This PR contains the following updates:

| Package | Change | Age | Confidence |
|---|---|---|---|
| smol-toml | 1.6.1 → 1.7.1 | | |

smol-toml: Denial of Service via malformed TOML documents

CVE-2026-85730 / GHSA-7w5x-hrqm-74c2

More information

#### Details
##### Summary
`parse()` can be forced into an infinite loop when a value inside an array or inline table is followed by a comment that has no trailing newline (i.e. the comment "ends" the document).

The library fails to exit an internal loop when attempting to find the end of the structure, resetting its cursor to the beginning of the string instead. This causes the parser to indefinitely hang, compromising the availability of the service.

##### Proof of concept

```js
import { parse } from 'smol-toml'
parse('a=[1 #') // never returns; CPU pinned at 100%
```

##### Impact

Applications which parse arbitrary TOML documents can suffer major availability issues if they receive malicious input. This issue is particularly severe for these use-cases, and it is **strongly advised** to upgrade to an up-to-date version of the library as soon as possible.

If your use-case does not involve parsing arbitrary TOML documents from untrusted sources, the impact is much lower in practice, although it's still advisable to update to version 1.7.1.

##### Patches

Version 1.7.1 properly breaks out of the loop in these situations and throws the expected `TomlError`.

##### Workarounds

None that don't involve refactors. Update the library **as soon as possible** if your use-case involves parsing arbitrary TOML documents from untrusted sources.

Reported By : [Ravindu Lakmina Munaweera](https://www.linkedin.com/in/ravindulakmina/)

#### Severity
- CVSS Score: 8.2 / 10 (High)
- Vector String: `CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N`

#### References
- [https://github.com/squirrelchat/smol-toml/security/advisories/GHSA-7w5x-hrqm-74c2](https://redirect.github.com/squirrelchat/smol-toml/security/advisories/GHSA-7w5x-hrqm-74c2)
- [https://nvd.nist.gov/vuln/detail/CVE-2026-85730](https://nvd.nist.gov/vuln/detail/CVE-2026-85730)
- [https://github.com/squirrelchat/smol-toml/commit/30f5c367d946b695f379b5d4f0946b2f0a0a8c2f](https://redirect.github.com/squirrelchat/smol-toml/commit/30f5c367d946b695f379b5d4f0946b2f0a0a8c2f)
- [https://github.com/squirrelchat/smol-toml/releases/tag/v1.7.1](https://redirect.github.com/squirrelchat/smol-toml/releases/tag/v1.7.1)
- [https://medium.com/@ravindu.lakmina1/seven-bytes-that-freeze-a-node-js-server-forever-the-story-of-cve-2026-85730-3213328b38f0](https://medium.com/@ravindu.lakmina1/seven-bytes-that-freeze-a-node-js-server-forever-the-story-of-cve-2026-85730-3213328b38f0)
- [https://github.com/advisories/GHSA-7w5x-hrqm-74c2](https://redirect.github.com/advisories/GHSA-7w5x-hrqm-74c2)

This data is provided by the [GitHub Advisory Database](https://redirect.github.com/advisories/GHSA-7w5x-hrqm-74c2) ([CC-BY 4.0](https://redirect.github.com/github/advisory-database/blob/main/LICENSE.md)).

Configuration

📅 Schedule: (UTC)

• Branch creation
  
  
  • At any time (no schedule defined)
  
  
  
  


• Automerge
  
  
  • At any time (no schedule defined)
  
  
  
  

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

• [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC45My43IiwidXBkYXRlZEluVmVyIjoiNDQuOTMuNyIsInRhcmdldEJyYW5jaCI6Im1haW4iLCJsYWJlbHMiOlsiZGVwZW5kZW5jaWVzIl19-->