[wrangler] Update smol-toml to 1.8.0

.changeset/smol-toml-parser-dos.md

@@ -0,0 +1,10 @@
+---
+"wrangler": patch
+"create-cloudflare": patch
+"@cloudflare/workers-utils": patch
+"@cloudflare/workers-auth": patch
+---
+
+Update `smol-toml` to 1.8.0
+
+This updates the bundled TOML parser that reads `wrangler.toml` to a version that addresses two advisories against 1.5.2: `GHSA-7w5x-hrqm-74c2` (a value followed by a comment with no trailing newline, such as `a=[1 #`, put the parser in an infinite loop) and `GHSA-v3rj-xjv7-4jmq` (thousands of consecutive comment lines overflowed the stack). On the old version, `wrangler deploy` against a `wrangler.toml` ending in `a=[1 #` never returned; it now fails with `Invalid TOML document: cannot find end of structure`.

packages/workers-utils/tests/parse.test.ts

@@ -57,11 +57,11 @@ describe("parseTOML", () => {
 		} catch (err) {
 			expect({ ...(err as Error) }).toStrictEqual({
 				name: "ParseError",
-				text: "Invalid TOML document: only letter, numbers, dashes and underscores are allowed in keys",
+				text: "Invalid TOML document: unfinished string",
 				kind: "error",
 				location: {
 					line: 1,
-					column: 12,
+					column: 7,
 					fileText: "name = 'fail\"",
 					file: undefined,
 					lineText: "name = 'fail\"",

pnpm-workspace.yaml

@@ -132,7 +132,7 @@ catalog:
   "@cloudflare/workers-types": "^5.20260921.1"
   workerd: "1.20260921.1"
   jsonc-parser: "3.2.0"
-  smol-toml: "1.5.2"
+  smol-toml: "1.8.0"
   msw: "2.14.6"
   tinyglobby: "0.2.16"
   "tree-kill": "1.2.2"