From 809d4dec11d3a7bd92929409a6f743c87887e9b4 Mon Sep 17 00:00:00 2001 From: Cursor Agent Date: Mon, 14 Sep 2026 08:49:51 +0000 Subject: [PATCH] ci(security): pin docs-site smol-toml past GHSA-7w5x-hrqm-74c2 The Monday security cron failed npm audit --audit-level=high on docs-site because Astro's smol-toml 1.7.0 can hang on malformed TOML (CVE-2026-85730). Override to ^1.7.1 (lockfile 1.8.0). Remaining Scalar/ai-sdk findings are low and do not trip the gate. Signed-off-by: Cursor Agent Co-authored-by: Santosh kumar --- docs-site/package-lock.json | 6 +++--- docs-site/package.json | 1 + 2 files changed, 4 insertions(+), 3 deletions(-) diff --git a/docs-site/package-lock.json b/docs-site/package-lock.json index e1e1476..3a217f1 100644 --- a/docs-site/package-lock.json +++ b/docs-site/package-lock.json @@ -8906,9 +8906,9 @@ } }, "node_modules/smol-toml": { - "version": "1.7.0", - "resolved": "https://registry.npmjs.org/smol-toml/-/smol-toml-1.7.0.tgz", - "integrity": "sha512-aqVvWoyO21L23mb+drl4RmMXbf6N7FdHjAhTRA9ZBL7apWBgfWC16KjrASI+1p9GAroljyMHj6fK67i0UiTNvQ==", + "version": "1.8.0", + "resolved": "https://registry.npmjs.org/smol-toml/-/smol-toml-1.8.0.tgz", + "integrity": "sha512-kCZr2V3ch9i00x8zXRhjUNVcjG9ijES5dDudkXvUVCT5QlJNQWElSJdZqyPemffHoLNUYwOcou0Fy+ojN0uHSQ==", "license": "BSD-3-Clause", "engines": { "node": ">= 18" diff --git a/docs-site/package.json b/docs-site/package.json index 7c240dd..d8dd928 100644 --- a/docs-site/package.json +++ b/docs-site/package.json @@ -31,6 +31,7 @@ "js-yaml": "^4.3.2", "nanoid": "^3.3.18", "postcss": "^8.5.26", + "smol-toml": "^1.7.1", "svgo": "^4.1.0" } }