Skip to content

chore(deps): bump toml and netlify-cli - #513

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/multi-1282a99442
Open

dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/multi-1282a99442

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Oct 29, 2026

Copy link
Copy Markdown
Contributor

Bumps toml to 5.0.1 and updates ancestor dependency netlify-cli. These dependencies need to be updated together.

Updates toml from 3.0.0 to 5.0.1

Changelog

Sourced from toml's changelog.

5.0.1 - October 12 2026

  • Address four security advisories, each reachable by parsing untrusted input:
    • CVE-2026-114142, in which a crafted document could still write to Object.prototype. Two distinct key paths could render to the same bookkeeping string, letting an array-of-tables header clear the guard on an unrelated key, after which a dotted key could descend through a date value into its prototype chain. The compiler now records how each table was defined on the table itself rather than in string-keyed sets, so paths cannot collide and key paths can only descend through tables the compiler created.
    • CVE-2026-114143, in which dotted keys, table headers, and inline-table keys with many segments took quadratic time to resolve.
    • CVE-2026-114141, in which every array-of-tables header rescanned all paths defined so far, so documents with many such headers took quadratic time.
    • CVE-2026-114144, in which integer literals were converted to BigInt before any size check, so a multi-megabyte literal consumed super-linear CPU time before being rejected. Literals with more digits than any 64-bit integer are now rejected before conversion.

5.0.0 - July 14 2026

  • Breaking: Integers outside JavaScript's safe range (beyond ±Number.MAX_SAFE_INTEGER) now throw a parse error instead of silently returning a rounded value (#28). Opt in to lossless handling of the full 64-bit range with toml.parse(input, { bigint: true }), which returns all integer values as BigInt.
  • Breaking: Integers outside TOML's 64-bit signed integer range now throw a parse error in either mode, as required by the spec. Previously they were silently rounded.

4.3.0 - July 13 2026

  • Add opt-in Temporal support via toml.parse(input, { useTemporal: true }), mapping offset date-times to Temporal.ZonedDateTime and local date-times/dates/times to Temporal.PlainDateTime/PlainDate/PlainTime. An implementation can be supplied via the temporal option on runtimes without a Temporal global. (#69)

4.2.0 - July 13 2026

  • Address CVE-2026-77465, in which deeply nested arrays or inline tables could overflow the call stack and crash the process with an uncatchable RangeError. Nesting is now bounded (default 500 levels), and input past the limit throws a normal parse error. The limit is configurable via toml.parse(input, { maxDepth }).

4.1.2 - June 30 2026

  • Address CVE-2026-63376, in which a specially crafted TOML string could pollute Object.prototype process-wide.

4.1.1 - March 31 2026

  • Increase performance ~5x (#68)

4.1.0 - March 31 2026

  • Add spec v1.1.0 support (#67)

4.0.1 - March 31 2026

  • Minor packaging changes

4.0.0 - March 31 2026

  • Modernize tooling and support TOML v1.0.0 spec (#66)

... (truncated)

Commits

Updates netlify-cli from 26.2.0 to 27.16.0

Release notes

Sourced from netlify-cli's releases.

v27.16.0

27.16.0 (2026-10-28)

Features

  • deploy: add --remote to build an existing commit remotely on Netlify (#8643) (bc57163)
  • edge-functions: mention Fetchable modules in the default export error (#9068) (027f317)

Bug Fixes

  • deps: update dependency @​netlify/redirect-matcher to ^0.7.0 (2a176ca)
  • deps: update netlify packages (#8652) (70b03e3)
  • dev: don't crash when the proxy errors after response headers are sent (#8613) (cc9c766)
  • dev: respond with 413/408 instead of crashing on oversized or slow request bodies (#8612) (de3f783)

v27.15.0

27.15.0 (2026-10-27)

Features

v27.14.3

27.14.3 (2026-10-27)

Bug Fixes

  • deps: update dependency toml to v5 [security] (820f495)
  • pass the client address to Netlify Server in local dev (#8762) (4b99949)

v27.14.2

27.14.2 (2026-10-22)

Bug Fixes

  • dev: start server when standalone flag is enabled (#8650) (fb2f0bb)

v27.14.1

27.14.1 (2026-10-21)

Bug Fixes

  • deps: bump all netlify deps (24b0aa2)

... (truncated)

Changelog

Sourced from netlify-cli's changelog.

27.16.0 (2026-10-28)

Features

  • deploy: add --remote to build an existing commit remotely on Netlify (#8643) (bc57163)
  • edge-functions: mention Fetchable modules in the default export error (#9068) (027f317)

Bug Fixes

  • deps: update dependency @​netlify/redirect-matcher to ^0.7.0 (2a176ca)
  • deps: update netlify packages (#8652) (70b03e3)
  • dev: don't crash when the proxy errors after response headers are sent (#8613) (cc9c766)
  • dev: respond with 413/408 instead of crashing on oversized or slow request bodies (#8612) (de3f783)

27.15.0 (2026-10-27)

Features

27.14.3 (2026-10-27)

Bug Fixes

  • deps: update dependency toml to v5 [security] (820f495)
  • pass the client address to Netlify Server in local dev (#8762) (4b99949)

27.14.2 (2026-10-22)

Bug Fixes

  • dev: start server when standalone flag is enabled (#8650) (fb2f0bb)

27.14.1 (2026-10-21)

Bug Fixes

  • deps: bump all netlify deps (24b0aa2)
  • deps: update netlify packages (c4e1447)

27.14.0 (2026-10-20)

... (truncated)

Commits
  • 84f0425 chore(main): release 27.16.0
  • 4250df5 chore(deps): update googlecloudplatform/release-please-action action to v5
  • de3f783 fix(dev): respond with 413/408 instead of crashing on oversized or slow reque...
  • cc9c766 fix(dev): don't crash when the proxy errors after response headers are sent (...
  • fb32681 chore(deps): update dependency @​bugsnag/js to v9
  • 70b03e3 fix(deps): update netlify packages (#8652)
  • 2a176ca fix(deps): update dependency @​netlify/redirect-matcher to ^0.7.0
  • 088eb13 chore(website): update website non-major dependencies
  • 027f317 feat(edge-functions): mention Fetchable modules in the default export error (...
  • b64067f ci: use NPM Trusted Publishing with provenance (#8658)
  • Additional commits viewable in compare view
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for netlify-cli since your current version.


Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
    You can disable automated security fix PRs for this repo from the Security Alerts page.

Bumps [toml](https://github.com/BinaryMuse/toml-node) to 5.0.1 and updates ancestor dependency [netlify-cli](https://github.com/netlify/cli). These dependencies need to be updated together.


Updates `toml` from 3.0.0 to 5.0.1
- [Changelog](https://github.com/BinaryMuse/toml-node/blob/main/CHANGELOG.md)
- [Commits](BinaryMuse/toml-node@v3.0.0...v5.0.1)

Updates `netlify-cli` from 26.2.0 to 27.16.0
- [Release notes](https://github.com/netlify/cli/releases)
- [Changelog](https://github.com/netlify/cli/blob/main/CHANGELOG.md)
- [Commits](netlify/cli@v26.2.0...v27.16.0)

---
updated-dependencies:
- dependency-name: toml
  dependency-version: 5.0.1
  dependency-type: indirect
- dependency-name: netlify-cli
  dependency-version: 27.16.0
  dependency-type: direct:development
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Oct 29, 2026
@changeset-bot

changeset-bot Bot commented Oct 29, 2026

Copy link
Copy Markdown

⚠️ No Changeset found

Latest commit: 2b28b45

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants