From 82e3ed27b7944c79570ddd18af1dd746ff251955 Mon Sep 17 00:00:00 2001 From: Ben Date: Fri, 4 Sep 2026 11:07:08 -0400 Subject: [PATCH] fix(security): bump toml 3.0.0 -> 4.3.0 (root package-lock.json) Closes Dependabot alerts #46 #47 #48 #49. - GHSA-v5mp-jgw5-2x6j / CVE-2026-63376 (high) - prototype pollution via a crafted TOML string; patched in 4.1.2. - GHSA-82x6-q7mm-w9cf (high) - stack-overflow DoS via deeply nested arrays / inline tables; patched in 4.2.0. toml is a direct dependency of the root package.json and the only requester, so this is a direct bump (^3.0.0 -> ^4.2.0, resolving to 4.3.0). No override needed. Lockfile regenerated with `npm install --package-lock-only`. Co-Authored-By: Claude Opus 5 (1M context) --- package-lock.json | 13 ++++++++----- package.json | 2 +- 2 files changed, 9 insertions(+), 6 deletions(-) diff --git a/package-lock.json b/package-lock.json index 8d7df77..72882ab 100644 --- a/package-lock.json +++ b/package-lock.json @@ -10,7 +10,7 @@ "license": "ISC", "dependencies": { "@iarna/toml": "^2.2.5", - "toml": "^3.0.0" + "toml": "^4.2.0" }, "devDependencies": { "typedoc": "^0.27.8" @@ -206,10 +206,13 @@ } }, "node_modules/toml": { - "version": "3.0.0", - "resolved": "https://registry.npmjs.org/toml/-/toml-3.0.0.tgz", - "integrity": "sha512-y/mWCZinnvxjTKYhJ+pYxwD0mRLVvOtdS2Awbgxln6iEnt4rk0yBxeSBHkGJcPucRiG0e55mwWp+g/05rsrd6w==", - "license": "MIT" + "version": "4.3.0", + "resolved": "https://registry.npmjs.org/toml/-/toml-4.3.0.tgz", + "integrity": "sha512-lVb8X9BsPVuH0M4BKeS91tXAmJvCjQ5UIyAbQFaxkKGyUFK2RPkhwaFSQH8vbpl1d23eu/IBH+dwVMHWaq9A5A==", + "license": "MIT", + "engines": { + "node": ">=20" + } }, "node_modules/typedoc": { "version": "0.27.8", diff --git a/package.json b/package.json index 6d49061..6292155 100644 --- a/package.json +++ b/package.json @@ -22,7 +22,7 @@ "license": "ISC", "dependencies": { "@iarna/toml": "^2.2.5", - "toml": "^3.0.0" + "toml": "^4.2.0" }, "devDependencies": { "typedoc": "^0.27.8"