[GH-ISSUE #817] fix(deps): remediate remaining smol-toml advisory on operator-config path #351

New issue

Closed

opened 2026-10-15 18:24:11 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-10-15 18:24:11 +00:00

Owner

Originally created by @morluto on GitHub (Oct 7, 2026).
Original GitHub issue: https://github.com/morluto/rea/issues/817

Follow-up to #785, which patched the two reachable advisories (@xmldom/xmldom, brace-expansion) and deliberately left smol-toml in place.

Why it was left out

smol-toml only parses operator configuration (not untrusted target content), so it is outside the reachable-from-target surface #785 covered.
Bumping it changes BOM handling and breaks a locked test, so it needs its own scoped change.

Expected work

Bump smol-toml to the patched release in-range if possible; otherwise document the pin.
Adjust the locked BOM test for the new behavior, or justify keeping the old behavior with an explicit unknown.
Re-run npm audit + the config test suite.

Related: #785.

Originally created by @morluto on GitHub (Oct 7, 2026). Original GitHub issue: https://github.com/morluto/rea/issues/817 Follow-up to #785, which patched the two reachable advisories (@xmldom/xmldom, brace-expansion) and deliberately left smol-toml in place. ## Why it was left out - smol-toml only parses operator configuration (not untrusted target content), so it is outside the reachable-from-target surface #785 covered. - Bumping it changes BOM handling and breaks a locked test, so it needs its own scoped change. ## Expected work - Bump smol-toml to the patched release in-range if possible; otherwise document the pin. - Adjust the locked BOM test for the new behavior, or justify keeping the old behavior with an explicit unknown. - Re-run npm audit + the config test suite. Related: #785.

bsakaguchi

2026-10-15 18:24:11 +00:00

closed this issue
added the
area: runtime

bug
labels

bsakaguchi referenced this issue

2026-10-16 21:13:07 +00:00

[PR #437] [MERGED] feat: complete evidence-backed roadmap workflows #1986

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

morluto/rea#351

No description provided.

Rows
Columns