chore: upgrade smol-toml to 1.8.0 to address CVE-2026-85730

[claude]

Fixes SOU-2206

Raises the existing qualified smol-toml@npm:^1.6.0 resolution floor from ^1.6.1 to ^1.7.1 and refreshes yarn.lock, which now resolves 1.8.0.

smol-toml is not a direct dependency of any workspace. It reaches the tree only through @react-grab/cli (via react-grab / @react-grab/mcp in packages/web), and its version is already governed by a qualified resolutions entry added for an earlier advisory. That entry was the thing holding the floor at ^1.6.1, which is still affected here, so the floor is what had to move rather than a manifest range.

Advisory addressed

Advisory	Patched in	Summary
CVE-2026-85730	1.7.1	Denial of service: parse() can be forced into an infinite loop by a value inside an array or inline table followed by an unterminated comment

Verification

• yarn why smol-toml reports every instance resolving to smol-toml@npm:1.8.0, with 1.6.1 gone from the graph.
• yarn workspace @sourcebot/web test --run — 140 files, 1440 tests passed.

🤖 Generated with Claude Code

---

Note

Low Risk
Dependency-only security patch with no runtime code changes; risk is limited to transitive TOML parsing behavior via @react-grab/cli.

Overview
Bumps the Yarn resolution for transitive smol-toml so the lockfile resolves 1.8.0 instead of 1.6.1, addressing CVE-2026-85730 (DoS via parse() hanging on crafted TOML with an unterminated comment). The floor on smol-toml@npm:^1.6.0 moves from ^1.6.1 to ^1.7.1 in package.json, with matching yarn.lock updates.

Documents the change under [Unreleased] → Fixed in CHANGELOG.md. No application source changes—only dependency pinning and release notes.

^{Reviewed by Cursor Bugbot for commit 39c071e. Bugbot is set up for automated code reviews on this repo. Configure here.}

---

Summary by cubic

Upgrades smol-toml to 1.8.0 to patch CVE-2026-85730, a denial-of-service vulnerability in parse().

Dependencies

• Raises the resolution floor for smol-toml@npm:^1.6.0 from ^1.6.1 to ^1.7.1; smol-toml is only a transitive dependency via @react-grab/cli.
• Adds a changelog entry under [Unreleased] → Fixed.

^{Written for commit 39c071e. Summary will update on new commits.}

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Advanced

Run ID: 97bb3696-656f-40df-b30f-b2917c605cd7

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

License Audit

⚠️ Status: PASS

Metric	Count
Total packages	2174
Resolved (non-standard)	26
Unresolved	0
Strong copyleft	0
Weak copyleft	28

Weak Copyleft Packages (informational)

Package	Version	License
@img/sharp-libvips-darwin-arm64	1.3.3	LGPL-3.0-or-later
@img/sharp-libvips-darwin-x64	1.3.3	LGPL-3.0-or-later
@img/sharp-libvips-linux-arm	1.3.3	LGPL-3.0-or-later
@img/sharp-libvips-linux-arm64	1.3.3	LGPL-3.0-or-later
@img/sharp-libvips-linux-ppc64	1.3.3	LGPL-3.0-or-later
@img/sharp-libvips-linux-riscv64	1.3.3	LGPL-3.0-or-later
@img/sharp-libvips-linux-s390x	1.3.3	LGPL-3.0-or-later
@img/sharp-libvips-linux-x64	1.3.3	LGPL-3.0-or-later
@img/sharp-libvips-linuxmusl-arm64	1.3.3	LGPL-3.0-or-later
@img/sharp-libvips-linuxmusl-x64	1.3.3	LGPL-3.0-or-later
@img/sharp-wasm32	0.35.4	Apache-2.0 AND LGPL-3.0-or-later AND MIT
@img/sharp-win32-arm64	0.35.4	Apache-2.0 AND LGPL-3.0-or-later
@img/sharp-win32-ia32	0.35.4	Apache-2.0 AND LGPL-3.0-or-later
@img/sharp-win32-x64	0.35.4	Apache-2.0 AND LGPL-3.0-or-later
axe-core	4.10.3	MPL-2.0
dompurify	3.4.13	(MPL-2.0 OR Apache-2.0)
lightningcss	1.32.0	MPL-2.0
lightningcss-android-arm64	1.32.0	MPL-2.0
lightningcss-darwin-arm64	1.32.0	MPL-2.0
lightningcss-darwin-x64	1.32.0	MPL-2.0
lightningcss-freebsd-x64	1.32.0	MPL-2.0
lightningcss-linux-arm-gnueabihf	1.32.0	MPL-2.0
lightningcss-linux-arm64-gnu	1.32.0	MPL-2.0
lightningcss-linux-arm64-musl	1.32.0	MPL-2.0
lightningcss-linux-x64-gnu	1.32.0	MPL-2.0
lightningcss-linux-x64-musl	1.32.0	MPL-2.0
lightningcss-win32-arm64-msvc	1.32.0	MPL-2.0
lightningcss-win32-x64-msvc	1.32.0	MPL-2.0

Resolved Packages (26)

Package	Version	Original	Resolved	Source
@sentry/cli	2.58.5	FSL-1.1-MIT	FSL-1.1-MIT	package LICENSE file in published npm tarball (version-matched in node_modules); self-identifies as "Functional Source License, Version 1.1, MIT Future License"
@sentry/cli	2.58.6	FSL-1.1-MIT	FSL-1.1-MIT	package LICENSE file in published npm tarball (version-matched in node_modules); self-identifies as "Functional Source License, Version 1.1, MIT Future License"
@sentry/cli-darwin	2.58.5	FSL-1.1-MIT	FSL-1.1-MIT	package LICENSE file in published npm tarball (version-matched in node_modules); self-identifies as "Functional Source License, Version 1.1, MIT Future License"
@sentry/cli-darwin	2.58.6	FSL-1.1-MIT	FSL-1.1-MIT	package LICENSE file in published npm tarball (version-matched in node_modules); self-identifies as "Functional Source License, Version 1.1, MIT Future License"
@sentry/cli-linux-arm	2.58.5	FSL-1.1-MIT	FSL-1.1-MIT	package LICENSE file in published npm tarball (version-matched in node_modules); self-identifies as "Functional Source License, Version 1.1, MIT Future License"
@sentry/cli-linux-arm	2.58.6	FSL-1.1-MIT	FSL-1.1-MIT	package LICENSE file in published npm tarball (version-matched in node_modules); self-identifies as "Functional Source License, Version 1.1, MIT Future License"
@sentry/cli-linux-arm64	2.58.5	FSL-1.1-MIT	FSL-1.1-MIT	package LICENSE file in published npm tarball (version-matched in node_modules); self-identifies as "Functional Source License, Version 1.1, MIT Future License"
@sentry/cli-linux-arm64	2.58.6	FSL-1.1-MIT	FSL-1.1-MIT	package LICENSE file in published npm tarball (version-matched in node_modules); self-identifies as "Functional Source License, Version 1.1, MIT Future License"
@sentry/cli-linux-i686	2.58.5	FSL-1.1-MIT	FSL-1.1-MIT	package LICENSE file in published npm tarball (version-matched in node_modules); self-identifies as "Functional Source License, Version 1.1, MIT Future License"
@sentry/cli-linux-i686	2.58.6	FSL-1.1-MIT	FSL-1.1-MIT	package LICENSE file in published npm tarball (version-matched in node_modules); self-identifies as "Functional Source License, Version 1.1, MIT Future License"
@sentry/cli-linux-x64	2.58.5	FSL-1.1-MIT	FSL-1.1-MIT	package LICENSE file in published npm tarball (version-matched in node_modules); self-identifies as "Functional Source License, Version 1.1, MIT Future License"
@sentry/cli-linux-x64	2.58.6	FSL-1.1-MIT	FSL-1.1-MIT	package LICENSE file in published npm tarball (version-matched in node_modules); self-identifies as "Functional Source License, Version 1.1, MIT Future License"
@sentry/cli-win32-arm64	2.58.5	FSL-1.1-MIT	FSL-1.1-MIT	package LICENSE file in published npm tarball (version-matched in node_modules); self-identifies as "Functional Source License, Version 1.1, MIT Future License"
@sentry/cli-win32-arm64	2.58.6	FSL-1.1-MIT	FSL-1.1-MIT	package LICENSE file in published npm tarball (version-matched in node_modules); self-identifies as "Functional Source License, Version 1.1, MIT Future License"
@sentry/cli-win32-i686	2.58.5	FSL-1.1-MIT	FSL-1.1-MIT	package LICENSE file in published npm tarball (version-matched in node_modules); self-identifies as "Functional Source License, Version 1.1, MIT Future License"
@sentry/cli-win32-i686	2.58.6	FSL-1.1-MIT	FSL-1.1-MIT	package LICENSE file in published npm tarball (version-matched in node_modules); self-identifies as "Functional Source License, Version 1.1, MIT Future License"
@sentry/cli-win32-x64	2.58.5	FSL-1.1-MIT	FSL-1.1-MIT	package LICENSE file in published npm tarball (version-matched in node_modules); self-identifies as "Functional Source License, Version 1.1, MIT Future License"
@sentry/cli-win32-x64	2.58.6	FSL-1.1-MIT	FSL-1.1-MIT	package LICENSE file in published npm tarball (version-matched in node_modules); self-identifies as "Functional Source License, Version 1.1, MIT Future License"
codemirror-lang-elixir	4.0.0	UNKNOWN	Apache-2.0	package LICENSE file in published npm tarball (version-matched in node_modules); full Apache License 2.0 text
khroma	2.1.0	UNKNOWN	MIT	package LICENSE file in published npm tarball (version-matched in node_modules); "The MIT License (MIT)"
lezer-elixir	1.1.2	UNKNOWN	Apache-2.0	package LICENSE file in published npm tarball (version-matched in node_modules); full Apache License 2.0 text
map-stream	0.1.0	UNKNOWN	MIT	package LICENSE file in published npm tarball (version-matched in node_modules) (LICENCE); verbatim MIT text
memorystream	0.3.1	UNKNOWN	MIT	extracted from object: package.json licenses:[{"type":"MIT"}]; confirmed by package LICENSE file in published npm tarball (version-matched in node_modules)
pause-stream	0.0.11	["MIT","Apache2"]	MIT OR Apache-2.0	extracted from array ["MIT","Apache2"]; confirmed by package LICENSE file in published npm tarball (version-matched in node_modules) ("Dual Licensed MIT and Apache 2")
posthog-js	1.369.0	SEE LICENSE IN LICENSE	Apache-2.0	package LICENSE file in published npm tarball (version-matched in node_modules); Apache-2.0 grant (vendored Sentry/Metro/Expo files remain MIT per file headers)
valid-url	1.0.9	UNKNOWN	MIT	package LICENSE file in published npm tarball (version-matched in node_modules); verbatim MIT text