const obj = /** @type {Env} */ (Object.create(null));
 
 	// Convert buffer to string
 	let lines = src.toString();
@@ -174,7 +174,7 @@ function expandValue(value, processEnv, runningParsed) {
  */
 function expand(options) {
 	// for use with progressive expansion
-	const runningParsed = /** @type {Env} */ ({});
+	const runningParsed = /** @type {Env} */ (Object.create(null));
 	const processEnv = options.processEnv;
 
 	// dotenv.config() ran before this so the assumption is process.env has already been set
@@ -183,7 +183,8 @@ function expand(options) {
 
 		// short-circuit scenario: process.env was already set prior to the file value
 		value =
-			processEnv[key] && processEnv[key] !== value
+			Object.prototype.hasOwnProperty.call(processEnv, key) &&
+			processEnv[key] !== value
 				? /** @type {string} */ (processEnv[key])
 				: expandValue(value, processEnv, runningParsed);
 
@@ -332,7 +333,7 @@ class DotenvPlugin {
 
 		// Parse all files and merge (later files override earlier ones)
 		// Similar to Vite's implementation
-		const parsed = /** @type {Env} */ ({});
+		const parsed = /** @type {Env} */ (Object.create(null));
 
 		for (const content of contents) {
 			if (!content) continue;
@@ -422,7 +423,7 @@ class DotenvPlugin {
 		// Make a copy of process.env so that dotenv-expand doesn't modify global process.env
 		const processEnv = { ...process.env };
 		expand({ parsed, processEnv });
-		const env = /** @type {Env} */ ({});
+		const env = /** @type {Env} */ (Object.create(null));
 
 		// Get all keys from parser and process.env
 		const keys = [...Object.keys(parsed), ...Object.keys(process.env)];
@@ -430,7 +431,11 @@ class DotenvPlugin {
 		// Prioritize actual env variables from `process.env`, fallback to parsed
 		for (const key of keys) {
 			if (prefixes.some((prefix) => key.startsWith(prefix))) {
-				env[key] = process.env[key] ? process.env[key] : parsed[key];
+				env[key] =
+					Object.prototype.hasOwnProperty.call(process.env, key) &&
+					process.env[key]
+						? process.env[key]
+						: parsed[key];
 			}
 		}