fix: parse TOML 1.1 manifests

.projenrc.js

@@ -43,14 +43,7 @@ project.addDevDeps('typescript@5.x');
 project.addDevDeps('@types/node@^18');
 project.addDevDeps('jest@^29');
 project.addDevDeps('ts-jest@^29');
-project.addBundledDeps('js-toml@^1.0.2');
-
-// Fix for GHSA-xxjr-mmjv-4gpg: lodash-es prototype pollution vulnerability
-// js-toml -> chevrotain -> lodash-es@4.17.21 is vulnerable
-// Force chevrotain@11.1.1+ which uses lodash-es@4.17.23 (patched)
-project.package.addField('resolutions', {
-  chevrotain: '^11.1.1',
-});
+project.addBundledDeps('js-toml@^2.0.1');
 
 project.addGitIgnore('target');
 project.gitignore.removePatterns('*.tgz');

test/cargo.test.ts

@@ -40,6 +40,12 @@ describe('getManifest', () => {
     expect(manifest.workspace?.members).toEqual(['binary1', 'binary2']);
   });
 
+  it('reads TOML 1.1 multi-line inline tables', () => {
+    const fixture = join(__dirname, 'fixtures/toml-1-1/Cargo.toml');
+    const manifest = getManifest(fixture);
+    expect(manifest.package?.name).toEqual('toml-1-1');
+  });
+
   it('reads binary sections', () => {
     const fixture = join(__dirname, 'fixtures/cargo-workspace/binary1/Cargo.toml');
     const manifest = getManifest(fixture);

test/fixtures/toml-1-1/Cargo.toml

@@ -0,0 +1,11 @@
+[package]
+name = "toml-1-1"
+version = "0.1.0"
+edition = "2024"
+
+# TOML 1.1 allows newlines and a trailing comma inside inline tables.
+[dependencies]
+tokio = {
+  version = "1",
+  features = ["macros", "rt-multi-thread"],
+}