[wrangler] Update smol-toml to 1.8.0

[oddharsh]

Fixes: no issue filed; a dependency bump seemed small enough to go straight to a PR per CONTRIBUTING. Happy to open one if you'd rather track it.

smol-toml is the bundled parser behind wrangler.toml (via @cloudflare/workers-utils' parseTOML), and it is also bundled into create-cloudflare and @cloudflare/workers-auth. The catalog:default entry pins 1.5.2, which is behind two published advisories:

advisory	fixed in	shape
GHSA-7w5x-hrqm-74c2 (high)	1.7.1	a value followed by a comment with no trailing newline (a=[1 #) never returns; the parser resets its cursor and spins
GHSA-v3rj-xjv7-4jmq	1.6.1	thousands of consecutive comment lines recurse until the stack overflows

Both reproduce through wrangler itself, measured on the main build published to pkg.pr.new yesterday (4.131.2 (main)):

# wrangler.toml ending in `a=[1 #`
$ timeout 10 wrangler deploy --dry-run ; echo $?
124                                     # never returned, CPU pinned

# wrangler.toml with 8000 lines of `# c` above the real keys
$ wrangler deploy --dry-run
✘ [ERROR] Maximum call stack size exceeded

With 1.8.0 the first fails in 1 ms with Invalid TOML document: cannot find end of structure, and the second parses.

The practical exposure is small, since wrangler.toml is almost always the user's own file. What tipped it into a PR is that the root Dependabot block only allows workerd and @cloudflare/workers-types, so nothing here would ever bump this on its own, and downstream OSV scans keep flagging the bundle (that is how I found it: our repo's scan named wrangler's copy after we had already bumped our own).

What changed

• pnpm-workspace.yaml: smol-toml catalog entry 1.5.2 to 1.8.0, the current release. 1.7.1 is the floor for the high-severity advisory; 1.8.0 adds TOML 1.1 parsing (multiline inline tables, \x escapes) and Temporal support in stringify. The one behaviour change worth knowing about is from 1.7.0: stringify emits integers outside the safe range as floats.
• pnpm-lock.yaml: only the smol-toml lines. I ran pnpm install --lockfile-only, which also wanted to rewrite the @cloudflare/workers-types peer suffix on the @flue/vite and agents snapshot keys (unrelated drift from Bump the workerd-and-workers-types group across 1 directory with 2 updates #15633), so I kept just the smol-toml hunks and confirmed pnpm install --frozen-lockfile --lockfile-only accepts the result.
• packages/workers-utils/tests/parse.test.ts: one assertion pinned the exact error text for name = 'fail". The 1.7.0 string-decode rewrite reports the real fault, unfinished string at column 7, where 1.5.2 blamed the key at column 12. Expectation updated.
• .changeset/smol-toml-parser-dos.md: one patch changeset naming the four packages that bundle it.

---

• Tests
  • Tests included/updated
  • Automated tests not possible - manual testing has been completed as follows:
  • Additional testing not necessary because:
• Public documentation
  • Cloudflare docs PR(s):
  • Documentation not necessary because: dependency update, no user-facing surface changes.

Locally: pnpm -F @cloudflare/workers-utils test 1064/1064 after the one expectation change; pnpm -F wrangler test (the whole unit suite, after pnpm run build --filter wrangler) 257 files, 5276 passed, 3 skipped, 9 todo, 0 failed.

---

[changeset-bot]

🦋 Changeset detected

Latest commit: 0b4d22e

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 11 packages

Name	Type
wrangler	Patch
create-cloudflare	Patch
@cloudflare/workers-utils	Patch
@cloudflare/workers-auth	Patch
@cloudflare/vite-plugin	Patch
@cloudflare/vitest-plugin	Patch
@cloudflare/autoconfig	Patch
@cloudflare/cli-shared-helpers	Patch
@cloudflare/containers-shared	Patch
@cloudflare/deploy-helpers	Patch
@cloudflare/remote-bindings	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

[workers-devprod]

Codeowners approval required for this PR:

• @cloudflare/wrangler

Show detailed file reviewers

• .changeset/smol-toml-parser-dos.md: [@cloudflare/wrangler]
• packages/workers-utils/tests/parse.test.ts: [@cloudflare/wrangler]
• pnpm-lock.yaml: [@cloudflare/wrangler]
• pnpm-workspace.yaml: [@cloudflare/wrangler]

[devin-ai-integration]

✅ Devin Review: No Issues Found

Devin Review analyzed this PR and found no bugs or issues to report.

[pkg-pr-new]

@cloudflare/autoconfig

npm i https://pkg.pr.new/@cloudflare/autoconfig@15662

@cloudflare/build-output-utils

npm i https://pkg.pr.new/@cloudflare/build-output-utils@15662

@cloudflare/codemods

npm i https://pkg.pr.new/@cloudflare/codemods@15662

@cloudflare/config

npm i https://pkg.pr.new/@cloudflare/config@15662

@cloudflare/containers-shared

npm i https://pkg.pr.new/@cloudflare/containers-shared@15662

create-cloudflare

npm i https://pkg.pr.new/create-cloudflare@15662

@cloudflare/deploy-helpers

npm i https://pkg.pr.new/@cloudflare/deploy-helpers@15662

@cloudflare/kv-asset-handler

npm i https://pkg.pr.new/@cloudflare/kv-asset-handler@15662

miniflare

npm i https://pkg.pr.new/miniflare@15662

@cloudflare/pages-functions

npm i https://pkg.pr.new/@cloudflare/pages-functions@15662

@cloudflare/pages-shared

npm i https://pkg.pr.new/@cloudflare/pages-shared@15662

@cloudflare/unenv-preset

npm i https://pkg.pr.new/@cloudflare/unenv-preset@15662

@cloudflare/vite-plugin

npm i https://pkg.pr.new/@cloudflare/vite-plugin@15662

@cloudflare/vitest-plugin

npm i https://pkg.pr.new/@cloudflare/vitest-plugin@15662

@cloudflare/workers-auth

npm i https://pkg.pr.new/@cloudflare/workers-auth@15662

@cloudflare/workers-editor-shared

npm i https://pkg.pr.new/@cloudflare/workers-editor-shared@15662

@cloudflare/workers-utils

npm i https://pkg.pr.new/@cloudflare/workers-utils@15662

wrangler

npm i https://pkg.pr.new/wrangler@15662

commit: 0b4d22e

[workers-devprod]

Codeowners approval required for this PR:

• ✅ @cloudflare/wrangler

Show detailed file reviewers

[workers-devprod]

Codeowners reviews satisfied

[dario-piotrowicz]

Thanks for the fix @oddharsh 😄