Bump smol-toml from 1.6.1 to 1.7.1 - #15278
Conversation
Bumps [smol-toml](https://github.com/squirrelchat/smol-toml) from 1.6.1 to 1.7.1. - [Release notes](https://github.com/squirrelchat/smol-toml/releases) - [Commits](squirrelchat/smol-toml@v1.6.1...v1.7.1) --- updated-dependencies: - dependency-name: smol-toml dependency-version: 1.7.1 dependency-type: direct:production ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependencies
npm Package VersionsWarning The following packages have changed files but no version bump:
If these changes affect published code, consider bumping the version. |
🟡 Waiting for changesLast updated: 2026-09-10 15:38 UTC |
rtibblesbot
left a comment
rtibblesbot
left a comment
There was a problem hiding this comment.
PR #15278 — smol-toml 1.6.1 → 1.7.1, minor, production dep of packages/kolibri-i18n (build tooling).
1.7.1 fixes GHSA-7w5x-hrqm-74c2 (high): parse() hangs on an unterminated comment inside an array or inline table. 1.7.0's stringify float change misses the sole call site, toml.parse() at packages/kolibri-i18n/src/cli.js:48. No breaking or peer-dep changes.
CI red on a setup-uv manifest-fetch flake.
blocking: the manifest bump is a no-op — inline.
@rtibblesbot's comments are generated by an LLM, and should be evaluated accordingly
How was this generated?
Ran a dependency-update review pipeline over the version bump:
- Classified the bump by semver (patch / minor / major) and dependency type (production vs. development)
- Extracted the changelog and release notes across the version range
- Assessed compatibility with this project's usage and whether any code changes are required
- Treated CI as the primary safety net
- Scaled the review depth to the update's risk
- Chose the verdict from semver risk, changelog findings, and CI status
| "lodash": "catalog:", | ||
| "recast": "^0.23.11", | ||
| "smol-toml": "^1.6.1", | ||
| "smol-toml": "^1.7.1", |
There was a problem hiding this comment.
blocking: smol-toml is declared twice; line 36 still pins ^1.6.1, and JSON parsers keep the last key. Only pnpm-lock.yaml delivers 1.7.1, and ^1.6.1 re-admits vulnerable 1.6.x on the next regeneration. Delete line 36, re-run pnpm install.
Build Artifacts
Smoke test screenshot |
1 participant
Bumps smol-toml from 1.6.1 to 1.7.1.
Release notes
Sourced from smol-toml's releases.
Commits
3e978a9chore: bump versions30f5c36chore: add some@internalannotationsf0e0399chore(README.md): npmx, use star importa62f06frevert: keep using vite 789aa9a3chore: remove prepare script17c7974chore: make devEngine more lax w/ node versione5280a3ci: checkout repo first241c256chore: version bump0bfe7f4chore: build cjs with rolldown instead of esbuilde0620abchore: fmtDependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)You can disable automated security fix PRs for this repo from the Security Alerts page.