Skip to content

Bump toml and netlify-cli - #16212

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/multi-bb044faf54
Open

dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/multi-bb044faf54

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Oct 27, 2026

Copy link
Copy Markdown
Contributor

Bumps toml to 5.0.1 and updates ancestor dependency netlify-cli. These dependencies need to be updated together.

Updates toml from 3.0.0 to 5.0.1

Changelog

Sourced from toml's changelog.

5.0.1 - October 12 2026

  • Address four security advisories, each reachable by parsing untrusted input:
    • GHSA-h895-cgqg-jf52, in which a crafted document could still write to Object.prototype. Two distinct key paths could render to the same bookkeeping string, letting an array-of-tables header clear the guard on an unrelated key, after which a dotted key could descend through a date value into its prototype chain. The compiler now records how each table was defined on the table itself rather than in string-keyed sets, so paths cannot collide and key paths can only descend through tables the compiler created.
    • GHSA-9j65-hcg3-gc64, in which dotted keys, table headers, and inline-table keys with many segments took quadratic time to resolve.
    • GHSA-4qx8-w7c3-pj3p, in which every array-of-tables header rescanned all paths defined so far, so documents with many such headers took quadratic time.
    • GHSA-9qmh-m7c6-f92p, in which integer literals were converted to BigInt before any size check, so a multi-megabyte literal consumed super-linear CPU time before being rejected. Literals with more digits than any 64-bit integer are now rejected before conversion.

5.0.0 - July 14 2026

  • Breaking: Integers outside JavaScript's safe range (beyond ±Number.MAX_SAFE_INTEGER) now throw a parse error instead of silently returning a rounded value (#28). Opt in to lossless handling of the full 64-bit range with toml.parse(input, { bigint: true }), which returns all integer values as BigInt.
  • Breaking: Integers outside TOML's 64-bit signed integer range now throw a parse error in either mode, as required by the spec. Previously they were silently rounded.

4.3.0 - July 13 2026

  • Add opt-in Temporal support via toml.parse(input, { useTemporal: true }), mapping offset date-times to Temporal.ZonedDateTime and local date-times/dates/times to Temporal.PlainDateTime/PlainDate/PlainTime. An implementation can be supplied via the temporal option on runtimes without a Temporal global. (#69)

4.2.0 - July 13 2026

  • Address security advisory GHSA-82x6-q7mm-w9cf (CVE pending), in which deeply nested arrays or inline tables could overflow the call stack and crash the process with an uncatchable RangeError. Nesting is now bounded (default 500 levels), and input past the limit throws a normal parse error. The limit is configurable via toml.parse(input, { maxDepth }).

4.1.2 - June 30 2026

  • Address CVE-2026-63376, in which a specially crafted TOML string could pollute Object.prototype process-wide.

4.1.1 - March 31 2026

  • Increase performance ~5x (#68)

4.1.0 - March 31 2026

  • Add spec v1.1.0 support (#67)

4.0.1 - March 31 2026

  • Minor packaging changes

4.0.0 - March 31 2026

  • Modernize tooling and support TOML v1.0.0 spec (#66)

... (truncated)

Commits

Updates netlify-cli from 18.1.0 to 27.15.0

Release notes

Sourced from netlify-cli's releases.

v27.15.0

27.15.0 (2026-10-27)

Features

v27.14.3

27.14.3 (2026-10-27)

Bug Fixes

  • deps: update dependency toml to v5 [security] (820f495)
  • pass the client address to Netlify Server in local dev (#8762) (4b99949)

v27.14.2

27.14.2 (2026-10-22)

Bug Fixes

  • dev: start server when standalone flag is enabled (#8650) (fb2f0bb)

v27.14.1

27.14.1 (2026-10-21)

Bug Fixes

  • deps: bump all netlify deps (24b0aa2)
  • deps: update netlify packages (c4e1447)

v27.14.0

27.14.0 (2026-10-20)

Features

Bug Fixes

v27.13.0

27.13.0 (2026-10-16)

... (truncated)

Changelog

Sourced from netlify-cli's changelog.

27.15.0 (2026-10-27)

Features

27.14.3 (2026-10-27)

Bug Fixes

  • deps: update dependency toml to v5 [security] (820f495)
  • pass the client address to Netlify Server in local dev (#8762) (4b99949)

27.14.2 (2026-10-22)

Bug Fixes

  • dev: start server when standalone flag is enabled (#8650) (fb2f0bb)

27.14.1 (2026-10-21)

Bug Fixes

  • deps: bump all netlify deps (24b0aa2)
  • deps: update netlify packages (c4e1447)

27.14.0 (2026-10-20)

Features

Bug Fixes

27.13.0 (2026-10-16)

Features

  • report CI environment CLI runs (77f9a3d)
  • support NETLIFY_TELEMETRY_DISABLED, DO_NOT_TRACK (#8620) (c6c4030)

... (truncated)

Commits
  • 944776c chore(main): release 27.15.0 (#8858)
  • f5afbe6 feat(logs): add a server log source (#8829)
  • 7c3919b feat(server): add scale configuration option (#8853)
  • 43f125f chore(main): release 27.14.3 (#8661)
  • 4b99949 fix: pass the client address to Netlify Server in local dev (#8762)
  • 4d59b5c chore(deps): update dependency fastify to v5.12.6 [security] (#8656)
  • f1632d5 build(deps): bump zod from 4.4.3 to 4.6.7
  • 0ecd589 build(deps): bump body-parser
  • 820f495 fix(deps): update dependency toml to v5 [security]
  • 6306231 ci: remove unused pre-release-sha
  • Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
    You can disable automated security fix PRs for this repo from the Security Alerts page.

Bumps [toml](https://github.com/BinaryMuse/toml-node) to 5.0.1 and updates ancestor dependency [netlify-cli](https://github.com/netlify/cli). These dependencies need to be updated together.


Updates `toml` from 3.0.0 to 5.0.1
- [Changelog](https://github.com/BinaryMuse/toml-node/blob/master/CHANGELOG.md)
- [Commits](BinaryMuse/toml-node@v3.0.0...v5.0.1)

Updates `netlify-cli` from 18.1.0 to 27.15.0
- [Release notes](https://github.com/netlify/cli/releases)
- [Changelog](https://github.com/netlify/cli/blob/main/CHANGELOG.md)
- [Commits](netlify/cli@v18.1.0...v27.15.0)

---
updated-dependencies:
- dependency-name: toml
  dependency-version: 5.0.1
  dependency-type: indirect
- dependency-name: netlify-cli
  dependency-version: 27.15.0
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
dependabot Bot requested a review from a team as a code owner October 27, 2026 23:56
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Oct 27, 2026
@netlify

netlify Bot commented Oct 27, 2026 •

Copy link
Copy Markdown

✅ Deploy Preview for devopsdays-web ready!

Name Link
🔨 Latest commit d41aca9
🔍 Latest deploy log https://app.netlify.com/projects/devopsdays-web/deploys/6ae13a1c286f06b1dd56b8f2
😎 Deploy Preview https://deploy-preview-16212--devopsdays-web.netlify.app
📱 Preview on mobile
Toggle QR Code...

QR Code

Use your smartphone camera to open QR code link.
🤖 Make changes Run an agent on this branch

To edit notification comments on pull requests, go to your Netlify project configuration.

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants