fix(security/high/): update dependency smol-toml to v1.7.1 [security] - #194
Merged
Merged
Conversation
| datasource | package | from | to | | ---------- | --------- | ----- | ----- | | npm | smol-toml | 1.6.1 | 1.7.1 | Signed-off-by: renovate-sh-app[bot] <219655108+renovate-sh-app[bot]@users.noreply.github.com>
domasx2
approved these changes
Sep 22, 2026
domasx2
left a comment
domasx2
left a comment
Contributor
There was a problem hiding this comment.
Security bump, green CI. Approving as part of the RUM CVE SLO cleanup.
Reply posted by Claude on Domas's behalf.
domasx2
added a commit
that referenced
this pull request
Sep 22, 2026
…y CVEs The packages are transitive-only, so Renovate cannot open security PRs for them. Pin them through the existing resolutions block instead. Three traps this works around: - Yarn Berry applies a ranged resolution key only when the range matches the requested descriptor exactly, so brace-expansion is pinned per descriptor rather than per major. - nx pins brace-expansion and smol-toml to exact vulnerable versions, which bypasses the unscoped resolutions, hence the nx/* entries. - postcss 8.5.18 fixes CVE-2026-73646 but is still hit by CVE-2026-69153, an incomplete-fix follow-up, so it goes to 8.5.23. Also closes the residuals left by #193 and #194: both CVEs also affect an older major line in the tree (js-yaml 3.x, smol-toml via nx) that those PRs did not cover. Every resolved version is verified against the GitHub advisory database.
domasx2
added a commit
that referenced
this pull request
Sep 22, 2026
…y CVEs (#198) The packages are transitive-only, so Renovate cannot open security PRs for them. Pin them through the existing resolutions block instead. Three traps this works around: - Yarn Berry applies a ranged resolution key only when the range matches the requested descriptor exactly, so brace-expansion is pinned per descriptor rather than per major. - nx pins brace-expansion and smol-toml to exact vulnerable versions, which bypasses the unscoped resolutions, hence the nx/* entries. - postcss 8.5.18 fixes CVE-2026-73646 but is still hit by CVE-2026-69153, an incomplete-fix follow-up, so it goes to 8.5.23. Also closes the residuals left by #193 and #194: both CVEs also affect an older major line in the tree (js-yaml 3.x, smol-toml via nx) that those PRs did not cover. Every resolved version is verified against the GitHub advisory database.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
1.6.1→1.7.1smol-toml: Denial of Service via malformed TOML documents
CVE-2026-85730 / GHSA-7w5x-hrqm-74c2
More information
Details
Summary
parse()can be forced into an infinite loop when a value inside an array or inline table is followed by a comment that has no trailing newline (i.e. the comment "ends" the document).The library fails to exit an internal loop when attempting to find the end of the structure, resetting its cursor to the beginning of the string instead. This causes the parser to indefinitely hang, compromising the availability of the service.
Proof of concept
Impact
Applications which parse arbitrary TOML documents can suffer major availability issues if they receive malicious input. This issue is particularly severe for these use-cases, and it is strongly advised to upgrade to an up-to-date version of the library as soon as possible.
If your use-case does not involve parsing arbitrary TOML documents from untrusted sources, the impact is much lower in practice, although it's still advisable to update to version 1.7.1.
Patches
Version 1.7.1 properly breaks out of the loop in these situations and throws the expected
TomlError.Workarounds
None that don't involve refactors. Update the library as soon as possible if your use-case involves parsing arbitrary TOML documents from untrusted sources.
Reported By : Ravindu Lakmina Munaweera
Severity
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:NReferences
This data is provided by the GitHub Advisory Database (CC-BY 4.0).
smol-toml: Denial of Service via malformed TOML documents
CVE-2026-85730 / GHSA-7w5x-hrqm-74c2
More information
Details
Summary
parse()can be forced into an infinite loop when a value inside an array or inline table is followed by a comment that has no trailing newline (i.e. the comment "ends" the document).The library fails to exit an internal loop when attempting to find the end of the structure, resetting its cursor to the beginning of the string instead. This causes the parser to indefinitely hang, compromising the availability of the service.
Proof of concept
Impact
Applications which parse arbitrary TOML documents can suffer major availability issues if they receive malicious input. This issue is particularly severe for these use-cases, and it is strongly advised to upgrade to an up-to-date version of the library as soon as possible.
If your use-case does not involve parsing arbitrary TOML documents from untrusted sources, the impact is much lower in practice, although it's still advisable to update to version 1.7.1.
Patches
Version 1.7.1 properly breaks out of the loop in these situations and throws the expected
TomlError.Workarounds
None that don't involve refactors. Update the library as soon as possible if your use-case involves parsing arbitrary TOML documents from untrusted sources.
Reported By : Ravindu Lakmina Munaweera
Severity
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:NReferences
This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).
Configuration
📅 Schedule: (UTC)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
Need help?
You can ask for more help in the following Slack channel: #proj-renovate-self-hosted. In that channel you can also find ADR and FAQ docs in the Resources section.