fix(deps): bump smol-toml from 1.6.1 to 1.7.1

[dependabot]

Bumps smol-toml from 1.6.1 to 1.7.1.

Release notes

Sourced from smol-toml's releases.

v1.7.1

This release includes flagging internal functions as @internal to strip them from the emitted type declarations.

⚠️ Includes a fix for GHSA-7w5x-hrqm-74c2

Full Changelog: squirrelchat/smol-toml@v1.7.0...v1.7.1

v1.7.0

This version slightly changes the behaviour of stringify: integers beyond the safe range are always emitted as float numbers.

String decode logic has been rewritten, it is a bit faster now and uses a single-pass approach instead of a dual-pass approach as it did previously. The code should be a bit smaller too, though I didn't actually measure that.

The package is now published with source-maps, declaration-maps, and a copy of the original TypeScript source files. This will improve your DX if you're like me and like Ctrl+Click'ing things a lot. ;)

What's Changed

• improve performance of the string decode logic by @​cyyynthia
• fix(stringify): emit integer-valued numbers beyond the safe-integer range as floats by @​spokodev in squirrelchat/smol-toml#56
• publish source-maps, declaration-maps, and original source files by @​cyyynthia
• miscellaneous repository maintenance tasks by @​cyyynthia

New Contributors

• @​spokodev made their first contribution in squirrelchat/smol-toml#56

Full Changelog: squirrelchat/smol-toml@v1.6.1...v1.7.0

Commits

• 3e978a9 chore: bump versions
• 30f5c36 chore: add some @internal annotations
• f0e0399 chore(README.md): npmx, use star import
• a62f06f revert: keep using vite 7
• 89aa9a3 chore: remove prepare script
• 17c7974 chore: make devEngine more lax w/ node version
• e5280a3 ci: checkout repo first
• 241c256 chore: version bump
• 0bfe7f4 chore: build cjs with rolldown instead of esbuild
• e0620ab chore: fmt
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
cli-web-cli	Ready	Preview	Sep 11, 2026 1:54am UTC

[ci-lockfile-regen]

Dependabot Fix Assessment

Package: `smol-toml` `1.6.1` → `1.7.1` (minor)
Scope: runtime dependency (`dependencies` in root `package.json`)
Workspace: root

What changed upstream

• 1.7.1: Internal functions marked `@internal` to strip from type declarations; includes security fix for GHSA-7w5x-hrqm-74c2
• 1.7.0: `stringify` now emits integers beyond the safe integer range as floats (behaviour change, not breaking for our config use case); string decode logic rewritten for performance; source-maps and declaration-maps added
• Release notes

Migration concerns checked

• Peer dependencies: OK — no peer dep changes
• Type changes: OK — `parse` and `stringify` API is unchanged; `@internal` annotations strip internal helpers from the public type surface (not used by our code)
• Config files: OK — no config file changes needed
• Module format: OK — still ESM + CJS dual-publish
• React compatibility: N/A
• Monorepo impact: OK — `smol-toml` is only used in the root package (`src/services/config-manager.ts` and `src/commands/config/show.ts`)

What broke

• All three CI workflows (`Run Tests`, `E2E Tests`, `Web CLI E2E Tests`): `ERR_PNPM_LOCKFILE_CONFIG_MISMATCH` — the lockfile written by Dependabot did not match the `pnpm.overrides` configuration in `package.json`. The `dependabot-lockfile` workflow regenerated the lockfile (commit `b9ea533`), which resolved the installation failure.

What was fixed

1. `pnpm.overrides` updated — the existing security override `"smol-toml@<1.6.1": "1.6.1"` was updated to `"smol-toml@<1.7.1": "1.7.1"`. The old override only protected against pre-1.6.1 versions; the new one ensures all transitive deps (e.g. `@vercel/python-analysis@0.11.1` which required `smol-toml@1.6.1`) also receive the GHSA-7w5x-hrqm-74c2 security fix. This eliminates the duplicate smol-toml entry from the lockfile entirely.
2. Lockfile regenerated to reflect the updated override.
3. No code changes needed — the `parse`/`stringify` API we use in `src/services/config-manager.ts` and `src/commands/config/show.ts` is unchanged.

Verification

• Build: ✅
• Lint: ✅ (0 errors, 10 pre-existing warnings)
• Unit tests: ✅ (2644 passed, 1 todo, 188 files)
• Web CLI tests: ✅ (57 passed, 6 skipped)
• `pnpm install --frozen-lockfile`: ✅

Notes for reviewer

• The smol-toml security fix (GHSA-7w5x-hrqm-74c2) now applies to all dependencies in the tree, not just our direct dependency.

[ci-lockfile-regen]

Dependabot Fix Assessment

Package: `smol-toml` `1.6.1` → `1.7.1` (patch bump, security fix)
Scope: runtime dependency (`dependencies` in package.json)
Workspace: root

What changed upstream

• v1.7.1: Flags internal functions as `@internal` to strip them from emitted type declarations. Includes security fix for GHSA-7w5x-hrqm-74c2.
• v1.7.0: Integers beyond safe range are now emitted as floats in `stringify`; faster string decode logic rewritten to single-pass; source maps and TS sources now published.
• Full changelog

Migration concerns checked

• Peer dependencies: OK — no peer dep changes
• Type changes: OK — only @internal annotations added to internals; public API (parse, stringify) unchanged
• Config files: OK — no config file changes needed
• Module format: OK — ESM/CJS format unchanged
• React compatibility: N/A
• Monorepo impact: OK — only root workspace uses smol-toml (in src/services/config-manager.ts and src/commands/config/show.ts)

What broke

• E2E Tests (run 34551930319): No code failure — the run was cancelled by GitHub Actions with message "Canceling since a higher priority waiting request for E2E Tests-450 exists". This happens when a newer CI run supersedes an older one. There is no underlying code issue.

What was fixed

• No code changes required. The smol-toml API (parse and stringify) is unchanged between 1.6.1 and 1.7.1. Our usage in config-manager.ts and config/show.ts is unaffected.

Verification

• Build: ✅ (pnpm prepare succeeds)
• Lint: ✅ (0 errors, only pre-existing warnings)
• Unit tests: ✅ (188 passed, 1 skipped)
• Web CLI tests: ✅ (57 passed, 6 skipped)

Notes for reviewer

The lockfile was already regenerated by the "Regenerate Dependabot Lockfile" workflow. The new E2E run (34552511302) is currently in progress and should pass. This PR is safe to merge once CI completes.