From 6dde43cd810133595b848edc41c08c1dc3eff1e3 Mon Sep 17 00:00:00 2001 From: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com> Date: Wed, 16 Sep 2026 16:00:12 +0000 Subject: [PATCH] fix(deps): bump smol-toml to 1.7.1 Fixes GHSA-7w5x-hrqm-74c2 (CVE-2026-85730): parse() infinite loop on malformed TOML. Co-Authored-By: Robert Yeakel --- bun.lock | 4 ++-- package.json | 2 +- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/bun.lock b/bun.lock index caa44cc..37c9f14 100644 --- a/bun.lock +++ b/bun.lock @@ -16,7 +16,7 @@ "hyparquet": "1.26.1", "hyparquet-writer": "0.16.1", "modal": "0.8.0", - "smol-toml": "1.6.1", + "smol-toml": "1.7.1", "yaml": "2.8.3", "zod": "4.4.3", }, @@ -502,7 +502,7 @@ "sisteransi": ["sisteransi@1.0.5", "", {}, "sha512-bLGGlR1QxBcynn2d5YmDX4MGjlZvy2MRBDRNHLJ8VI6l6+9FUiyTFNJ0IveOSP0bcXgVDPRcfGqA0pjaqUpfVg=="], - "smol-toml": ["smol-toml@1.6.1", "", {}, "sha512-dWUG8F5sIIARXih1DTaQAX4SsiTXhInKf1buxdY9DIg4ZYPZK5nGM1VRIYmEbDbsHt7USo99xSLFu5Q1IqTmsg=="], + "smol-toml": ["smol-toml@1.7.1", "", {}, "sha512-PPlsspAZ4jbMBu5DMFhfUGDQLu/vrL4SyBROVS37x8ynnVmFIs1VPBz1Co8Xks3TvpIaZXmU85y4DrQ+UyVFoQ=="], "stream-events": ["stream-events@1.0.5", "", { "dependencies": { "stubs": "^3.0.0" } }, "sha512-E1GUzBSgvct8Jsb3v2X15pjzN1tYebtbLaMg+eBOUOAxgbLoSbT2NS91ckc5lJD1KfLjId+jXJRgo0qnV5Nerg=="], diff --git a/package.json b/package.json index acd9607..9fb5cca 100644 --- a/package.json +++ b/package.json @@ -63,7 +63,7 @@ "hyparquet": "1.26.1", "hyparquet-writer": "0.16.1", "modal": "0.8.0", - "smol-toml": "1.6.1", + "smol-toml": "1.7.1", "yaml": "2.8.3", "zod": "4.4.3" },