Skip to content

fix: bump toml override to ^5.0.1 - #295

Merged
danielpeng1 merged 1 commit into
masterfrom
WCN-3798-bump-toml-override-to-5-0-1
Oct 23, 2026
Merged

danielpeng1 merged 1 commit into
masterfrom
WCN-3798-bump-toml-override-to-5-0-1

Conversation

@danielpeng1

Copy link
Copy Markdown
Contributor

Bump the transitive toml override to ^5.0.1 to clear 3 HIGH Trivy CVEs failing CI.

  • package.json: overrides.toml goes from ^4.2.0 to ^5.0.1 (toml comes in via sdk-coin-algo -> stellar-sdk).
  • package-lock.json: only the node_modules/toml entry changes, 4.3.0 to 5.0.1.
  • Fixes CVE-2026-114141, CVE-2026-114143 and CVE-2026-114144 (DoS in the TOML parser).

Ticket: WCN-3798

@danielpeng1 danielpeng1 self-assigned this Oct 23, 2026
@danielpeng1
danielpeng1 requested review from a team as code owners October 23, 2026 18:07

@claude claude Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Claude Code Review

This repository is configured for manual code reviews. Comment @claude review for a one-time review, or @claude review always to subscribe this PR to a review on every future push.

Tip: disable this comment in your organization's Code Review settings.

@linear-code

linear-code Bot commented Oct 23, 2026

Copy link
Copy Markdown

WCN-3798

@danielpeng1
danielpeng1 enabled auto-merge October 23, 2026 18:08
@danielpeng1
danielpeng1 merged commit 7b5848f into master Oct 23, 2026
23 checks passed
@danielpeng1
danielpeng1 deleted the WCN-3798-bump-toml-override-to-5-0-1 branch October 23, 2026 18:13
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants