From 24b391769e38edb4de3aa25439c5b9645b99f8bb Mon Sep 17 00:00:00 2001 From: Aadharsh Pannirselvam Date: Tue, 15 Sep 2026 22:41:59 -0400 Subject: [PATCH] [wrangler] Update smol-toml to 1.8.0 The bundled TOML parser behind wrangler.toml was pinned at 1.5.2 in the catalog, behind GHSA-7w5x-hrqm-74c2 (a=[1 # spins forever, fixed 1.7.1) and GHSA-v3rj-xjv7-4jmq (8000 comment lines overflow the stack, fixed 1.6.1). Both reproduce through wrangler deploy --dry-run on main. One workers-utils test pinned the exact 1.5.2 error text for an unterminated string; 1.7.0 reports the real fault (unfinished string, column 7) and the expectation moves with it. --- .changeset/smol-toml-parser-dos.md | 10 ++++++++++ packages/workers-utils/tests/parse.test.ts | 4 ++-- pnpm-lock.yaml | 18 +++++++++--------- pnpm-workspace.yaml | 2 +- 4 files changed, 22 insertions(+), 12 deletions(-) create mode 100644 .changeset/smol-toml-parser-dos.md diff --git a/.changeset/smol-toml-parser-dos.md b/.changeset/smol-toml-parser-dos.md new file mode 100644 index 0000000000..61045d81aa --- /dev/null +++ b/.changeset/smol-toml-parser-dos.md @@ -0,0 +1,10 @@ +--- +"wrangler": patch +"create-cloudflare": patch +"@cloudflare/workers-utils": patch +"@cloudflare/workers-auth": patch +--- + +Update `smol-toml` to 1.8.0 + +This updates the bundled TOML parser that reads `wrangler.toml` to a version that addresses two advisories against 1.5.2: `GHSA-7w5x-hrqm-74c2` (a value followed by a comment with no trailing newline, such as `a=[1 #`, put the parser in an infinite loop) and `GHSA-v3rj-xjv7-4jmq` (thousands of consecutive comment lines overflowed the stack). On the old version, `wrangler deploy` against a `wrangler.toml` ending in `a=[1 #` never returned; it now fails with `Invalid TOML document: cannot find end of structure`. diff --git a/packages/workers-utils/tests/parse.test.ts b/packages/workers-utils/tests/parse.test.ts index 340414b500..a8e57202c6 100644 --- a/packages/workers-utils/tests/parse.test.ts +++ b/packages/workers-utils/tests/parse.test.ts @@ -57,11 +57,11 @@ describe("parseTOML", () => { } catch (err) { expect({ ...(err as Error) }).toStrictEqual({ name: "ParseError", - text: "Invalid TOML document: only letter, numbers, dashes and underscores are allowed in keys", + text: "Invalid TOML document: unfinished string", kind: "error", location: { line: 1, - column: 12, + column: 7, fileText: "name = 'fail\"", file: undefined, lineText: "name = 'fail\"", diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml index 45acaf90df..3ffbf1d1a8 100644 --- a/pnpm-lock.yaml +++ b/pnpm-lock.yaml @@ -64,8 +64,8 @@ catalogs: specifier: 4.1.0 version: 4.1.0 smol-toml: - specifier: 1.5.2 - version: 1.5.2 + specifier: 1.8.0 + version: 1.8.0 tinyglobby: specifier: 0.2.16 version: 0.2.16 @@ -1999,7 +1999,7 @@ importers: version: 7.7.1 smol-toml: specifier: catalog:default - version: 1.5.2 + version: 1.8.0 tinyglobby: specifier: catalog:default version: 0.2.16 @@ -4236,7 +4236,7 @@ importers: version: 2.14.6(@types/node@22.15.17)(typescript@5.8.3) smol-toml: specifier: catalog:default - version: 1.5.2 + version: 1.8.0 ts-dedent: specifier: ^2.2.0 version: 2.2.0 @@ -4505,7 +4505,7 @@ importers: version: 4.1.0 smol-toml: specifier: catalog:default - version: 1.5.2 + version: 1.8.0 ts-dedent: specifier: ^2.2.0 version: 2.2.0 @@ -4843,7 +4843,7 @@ importers: version: 4.1.0 smol-toml: specifier: catalog:default - version: 1.5.2 + version: 1.8.0 supports-color: specifier: ^9.2.2 version: 9.2.2 @@ -15484,8 +15484,8 @@ packages: resolution: {integrity: sha512-94hK0Hh8rPqQl2xXc3HsaBoOXKV20MToPkcXvwbISWLEs+64sBq5kFgn2kJDHb1Pry9yrP0dxrCI9RRci7RXKg==} engines: {node: '>= 6.0.0', npm: '>= 3.0.0'} - smol-toml@1.5.2: - resolution: {integrity: sha512-QlaZEqcAH3/RtNyet1IPIYPsEWAaYyXXv1Krsi+1L/QHppjX4Ifm8MQsBISz9vE8cHicIq3clogsheili5vhaQ==} + smol-toml@1.8.0: + resolution: {integrity: sha512-kCZr2V3ch9i00x8zXRhjUNVcjG9ijES5dDudkXvUVCT5QlJNQWElSJdZqyPemffHoLNUYwOcou0Fy+ojN0uHSQ==} engines: {node: '>= 18'} snake-case@3.0.4: @@ -28240,7 +28240,7 @@ snapshots: smart-buffer@4.2.0: {} - smol-toml@1.5.2: {} + smol-toml@1.8.0: {} snake-case@3.0.4: dependencies: diff --git a/pnpm-workspace.yaml b/pnpm-workspace.yaml index 479b9884ed..ff73de1ad9 100644 --- a/pnpm-workspace.yaml +++ b/pnpm-workspace.yaml @@ -132,7 +132,7 @@ catalog: "@cloudflare/workers-types": "^5.20260915.1" workerd: "1.20260915.1" jsonc-parser: "3.2.0" - smol-toml: "1.5.2" + smol-toml: "1.8.0" msw: "2.14.6" tinyglobby: "0.2.16" "tree-kill": "1.2.2"