Update dependency js-toml to v1.2.2 #35

Merged

MarkerBot merged 1 commit from renovate/js-toml-1.x-lockfile into main

2026-08-03 22:03:00 -07:00

MarkerBot commented

2026-08-03 22:00:56 -07:00

Member

This PR contains the following updates:

Package	Change	Age	Confidence
js-toml	`1.2.1` → `1.2.2`

Release Notes

sunnyadn/js-toml (js-toml)

`v1.2.2`

Compare Source

Security

Fix exponential backtracking in the multi-line basic string grammar (GHSA-j4cp-cc36-jxwg, CWE-1333). The escaped-newline rule ended in (whiteSpaceChar | newline)*, which is ambiguous with the enclosing content loop over the same characters, so an unterminated multi-line basic string made the lexer enumerate every composition of the whitespace run. Cost doubled roughly every three bytes of input: a 97-byte document blocked the event loop for about nine seconds, and ~160 bytes for over a year. Unlike a size-proportional CPU bug, request-size limits give no protection. The trailing group is redundant, since unescapeString performs line-ending-backslash trimming at interpretation time, and removing it leaves the accepted language unchanged. All versions up to and including 1.2.1 are affected. Found while triaging an unrelated report.
Cap decimal integer literals at 1000 digits, matching the existing radix-prefixed cap (CWE-400). NonDecimalInteger enforced MAX_RADIX_LITERAL_LENGTH while DecimalInteger passed the whole literal to BigInt() unbounded. No advisory was published for this one: BigInt() on a decimal string measures at roughly O(n^1.28) on every supported Node (18 through 24 each parse a million digits in ~41 ms), and a megabyte of digits costs less to parse than a megabyte of ordinary key/value pairs, so there is no amplification to exploit. It is fixed as a consistency guard. Reported by @arpitjain099.

Changed

Decimal integer literals longer than 1000 digits now raise SyntaxParseError instead of loading as a bigint. TOML's 64-bit integer range needs at most 20 digits, so this affects only documents that deliberately carry oversized integers.

Configuration

📅 Schedule: (UTC)

Branch creation
- At any time (no schedule defined)
Automerge
- At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

If you want to rebase/retry this PR, check this box

This PR has been generated by Mend Renovate.

This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [js-toml](https://github.com/sunnyadn/js-toml) | [`1.2.1` → `1.2.2`](https://renovatebot.com/diffs/npm/js-toml/1.2.1/1.2.2) | ![age](https://developer.mend.io/api/mc/badges/age/npm/js-toml/1.2.2?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/js-toml/1.2.1/1.2.2?slim=true) | --- ### Release Notes <details> <summary>sunnyadn/js-toml (js-toml)</summary> ### [`v1.2.2`](https://github.com/sunnyadn/js-toml/blob/HEAD/CHANGELOG.md#122---2026-08-04) [Compare Source](https://github.com/sunnyadn/js-toml/compare/v1.2.1...v1.2.2) ##### Security - Fix exponential backtracking in the multi-line basic string grammar ([GHSA-j4cp-cc36-jxwg](https://github.com/sunnyadn/js-toml/security/advisories/GHSA-j4cp-cc36-jxwg), CWE-1333). The escaped-newline rule ended in `(whiteSpaceChar | newline)*`, which is ambiguous with the enclosing content loop over the same characters, so an unterminated multi-line basic string made the lexer enumerate every composition of the whitespace run. Cost doubled roughly every three bytes of input: a 97-byte document blocked the event loop for about nine seconds, and \~160 bytes for over a year. Unlike a size-proportional CPU bug, request-size limits give no protection. The trailing group is redundant, since `unescapeString` performs line-ending-backslash trimming at interpretation time, and removing it leaves the accepted language unchanged. All versions up to and including 1.2.1 are affected. Found while triaging an unrelated report. - Cap decimal integer literals at 1000 digits, matching the existing radix-prefixed cap (CWE-400). `NonDecimalInteger` enforced `MAX_RADIX_LITERAL_LENGTH` while `DecimalInteger` passed the whole literal to `BigInt()` unbounded. No advisory was published for this one: `BigInt()` on a decimal string measures at roughly O(n^1.28) on every supported Node (18 through 24 each parse a million digits in \~41 ms), and a megabyte of digits costs less to parse than a megabyte of ordinary key/value pairs, so there is no amplification to exploit. It is fixed as a consistency guard. Reported by [@arpitjain099](https://github.com/arpitjain099). ##### Changed - Decimal integer literals longer than 1000 digits now raise `SyntaxParseError` instead of loading as a `bigint`. TOML's 64-bit integer range needs at most 20 digits, so this affects only documents that deliberately carry oversized integers. </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Enabled. ♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate](https://github.com/renovatebot/renovate).

MarkerBot added 1 commit

2026-08-03 22:00:57 -07:00

Update dependency js-toml to v1.2.2

ci/woodpecker/push/build Pipeline was successful

Details

ci/woodpecker/pr/build Pipeline was successful

Details

ci/woodpecker/pull_request_closed/build Pipeline was successful

Details

deefd0437a

MarkerBot scheduled this pull request to auto merge when all checks succeed

2026-08-03 22:00:57 -07:00