From 511413ff4edccdb18d9911641e3a63866e8c7510 Mon Sep 17 00:00:00 2001 From: JP-Ellis Date: Mon, 12 Oct 2026 11:58:52 +1100 Subject: [PATCH] fix: parse TOML 1.1 manifests Cargo accepts TOML 1.1 in Cargo.toml, including inline tables that span several lines. The bundled js-toml 1.0.2 parses TOML 1.0 only, so `getManifest` throws a syntax error on such a manifest and `cdk synth` fails before bundling starts. js-toml parses TOML 1.1 from 1.2.0. This bumps the bundled js-toml to ^2.0.1. The 2.x breaking changes only affect how dates and times are represented, and the manifest fields read here are strings. js-toml 2 depends on chevrotain 12, which no longer depends on lodash-es, so the chevrotain resolution added for GHSA-xxjr-mmjv-4gpg is no longer needed. Dropping it restores projen's default resolutions. Assisted-by: Claude Code:claude-opus-5-5 --- .projen/deps.json | 2 +- .projenrc.js | 9 +-- package.json | 5 +- test/cargo.test.ts | 6 ++ test/fixtures/toml-1-1/Cargo.toml | 11 +++ yarn.lock | 119 +++++++++++++++--------------- 6 files changed, 80 insertions(+), 72 deletions(-) create mode 100644 test/fixtures/toml-1-1/Cargo.toml diff --git a/.projen/deps.json b/.projen/deps.json index 23812a1..091cd23 100644 --- a/.projen/deps.json +++ b/.projen/deps.json @@ -97,7 +97,7 @@ }, { "name": "js-toml", - "version": "^1.0.2", + "version": "^2.0.1", "type": "bundled" }, { diff --git a/.projenrc.js b/.projenrc.js index 4e0b717..1b5358c 100644 --- a/.projenrc.js +++ b/.projenrc.js @@ -43,14 +43,7 @@ project.addDevDeps('typescript@5.x'); project.addDevDeps('@types/node@^18'); project.addDevDeps('jest@^29'); project.addDevDeps('ts-jest@^29'); -project.addBundledDeps('js-toml@^1.0.2'); - -// Fix for GHSA-xxjr-mmjv-4gpg: lodash-es prototype pollution vulnerability -// js-toml -> chevrotain -> lodash-es@4.17.21 is vulnerable -// Force chevrotain@11.1.1+ which uses lodash-es@4.17.23 (patched) -project.package.addField('resolutions', { - chevrotain: '^11.1.1', -}); +project.addBundledDeps('js-toml@^2.0.1'); project.addGitIgnore('target'); project.gitignore.removePatterns('*.tgz'); diff --git a/package.json b/package.json index e620255..13fe470 100644 --- a/package.json +++ b/package.json @@ -65,13 +65,14 @@ "constructs": "^10.0.5" }, "dependencies": { - "js-toml": "^1.0.2" + "js-toml": "^2.0.1" }, "bundledDependencies": [ "js-toml" ], "resolutions": { - "chevrotain": "^11.1.1" + "@types/babel__traverse": "7.18.2", + "@types/prettier": "2.6.0" }, "keywords": [ "cdk" diff --git a/test/cargo.test.ts b/test/cargo.test.ts index c1709c0..32275a6 100644 --- a/test/cargo.test.ts +++ b/test/cargo.test.ts @@ -40,6 +40,12 @@ describe('getManifest', () => { expect(manifest.workspace?.members).toEqual(['binary1', 'binary2']); }); + it('reads TOML 1.1 multi-line inline tables', () => { + const fixture = join(__dirname, 'fixtures/toml-1-1/Cargo.toml'); + const manifest = getManifest(fixture); + expect(manifest.package?.name).toEqual('toml-1-1'); + }); + it('reads binary sections', () => { const fixture = join(__dirname, 'fixtures/cargo-workspace/binary1/Cargo.toml'); const manifest = getManifest(fixture); diff --git a/test/fixtures/toml-1-1/Cargo.toml b/test/fixtures/toml-1-1/Cargo.toml new file mode 100644 index 0000000..a566f2d --- /dev/null +++ b/test/fixtures/toml-1-1/Cargo.toml @@ -0,0 +1,11 @@ +[package] +name = "toml-1-1" +version = "0.1.0" +edition = "2024" + +# TOML 1.1 allows newlines and a trailing comma inside inline tables. +[dependencies] +tokio = { + version = "1", + features = ["macros", "rt-multi-thread"], +} diff --git a/yarn.lock b/yarn.lock index cbadd7c..7951c83 100644 --- a/yarn.lock +++ b/yarn.lock @@ -264,12 +264,12 @@ dependencies: "@babel/helper-plugin-utils" "^7.27.1" -"@babel/runtime-corejs3@^7.26.9": - version "7.28.4" - resolved "https://registry.npmjs.org/@babel/runtime-corejs3/-/runtime-corejs3-7.28.4.tgz" - integrity sha512-h7iEYiW4HebClDEhtvFObtPmIvrd1SSfpI9EhOeKk4CtIK/ngBWFpuhCzhdmRKtg71ylcue+9I6dv54XYO1epQ== +"@babel/runtime-corejs3@^7.29.7": + version "7.29.10" + resolved "https://registry.yarnpkg.com/@babel/runtime-corejs3/-/runtime-corejs3-7.29.10.tgz#70f3380caa436ebbc9f1eff67c4fb7efe8778a5a" + integrity sha512-R4FKrg4Vy0hB7PfAxf9LOorEPd5/36SCIXPXAvjlQaQmPvtrjwoDXV15jsSm2ecsqBW1Iewwb7mEnG83xIEApg== dependencies: - core-js-pure "^3.43.0" + core-js-pure "^3.48.0" "@babel/template@^7.27.2", "@babel/template@^7.3.3": version "7.27.2" @@ -311,37 +311,35 @@ resolved "https://registry.npmjs.org/@bcoe/v8-coverage/-/v8-coverage-0.2.3.tgz" integrity sha512-0hYQ8SB4Db5zvZB4axdMHGwEaQjkZzFjQiN9LVYvIFB2nSUHW9tYpxWriPrWDASIxiaXax83REcLxuSdnGPZtw== -"@chevrotain/cst-dts-gen@11.1.1": - version "11.1.1" - resolved "https://registry.yarnpkg.com/@chevrotain/cst-dts-gen/-/cst-dts-gen-11.1.1.tgz#4224e0bb05064f7186886b5d9371e6ea9ff29326" - integrity sha512-fRHyv6/f542qQqiRGalrfJl/evD39mAvbJLCekPazhiextEatq1Jx1K/i9gSd5NNO0ds03ek0Cbo/4uVKmOBcw== +"@chevrotain/cst-dts-gen@12.0.0": + version "12.0.0" + resolved "https://registry.yarnpkg.com/@chevrotain/cst-dts-gen/-/cst-dts-gen-12.0.0.tgz#ec068e1e83c5fdad69d81773556cae97f0b5dcdb" + integrity sha512-fSL4KXjTl7cDgf0B5Rip9Q05BOrYvkJV/RrBTE/bKDN096E4hN/ySpcBK5B24T76dlQ2i32Zc3PAE27jFnFrKg== dependencies: - "@chevrotain/gast" "11.1.1" - "@chevrotain/types" "11.1.1" - lodash-es "4.17.23" + "@chevrotain/gast" "12.0.0" + "@chevrotain/types" "12.0.0" -"@chevrotain/gast@11.1.1": - version "11.1.1" - resolved "https://registry.yarnpkg.com/@chevrotain/gast/-/gast-11.1.1.tgz#f2af299cafb9b578912880e28df20f84b8507cab" - integrity sha512-Ko/5vPEYy1vn5CbCjjvnSO4U7GgxyGm+dfUZZJIWTlQFkXkyym0jFYrWEU10hyCjrA7rQtiHtBr0EaZqvHFZvg== +"@chevrotain/gast@12.0.0": + version "12.0.0" + resolved "https://registry.yarnpkg.com/@chevrotain/gast/-/gast-12.0.0.tgz#0e0cbf8eee01c7a4449b9caf19e5f3834dba2c35" + integrity sha512-1ne/m3XsIT8aEdrvT33so0GUC+wkctpUPK6zU9IlOyJLUbR0rg4G7ZiApiJbggpgPir9ERy3FRjT6T7lpgetnQ== dependencies: - "@chevrotain/types" "11.1.1" - lodash-es "4.17.23" + "@chevrotain/types" "12.0.0" -"@chevrotain/regexp-to-ast@11.1.1": - version "11.1.1" - resolved "https://registry.yarnpkg.com/@chevrotain/regexp-to-ast/-/regexp-to-ast-11.1.1.tgz#a413f59f82590df8d869d7c6233767aff734ba2e" - integrity sha512-ctRw1OKSXkOrR8VTvOxrQ5USEc4sNrfwXHa1NuTcR7wre4YbjPcKw+82C2uylg/TEwFRgwLmbhlln4qkmDyteg== +"@chevrotain/regexp-to-ast@12.0.0": + version "12.0.0" + resolved "https://registry.yarnpkg.com/@chevrotain/regexp-to-ast/-/regexp-to-ast-12.0.0.tgz#a90bc4b4f5337a883a88dddd0cca7c38cfe66a7a" + integrity sha512-p+EW9MaJwgaHguhoqwOtx/FwuGr+DnNn857sXWOi/mClXIkPGl3rn7hGNWvo31HA3vyeQxjqe+H36yZJwYU8cA== -"@chevrotain/types@11.1.1": - version "11.1.1" - resolved "https://registry.yarnpkg.com/@chevrotain/types/-/types-11.1.1.tgz#cfae33d6cfb3048a1ad8fc2277ee9fcf3e9252c9" - integrity sha512-wb2ToxG8LkgPYnKe9FH8oGn3TMCBdnwiuNC5l5y+CtlaVRbCytU0kbVsk6CGrqTL4ZN4ksJa0TXOYbxpbthtqw== +"@chevrotain/types@12.0.0": + version "12.0.0" + resolved "https://registry.yarnpkg.com/@chevrotain/types/-/types-12.0.0.tgz#a762b5c2b4f07496b56c93c30ce224b3637cc2c8" + integrity sha512-S+04vjFQKeuYw0/eW3U52LkAHQsB1ASxsPGsLPUyQgrZ2iNNibQrsidruDzjEX2JYfespXMG0eZmXlhA6z7nWA== -"@chevrotain/utils@11.1.1": - version "11.1.1" - resolved "https://registry.yarnpkg.com/@chevrotain/utils/-/utils-11.1.1.tgz#ba7608d5d3e358127dc0a89e2be24d131d36f750" - integrity sha512-71eTYMzYXYSFPrbg/ZwftSaSDld7UYlS8OQa3lNnn9jzNtpFbaReRRyghzqS7rI3CDaorqpPJJcXGHK+FE1TVQ== +"@chevrotain/utils@12.0.0": + version "12.0.0" + resolved "https://registry.yarnpkg.com/@chevrotain/utils/-/utils-12.0.0.tgz#9aab2055df43d0bb55919eaca76a9cda45e52b89" + integrity sha512-lB59uJoaGIfOOL9knQqQRfhl9g7x8/wqFkp13zTdkRu1huG9kg6IJs1O8hqj9rs6h7orGxHJUKb+mX3rPbWGhA== "@csstools/color-helpers@^5.1.0": version "5.1.0" @@ -898,7 +896,7 @@ "@babel/parser" "^7.1.0" "@babel/types" "^7.0.0" -"@types/babel__traverse@*", "@types/babel__traverse@^7.0.6": +"@types/babel__traverse@*", "@types/babel__traverse@7.18.2", "@types/babel__traverse@^7.0.6": version "7.18.2" resolved "https://registry.yarnpkg.com/@types/babel__traverse/-/babel__traverse-7.18.2.tgz#235bf339d17185bdec25e024ca19cce257cc7309" integrity sha512-FcFaxOr2V5KZCviw1TnutEMVUVsGt4D2hP1TAfXZAMKuHYW3xQhe3jTxNPWutgCJ3/X1c5yX8ZoGVEItxKbwBg== @@ -971,6 +969,11 @@ resolved "https://registry.npmjs.org/@types/normalize-package-data/-/normalize-package-data-2.4.4.tgz" integrity sha512-37i+OaWTh9qeK4LSHPsyRC7NahnGotNuZvjLSgcPzblpHB3rrCJxAOgI5gCdKm7coonsaX1Of0ILiTcnZjbfxA== +"@types/prettier@2.6.0": + version "2.6.0" + resolved "https://registry.yarnpkg.com/@types/prettier/-/prettier-2.6.0.tgz#efcbd41937f9ae7434c714ab698604822d890759" + integrity sha512-G/AdOadiZhnJp0jXCaBQU449W2h716OW/EoXeYkCytxKL06X1WCXB4DZpp8TpZ8eyIJVS1cw4lrlkkSYU21cDw== + "@types/stack-utils@^2.0.0": version "2.0.3" resolved "https://registry.npmjs.org/@types/stack-utils/-/stack-utils-2.0.3.tgz" @@ -1619,17 +1622,16 @@ char-regex@^1.0.2: resolved "https://registry.npmjs.org/char-regex/-/char-regex-1.0.2.tgz" integrity sha512-kWWXztvZ5SBQV+eRgKFeh8q5sLuZY2+8WUIzlxWVTg+oGwY14qylx1KbKzHd8P6ZYkAg0xyIDU9JMHhyJMZ1jw== -chevrotain@^11.0.3, chevrotain@^11.1.1: - version "11.1.1" - resolved "https://registry.yarnpkg.com/chevrotain/-/chevrotain-11.1.1.tgz#39be6f767cb22cc6a728246995ba906c5c2f2157" - integrity sha512-f0yv5CPKaFxfsPTBzX7vGuim4oIC1/gcS7LUGdBSwl2dU6+FON6LVUksdOo1qJjoUvXNn45urgh8C+0a24pACQ== +chevrotain@^12.0.0: + version "12.0.0" + resolved "https://registry.yarnpkg.com/chevrotain/-/chevrotain-12.0.0.tgz#8ebefe0a0516b1b314a8d9c7f4e948a509098d1c" + integrity sha512-csJvb+6kEiQaqo1woTdSAuOWdN0WTLIydkKrBnS+V5gZz0oqBrp4kQ35519QgK6TpBThiG3V1vNSHlIkv4AglQ== dependencies: - "@chevrotain/cst-dts-gen" "11.1.1" - "@chevrotain/gast" "11.1.1" - "@chevrotain/regexp-to-ast" "11.1.1" - "@chevrotain/types" "11.1.1" - "@chevrotain/utils" "11.1.1" - lodash-es "4.17.23" + "@chevrotain/cst-dts-gen" "12.0.0" + "@chevrotain/gast" "12.0.0" + "@chevrotain/regexp-to-ast" "12.0.0" + "@chevrotain/types" "12.0.0" + "@chevrotain/utils" "12.0.0" ci-info@^3.2.0: version "3.9.0" @@ -1928,10 +1930,10 @@ convert-source-map@^2.0.0: resolved "https://registry.npmjs.org/convert-source-map/-/convert-source-map-2.0.0.tgz" integrity sha512-Kvp459HrV2FEJ1CAsi1Ku+MY3kasH19TFykTz2xWmMeq6bk2NU3XXvfJ+Q61m0xktWwt+1HSYf3JZsTms3aRJg== -core-js-pure@^3.43.0: - version "3.46.0" - resolved "https://registry.npmjs.org/core-js-pure/-/core-js-pure-3.46.0.tgz" - integrity sha512-NMCW30bHNofuhwLhYPt66OLOKTMbOhgTTatKVbaQC3KRHpTCiRIBYvtshr+NBYSnBxwAFhjW/RfJ0XbIjS16rw== +core-js-pure@^3.48.0: + version "3.50.0" + resolved "https://registry.yarnpkg.com/core-js-pure/-/core-js-pure-3.50.0.tgz#263313e83606cb527005885da5be36c0a28f65ef" + integrity sha512-6GP3Pxz4IKyWjAfa747vIu/jilB5z29JWROLqH/b+pXVcpgh6tM06ZIBwSuglgVqzDYURhOK6oEzTrG0bCHitA== core-util-is@^1.0.3, core-util-is@~1.0.0: version "1.0.3" @@ -3756,13 +3758,13 @@ js-tokens@^4.0.0: resolved "https://registry.npmjs.org/js-tokens/-/js-tokens-4.0.0.tgz" integrity sha512-RdJUflcE3cUzKiMqQgsCu06FPu9UdIJO0beYbPhHN4k6apgJtifcoCtT9bcxOpYBtpD2kCM6Sbzg4CausW/PKQ== -js-toml@^1.0.2: - version "1.0.2" - resolved "https://registry.npmjs.org/js-toml/-/js-toml-1.0.2.tgz" - integrity sha512-/7IQ//bzn2a/5IDazPUNzlW7bsjxS51cxciYZDR+Z+3Le60yzT0YfI8KOWqTtBcZkXXVklhWd2OuGd8ZksB0wQ== +js-toml@^2.0.1: + version "2.0.1" + resolved "https://registry.yarnpkg.com/js-toml/-/js-toml-2.0.1.tgz#f378471337b711537f252ab907ae057495a5aaac" + integrity sha512-HH5e3fCXraX+FDTjpu0IuITue9AjKxAATaIoRDcUqqUyZnBdPCYlxHPpjGEwZW93WT6r8lPY73O0ADugrtQR1g== dependencies: - chevrotain "^11.0.3" - xregexp "^5.1.1" + chevrotain "^12.0.0" + xregexp "^5.1.2" js-yaml@3.14.1, js-yaml@^3.13.1: version "3.14.1" @@ -4063,11 +4065,6 @@ locate-path@^6.0.0: dependencies: p-locate "^5.0.0" -lodash-es@4.17.23: - version "4.17.23" - resolved "https://registry.yarnpkg.com/lodash-es/-/lodash-es-4.17.23.tgz#58c4360fd1b5d33afc6c0bbd3d1149349b1138e0" - integrity sha512-kVI48u3PZr38HdYz98UmfPnXl2DXrpdctLrFLCd3kOx1xUkOmpFPx7gCWWM5MPkL/fD8zb+Ph0QzjGFs4+hHWg== - lodash.ismatch@^4.4.0: version "4.4.0" resolved "https://registry.npmjs.org/lodash.ismatch/-/lodash.ismatch-4.4.0.tgz" @@ -5768,12 +5765,12 @@ xmlchars@^2.2.0: resolved "https://registry.npmjs.org/xmlchars/-/xmlchars-2.2.0.tgz" integrity sha512-JZnDKK8B0RCDw84FNdDAIpZK+JuJw+s7Lz8nksI7SIuU3UXJJslUthsi+uWBUYOwPFwW7W7PRLRfUKpxjtjFCw== -xregexp@^5.1.1: - version "5.1.2" - resolved "https://registry.npmjs.org/xregexp/-/xregexp-5.1.2.tgz" - integrity sha512-6hGgEMCGhqCTFEJbqmWrNIPqfpdirdGWkqshu7fFZddmTSfgv5Sn9D2SaKloR79s5VUiUlpwzg3CM3G6D3VIlw== +xregexp@^5.1.2: + version "5.1.3" + resolved "https://registry.yarnpkg.com/xregexp/-/xregexp-5.1.3.tgz#d3734782f183109a315f136df08f85198297d346" + integrity sha512-7uOg8BVk9kt6HnkeBdyW3VEq7KXzs4un/Efge4AN1FsAMzM6fYexggbWWkQcfHExQpQEoNkWXnr4wSWpqtx49Q== dependencies: - "@babel/runtime-corejs3" "^7.26.9" + "@babel/runtime-corejs3" "^7.29.7" xtend@~4.0.1: version "4.0.2"