fix: upgrade smol-toml to 1.7.1 (CVE-2026-85730)

[anupamme]

This upgrades smol-toml (currently 1.7.0) to 1.7.1, which carries the fix for CVE-2026-85730. The package is present in this repository's dependency tree; I have not verified that your code reaches the affected function.

Reference: CVE-2026-85730

What changed

• package.json
• package-lock.json

Verification

No automated check could be run against this repository, so this change is unverified beyond review. Please treat it as a suggestion.

---

Automated security fix by OrbisAI Security

[esperanza-volkov]

Thanks for the heads-up and the patch. Merged. confdiff parses arbitrary user-supplied TOML, so the DoS in smol-toml <1.7.1 (infinite loop on a comment with no trailing newline inside an array/inline table) is reachable here. Cutting a patch release so npm users pick up the fix.