chore(repo): Update dependency smol-toml@<1.6.1 to v1.7.1 [SECURITY]

[renovate]

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
smol-toml@<1.6.1	1.6.1 → 1.7.1

---

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

---

smol-toml: Denial of Service via malformed TOML documents

CVE-2026-85730 / GHSA-7w5x-hrqm-74c2

More information

Details

Summary

parse() can be forced into an infinite loop when a value inside an array or inline table is followed by a comment that has no trailing newline (i.e. the comment "ends" the document).

The library fails to exit an internal loop when attempting to find the end of the structure, resetting its cursor to the beginning of the string instead. This causes the parser to indefinitely hang, compromising the availability of the service.

Proof of concept

import { parse } from 'smol-toml'
parse('a=[1 #')   // never returns; CPU pinned at 100%

Impact

Applications which parse arbitrary TOML documents can suffer major availability issues if they receive malicious input. This issue is particularly severe for these use-cases, and it is strongly advised to upgrade to an up-to-date version of the library as soon as possible.

If your use-case does not involve parsing arbitrary TOML documents from untrusted sources, the impact is much lower in practice, although it's still advisable to update to version 1.7.1.

Patches

Version 1.7.1 properly breaks out of the loop in these situations and throws the expected TomlError.

Workarounds

None that don't involve refactors. Update the library as soon as possible if your use-case involves parsing arbitrary TOML documents from untrusted sources.

Reported By : Ravindu Lakmina Munaweera

Severity

• CVSS Score: 8.2 / 10 (High)
• Vector String: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

References

• https://github.com/squirrelchat/smol-toml/security/advisories/GHSA-7w5x-hrqm-74c2
• https://nvd.nist.gov/vuln/detail/CVE-2026-85730
• https://github.com/squirrelchat/smol-toml/commit/30f5c367d946b695f379b5d4f0946b2f0a0a8c2f
• https://github.com/squirrelchat/smol-toml/releases/tag/v1.7.1
• https://medium.com/@ravindu.lakmina1/seven-bytes-that-freeze-a-node-js-server-forever-the-story-of-cve-2026-85730-3213328b38f0
• https://github.com/advisories/GHSA-7w5x-hrqm-74c2

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Configuration

📅 Schedule: (in timezone GMT)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
clerk-js-sandbox	Ready	Preview	Oct 3, 2026 11:16pm UTC
swingset	Ready	Preview	Oct 3, 2026 11:16pm UTC

[changeset-bot]

⚠️ No Changeset found

Latest commit: 9c79774

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

• Configuration used: Repository YAML (base), Organization UI (inherited)
• Review profile: ASSERTIVE
• Plan: Advanced
• Run ID: 20c923b2-ae26-460a-991f-c586e459144e

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

• Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

---

_{Comment @coderabbitai help to get the list of available commands.}

[pkg-pr-new]

Open in StackBlitz

@clerk/astro

npm i https://pkg.pr.new/@clerk/astro@10061

@clerk/backend

npm i https://pkg.pr.new/@clerk/backend@10061

@clerk/chrome-extension

npm i https://pkg.pr.new/@clerk/chrome-extension@10061

@clerk/clerk-js

npm i https://pkg.pr.new/@clerk/clerk-js@10061

@clerk/electron

npm i https://pkg.pr.new/@clerk/electron@10061

@clerk/electron-passkeys

npm i https://pkg.pr.new/@clerk/electron-passkeys@10061

@clerk/eslint-plugin

npm i https://pkg.pr.new/@clerk/eslint-plugin@10061

@clerk/expo

npm i https://pkg.pr.new/@clerk/expo@10061

@clerk/expo-biometrics

npm i https://pkg.pr.new/@clerk/expo-biometrics@10061

@clerk/expo-google-signin

npm i https://pkg.pr.new/@clerk/expo-google-signin@10061

@clerk/expo-passkeys

npm i https://pkg.pr.new/@clerk/expo-passkeys@10061

@clerk/express

npm i https://pkg.pr.new/@clerk/express@10061

@clerk/fastify

npm i https://pkg.pr.new/@clerk/fastify@10061

@clerk/hono

npm i https://pkg.pr.new/@clerk/hono@10061

@clerk/localizations

npm i https://pkg.pr.new/@clerk/localizations@10061

@clerk/mosaic

npm i https://pkg.pr.new/@clerk/mosaic@10061

@clerk/nextjs

npm i https://pkg.pr.new/@clerk/nextjs@10061

@clerk/nuxt

npm i https://pkg.pr.new/@clerk/nuxt@10061

@clerk/react

npm i https://pkg.pr.new/@clerk/react@10061

@clerk/react-router

npm i https://pkg.pr.new/@clerk/react-router@10061

@clerk/shared

npm i https://pkg.pr.new/@clerk/shared@10061

@clerk/tanstack-react-start

npm i https://pkg.pr.new/@clerk/tanstack-react-start@10061

@clerk/testing

npm i https://pkg.pr.new/@clerk/testing@10061

@clerk/ui

npm i https://pkg.pr.new/@clerk/ui@10061

@clerk/upgrade

npm i https://pkg.pr.new/@clerk/upgrade@10061

@clerk/vue

npm i https://pkg.pr.new/@clerk/vue@10061

commit: 9c79774