[PR #863] [MERGED] fix(deps): remediate smol-toml advisories #2299

New issue

Closed

opened 2026-10-16 21:16:55 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-10-16 21:16:55 +00:00

Owner

📋 Pull Request Information

Original PR: https://github.com/morluto/rea/pull/863
Author: @kaoru0822-kitauji
Created: 10/7/2026
Status: ✅ Merged
Merged: 10/7/2026
Merged by: @kaoru0822-kitauji

Base: main ← Head: fix/smol-toml-advisory

📝 Commits (1)

c55ae3b fix(deps): remediate smol-toml advisories

📊 Changes

3 files changed (+7 additions, -23 deletions)

View changed files

📝 package-lock.json (+4 -17)
📝 package.json (+1 -1)
📝 src/application/ClientConfigurationDocument.test.ts (+2 -5)

📄 Description

Summary

update the direct smol-toml dependency from 1.7.0 to 1.9.0
deduplicate Knip's existing 1.9.0 transitive copy in the lockfile
update the locked TOML configuration contract for 1.9.0's leading-BOM support

Reproduction and behavior

Before this change, npm audit --json reports the direct smol-toml dependency as vulnerable to:

GHSA-7w5x-hrqm-74c2 (malformed-document denial of service, affecting <=1.7.0)
GHSA-r4xh-jqrq-34v2 (quadratic key parsing, affecting <=1.8.0)

The audit-recommended non-major fix is 1.9.0. After the update, npm audit --json reports zero vulnerabilities and npm ls smol-toml --all shows both REA and Knip using one deduplicated 1.9.0 installation.

Version 1.9.0 accepts a UTF-8 BOM at the start of a TOML document. The existing test deliberately locked 1.7.0's rejection, so it now verifies that otherwise-identical configuration parses with and without the leading BOM.

Fixes #817.

Validation

63 tests across:
- src/application/ClientConfigurationDocument.test.ts
- tests/boundary/filesystem/clientConfigurationBom.test.ts
npm audit --json: zero vulnerabilities
npm ls smol-toml --all: 1.9.0, deduplicated
TypeScript 5.9.3 tsc --noEmit
lint with --deny-warnings on the changed TypeScript test
formatting check on all changed files
npm run knip
npm run metadata:check
git diff --check

Unverified coverage

The default TypeScript 7 binary panics in this execution environment because /proc/self/exe is unavailable. Consequently, npm run check, the build-triggered package verifier, and the normal lifecycle-enabled npm pack --dry-run could not complete locally. A no-lifecycle pack dry run completed, but it does not establish the built package boundary. Hosted CI remains the authoritative full build, package, and deterministic-suite verification.

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/morluto/rea/pull/863 **Author:** [@kaoru0822-kitauji](https://github.com/kaoru0822-kitauji) **Created:** 10/7/2026 **Status:** ✅ Merged **Merged:** 10/7/2026 **Merged by:** [@kaoru0822-kitauji](https://github.com/kaoru0822-kitauji) **Base:** `main` ← **Head:** `fix/smol-toml-advisory` --- ### 📝 Commits (1) - [`c55ae3b`](https://github.com/morluto/rea/commit/c55ae3b9eccc17e6e8f4369e13044995d0650704) fix(deps): remediate smol-toml advisories ### 📊 Changes **3 files changed** (+7 additions, -23 deletions) <details> <summary>View changed files</summary> 📝 `package-lock.json` (+4 -17) 📝 `package.json` (+1 -1) 📝 `src/application/ClientConfigurationDocument.test.ts` (+2 -5) </details> ### 📄 Description ## Summary - update the direct `smol-toml` dependency from 1.7.0 to 1.9.0 - deduplicate Knip's existing 1.9.0 transitive copy in the lockfile - update the locked TOML configuration contract for 1.9.0's leading-BOM support ## Reproduction and behavior Before this change, `npm audit --json` reports the direct `smol-toml` dependency as vulnerable to: - GHSA-7w5x-hrqm-74c2 (malformed-document denial of service, affecting <=1.7.0) - GHSA-r4xh-jqrq-34v2 (quadratic key parsing, affecting <=1.8.0) The audit-recommended non-major fix is 1.9.0. After the update, `npm audit --json` reports zero vulnerabilities and `npm ls smol-toml --all` shows both REA and Knip using one deduplicated 1.9.0 installation. Version 1.9.0 accepts a UTF-8 BOM at the start of a TOML document. The existing test deliberately locked 1.7.0's rejection, so it now verifies that otherwise-identical configuration parses with and without the leading BOM. Fixes #817. ## Validation - 63 tests across: - `src/application/ClientConfigurationDocument.test.ts` - `tests/boundary/filesystem/clientConfigurationBom.test.ts` - `npm audit --json`: zero vulnerabilities - `npm ls smol-toml --all`: 1.9.0, deduplicated - TypeScript 5.9.3 `tsc --noEmit` - lint with `--deny-warnings` on the changed TypeScript test - formatting check on all changed files - `npm run knip` - `npm run metadata:check` - `git diff --check` ## Unverified coverage The default TypeScript 7 binary panics in this execution environment because `/proc/self/exe` is unavailable. Consequently, `npm run check`, the build-triggered package verifier, and the normal lifecycle-enabled `npm pack --dry-run` could not complete locally. A no-lifecycle pack dry run completed, but it does not establish the built package boundary. Hosted CI remains the authoritative full build, package, and deterministic-suite verification. --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>

bsakaguchi

2026-10-16 21:16:55 +00:00