fix(deps): raise smol-toml floor to >=1.8.0 for GHSA-7w5x-hrqm-74c2 - #106
Merged
Merged
Conversation
smol-toml <=1.7.0 never returns from parse() when a value inside an array
or inline table is followed by a comment with no trailing newline. The
parser resets its cursor to the start of the string instead of exiting an
internal loop, so `parse('a=[1 #')` pins a core at 100 percent. HIGH,
CWE-835.
Reached through @astrojs/internal-helpers@0.10.0, which astro, @astrojs/react
and @astrojs/vercel all pull in. The lockfile resolved 1.7.0.
Floor set at 1.8.0 rather than the advisory's 1.7.1 minimum.
@astrojs/internal-helpers declares ^1.6.0, so the whole 1.7.1-1.8.0 range
satisfies it, and 1.8.0 is current latest. A floor pinned at exactly the
first patched version goes stale the moment 1.8.x carries its own advisory.
Published after the 2026-09-09 hardening pass, which is why three scheduled
audit runs went red overnight on commits that were green when merged.
Verified by islamwiki/web astro build against 1.8.0. smol-toml is only
invoked by Astro's build-time TOML parsing.
Refs D-2026-09-10-SMOLTOML-FLOOR
|
The latest updates on your projects. Learn more about Vercel for GitHub. 2 Skipped Deployments
|
🟢 Rampart Security Gate — CLEAN
Totals: 0 critical · 0 high · 0 medium · 0 low Mode: |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Raises the
smol-tomloverride floor to>=1.8.0.GHSA-7w5x-hrqm-74c2 — HIGH, CWE-835.
smol-toml.parse()never returns when a value inside an array or inline table is followed by a comment with no trailing newline.parse("a=[1 #")pins a core at 100%. Vulnerable<=1.7.0, first patched1.7.1.Reached through
@astrojs/internal-helpers@0.10.0, pulled byastro,@astrojs/reactand@astrojs/vercelalike. The lockfile resolved 1.7.0.Why 1.8.0 and not the advisory minimum.
@astrojs/internal-helpersdeclares^1.6.0, so 1.7.1, 1.7.2 and 1.8.0 all satisfy it, and 1.8.0 is currentlatest. A floor pinned at exactly the first patched version goes stale the moment 1.8.x carries its own advisory.Why this is not a regression. The advisory was published after the 2026-09-09 hardening pass, which is why the scheduled audit runs went red overnight on commits that were green when merged. An override floor only protects against advisories that exist when it is written.
Verified: all four repo install roots resolve
smol-toml@1.8.0;islamwiki/webastro buildexits 0 against it with zero errors.Merging this is also the ASI Policy 9.0 deploy approval for the repo it lands in.