Skip to content

Bump toml and @netlify/vite-plugin - #82

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/multi-a5db22b530
Open

dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/multi-a5db22b530

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Oct 28, 2026

Copy link
Copy Markdown

Bumps toml to 5.0.1 and updates ancestor dependency @netlify/vite-plugin. These dependencies need to be updated together.

Updates toml from 3.0.0 to 5.0.1

Changelog

Sourced from toml's changelog.

5.0.1 - October 12 2026

  • Address four security advisories, each reachable by parsing untrusted input:
    • CVE-2026-114142, in which a crafted document could still write to Object.prototype. Two distinct key paths could render to the same bookkeeping string, letting an array-of-tables header clear the guard on an unrelated key, after which a dotted key could descend through a date value into its prototype chain. The compiler now records how each table was defined on the table itself rather than in string-keyed sets, so paths cannot collide and key paths can only descend through tables the compiler created.
    • CVE-2026-114143, in which dotted keys, table headers, and inline-table keys with many segments took quadratic time to resolve.
    • CVE-2026-114141, in which every array-of-tables header rescanned all paths defined so far, so documents with many such headers took quadratic time.
    • CVE-2026-114144, in which integer literals were converted to BigInt before any size check, so a multi-megabyte literal consumed super-linear CPU time before being rejected. Literals with more digits than any 64-bit integer are now rejected before conversion.

5.0.0 - July 14 2026

  • Breaking: Integers outside JavaScript's safe range (beyond ±Number.MAX_SAFE_INTEGER) now throw a parse error instead of silently returning a rounded value (#28). Opt in to lossless handling of the full 64-bit range with toml.parse(input, { bigint: true }), which returns all integer values as BigInt.
  • Breaking: Integers outside TOML's 64-bit signed integer range now throw a parse error in either mode, as required by the spec. Previously they were silently rounded.

4.3.0 - July 13 2026

  • Add opt-in Temporal support via toml.parse(input, { useTemporal: true }), mapping offset date-times to Temporal.ZonedDateTime and local date-times/dates/times to Temporal.PlainDateTime/PlainDate/PlainTime. An implementation can be supplied via the temporal option on runtimes without a Temporal global. (#69)

4.2.0 - July 13 2026

  • Address CVE-2026-77465, in which deeply nested arrays or inline tables could overflow the call stack and crash the process with an uncatchable RangeError. Nesting is now bounded (default 500 levels), and input past the limit throws a normal parse error. The limit is configurable via toml.parse(input, { maxDepth }).

4.1.2 - June 30 2026

  • Address CVE-2026-63376, in which a specially crafted TOML string could pollute Object.prototype process-wide.

4.1.1 - March 31 2026

  • Increase performance ~5x (#68)

4.1.0 - March 31 2026

  • Add spec v1.1.0 support (#67)

4.0.1 - March 31 2026

  • Minor packaging changes

4.0.0 - March 31 2026

  • Modernize tooling and support TOML v1.0.0 spec (#66)

... (truncated)

Commits

Updates @netlify/vite-plugin from 2.12.8 to 3.0.1

Release notes

Sourced from @​netlify/vite-plugin's releases.

vite-plugin: v3.0.1

3.0.1 (2026-08-28)

Bug Fixes

  • update dependency @​netlify/dev to ^5.0.2 (#61) (2ef81f5)

vite-plugin: v3.0.0

3.0.0 (2026-08-25)

⚠ BREAKING CHANGES

  • require Node.js 22.12+ (#48)

Features

  • require Node.js 22.12+ (#48) (b5b08cb)
  • vite-plugin: promote build options to experimental (#32) (566da57)

vite-plugin: v2.12.9

2.12.9 (2026-07-17)

Bug Fixes

  • deps: bulk upgrade deps and dev deps (#15) (f88c812)
Changelog

Sourced from @​netlify/vite-plugin's changelog.

3.0.1 (2026-08-28)

Bug Fixes

  • make a change to trigger a patch (#61) (2ef81f5)

3.0.0 (2026-08-25)

⚠ BREAKING CHANGES

  • require Node.js 22.12+ (#48)

Features

  • require Node.js 22.12+ (#48) (b5b08cb)
  • vite-plugin: promote build options to experimental (#32) (566da57)

2.12.9 (2026-07-17)

Bug Fixes

  • deps: bulk upgrade deps and dev deps (#15) (f88c812)
Commits
  • df066e3 chore: release main (#62)
  • 2ef81f5 fix: make a change to trigger a patch (#61)
  • 4a3363e chore(deps): update dependency @​netlify/dev to ^5.0.2 (#60)
  • 4d1dcde chore: release main (#33)
  • 1c9294b chore(deps): update dependency @​netlify/dev-utils to v6 (#41)
  • b5b08cb feat!: require Node.js 22.12+ (#48)
  • 480aaac chore(deps): update dependency @​netlify/dev to v5 (#39)
  • 55eaddf test: allow custom fixture dep overrides (#34)
  • 566da57 feat(vite-plugin): promote build options to experimental (#32)
  • 4a012d0 chore: release main (#23)
  • Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
    You can disable automated security fix PRs for this repo from the Security Alerts page.

Bumps [toml](https://github.com/BinaryMuse/toml-node) to 5.0.1 and updates ancestor dependency [@netlify/vite-plugin](https://github.com/netlify/framework-adapters/tree/HEAD/packages/vite-plugin). These dependencies need to be updated together.


Updates `toml` from 3.0.0 to 5.0.1
- [Changelog](https://github.com/BinaryMuse/toml-node/blob/main/CHANGELOG.md)
- [Commits](BinaryMuse/toml-node@v3.0.0...v5.0.1)

Updates `@netlify/vite-plugin` from 2.12.8 to 3.0.1
- [Release notes](https://github.com/netlify/framework-adapters/releases)
- [Changelog](https://github.com/netlify/framework-adapters/blob/main/packages/vite-plugin/CHANGELOG.md)
- [Commits](https://github.com/netlify/framework-adapters/commits/vite-plugin-v3.0.1/packages/vite-plugin)

---
updated-dependencies:
- dependency-name: toml
  dependency-version: 5.0.1
  dependency-type: indirect
- dependency-name: "@netlify/vite-plugin"
  dependency-version: 3.0.1
  dependency-type: direct:development
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Oct 28, 2026
@netlify

netlify Bot commented Oct 28, 2026 •

Copy link
Copy Markdown

✅ Deploy Preview for gonnaai ready!

Name Link
🔨 Latest commit 50addf2
🔍 Latest deploy log https://app.netlify.com/projects/gonnaai/deploys/6ae21693c78c37145134866d
😎 Deploy Preview https://deploy-preview-82--gonnaai.netlify.app
📱 Preview on mobile
Toggle QR Code...

QR Code

Use your smartphone camera to open QR code link.
Lighthouse
Lighthouse
1 paths audited
Performance: 51
Accessibility: 98
Best Practices: 83
SEO: 89
PWA: 80
View the detailed breakdown and full score reports

To edit notification comments on pull requests, go to your Netlify project configuration.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

configuration dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code size/XL

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants