From e232f4f02c9fd44718796fbeed0853043a590127 Mon Sep 17 00:00:00 2001 From: Aric Camarata Date: Thu, 10 Sep 2026 08:11:47 -0400 Subject: [PATCH] fix(deps): raise smol-toml floor to >=1.8.0 for GHSA-7w5x-hrqm-74c2 smol-toml <=1.7.0 never returns from parse() when a value inside an array or inline table is followed by a comment with no trailing newline. The parser resets its cursor to the start of the string instead of exiting an internal loop, so `parse('a=[1 #')` pins a core at 100 percent. HIGH, CWE-835. Reached through @astrojs/internal-helpers@0.10.0, which astro, @astrojs/react and @astrojs/vercel all pull in. The lockfile resolved 1.7.0. Floor set at 1.8.0 rather than the advisory's 1.7.1 minimum. @astrojs/internal-helpers declares ^1.6.0, so the whole 1.7.1-1.8.0 range satisfies it, and 1.8.0 is current latest. A floor pinned at exactly the first patched version goes stale the moment 1.8.x carries its own advisory. Published after the 2026-09-09 hardening pass, which is why three scheduled audit runs went red overnight on commits that were green when merged. Verified by islamwiki/web astro build against 1.8.0. smol-toml is only invoked by Astro's build-time TOML parsing. Refs D-2026-09-10-SMOLTOML-FLOOR --- package.json | 1 + pnpm-lock.yaml | 13 +++++++------ 2 files changed, 8 insertions(+), 6 deletions(-) diff --git a/package.json b/package.json index 668e5cf7..6e070a56 100644 --- a/package.json +++ b/package.json @@ -40,6 +40,7 @@ "js-yaml@>=3.0.0 <4.0.0": "^3.15.2", "next": "^16.2.11", "sharp": "^0.35.4", + "smol-toml": "^1.8.0", "browserslist": ">=4.28.7 <5" }, "patchedDependencies": { diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml index a1b5c6da..1cf4dd59 100644 --- a/pnpm-lock.yaml +++ b/pnpm-lock.yaml @@ -32,6 +32,7 @@ overrides: js-yaml@>=3.0.0 <4.0.0: ^3.15.2 next: ^16.2.11 sharp: ^0.35.4 + smol-toml: ^1.8.0 browserslist: '>=4.28.7 <5' packageExtensionsChecksum: sha256-Gf83mnNeOFm4bsdkkYyZ9wx0RwPU5iAVL3Q6BE4+YOg= @@ -9114,8 +9115,8 @@ packages: resolution: {integrity: sha512-vZ7rfeehZui7wQs438JXBckYLkIIdfHOXsaVEUMyS5fHo1483l1bMdo0EDSWYclY0yZKFOipDy4KHuKs6ssvdg==} engines: {node: '>=8.0.0'} - smol-toml@1.7.0: - resolution: {integrity: sha512-aqVvWoyO21L23mb+drl4RmMXbf6N7FdHjAhTRA9ZBL7apWBgfWC16KjrASI+1p9GAroljyMHj6fK67i0UiTNvQ==} + smol-toml@1.8.0: + resolution: {integrity: sha512-kCZr2V3ch9i00x8zXRhjUNVcjG9ijES5dDudkXvUVCT5QlJNQWElSJdZqyPemffHoLNUYwOcou0Fy+ojN0uHSQ==} engines: {node: '>= 18'} source-map-js@1.2.1: @@ -10541,7 +10542,7 @@ snapshots: picomatch: 4.0.4 retext-smartypants: 6.2.0 shiki: 4.3.1 - smol-toml: 1.7.0 + smol-toml: 1.8.0 unified: 11.0.5 '@astrojs/internal-helpers@0.11.0': @@ -10552,7 +10553,7 @@ snapshots: picomatch: 4.0.4 retext-smartypants: 6.2.0 shiki: 4.3.1 - smol-toml: 1.7.0 + smol-toml: 1.8.0 unified: 11.0.5 '@astrojs/language-server@2.16.10(prettier@3.8.3)(typescript@5.9.3)': @@ -15429,7 +15430,7 @@ snapshots: picomatch: 4.0.4 semver: 7.8.5 shiki: 4.3.1 - smol-toml: 1.7.0 + smol-toml: 1.8.0 svgo: 4.1.0 tinyclip: 0.1.15 tinyexec: 1.1.2 @@ -21097,7 +21098,7 @@ snapshots: slugify@1.6.9: {} - smol-toml@1.7.0: {} + smol-toml@1.8.0: {} source-map-js@1.2.1: {}