[dependabot]

Bumps smol-toml from 1.8.0 to 1.9.1.

Release notes

Sourced from smol-toml's releases.

v1.9.1

What's Changed

• fix: reject invalid extra exponent sign by @​cyyynthia

Full Changelog: squirrelchat/smol-toml@v1.9.0...v1.9.1

v1.9.0

Huge update!!! This is most likely the largest update the library received since its release, with lots of new features and improvements.

Performance improvements

Significant parts of the internal parse logic have been rewritten, improving performance by 1.5x-2x. The library was already comfortably ahead of the others, but it is now faster than ever, sitting at 4x faster parse performance than the closest maintained implementation.

Problematic code paths have also been replaced by safer implementations, solving potential DoS vectors. See GHSA-r4xh-jqrq-34v2.

Note: the objects returned by the library now have a null prototype. This is a transparent change for 99.9% of users, and is one of the most significant contributors to the major performance gains in this version.

Full Temporal support

Version 1.8.0 brought support for Temporal in stringify; now the library is also able to emit Temporal objects instead of its own ad-hoc TomlDate object. It is not enabled by default, but it will become the default in v2. Enable by setting useLegacyDate: false in the parser's options.

Better Temporal support in stringify

Temporal support has been improved since it released: Temporal objects that cannot be represented (such as Temporal.PlainMonthDay) now throw an error (instead of silently emitting a bogus object).

A new option has been added to stringify to disallow Temporal objects that cannot be fully represented in TOML. This includes ZonedDateTime objects with a IANA timezone attached instead of a plain offset, and dates with a specific calendar value set. Enable by setting strictTemporal: true in the options.

Handling of unsafe keys

Since its release the library has been protected against prototype pollution attacks, setting properties like __proto__ using safe mechanisms that do not trigger prototype pollution. However, while the returned objects are safe on their own, they may become problematic if used carelessly.

Inspired by secure-json-parse, the library now offers a way to either drop unsafe properties from the returned object, or to throw an error and reject documents altogether. By default, these potentially unsafe keys are preserved and returned.

Miscellaneous updates

• Unicode BOM is now gracefully accepted and ignored.
• Table array headers are now properly checked again. Reported in #65.
• Closed certain gaps where invalid whitespace would be accepted. Reported in #61.
• Bogus local date and local time values with a UTC offset are no longer accepted.
• Certain error messages are more accurate and handle errors at line boundaries better.
• The default export of the lib is now formally deprecated; use a import * instead. Proposed in #50.
• On Node 20+, strings that contain lone surrogates are now normalised to well-formed strings.
• On Node 20+, keys that contain lone surrogates are now rejected.

Full Changelog: squirrelchat/smol-toml@v1.8.0...v1.9.0

Commits

• 69aa050 fix: actually properly fix exponent issues
• 7be7084 chore: version bump
• be3290d chore: upgrade deps
• 86c7613 fix: reject invalid extra exponent sign
• 6f9739a fix: gate [is|to]WellFormed (Node 18 compat)
• a73ca32 fix: no Temporal with toml-test when Node < 26
• 7727890 chore: version bump
• 641903d chore: rewrite README.md
• 2df14c5 fix(types): make it work if Temporal doesn't exist
• 3eaa44e chore: update benchmark harness
• Additional commits viewable in compare view

[izo]

Remplacée par #128, fusionnée : les huit mises à jour y sont regroupées dans les deux lockfiles. Résultat : audit à 0, 604 tests unitaires et 64 e2e verts.

---

Generated by Claude Code

[dependabot]

OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting @dependabot ignore this major version or @dependabot ignore this minor version.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.