Repository navigation
[wrangler] Update smol-toml to 1.9.0 - #15838
Merged
Merged
Conversation
1.9.0 fixes GHSA-r4xh-jqrq-34v2, which covers every version through 1.8.0. Parsed tables now have a null prototype, so the parseTOML tests compare with toEqual, and one TOML error snapshot now points at the bad character.
🦋 Changeset detectedLatest commit: 6d956bd The changes in this PR will be included in the next version bump. This PR includes changesets to release 11 packages
Not sure what this means? Click here to learn what changesets are. Click here if you're a maintainer who wants to add another changeset to this PR |
workers-devprod
requested review from
a team and
tpmmorris
and removed request for
a team
September 24, 2026 14:58
Contributor
|
Codeowners approval required for this PR:
Show detailed file reviewers |
@cloudflare/autoconfig
@cloudflare/build-output-utils
@cloudflare/codemods
@cloudflare/config
@cloudflare/containers-shared
create-cloudflare
@cloudflare/deploy-helpers
@cloudflare/kv-asset-handler
miniflare
@cloudflare/pages-functions
@cloudflare/pages-shared
@cloudflare/runtime-types
@cloudflare/unenv-preset
@cloudflare/vite-plugin
@cloudflare/vitest-plugin
@cloudflare/workers-auth
@cloudflare/workers-editor-shared
@cloudflare/workers-utils
wrangler
commit: |
1.9.0 deprecates the default export, and check:lint runs with --deny-warnings --type-aware, so all twelve default imports failed the Checks job. TomlError is now read off the namespace in parse.ts.
…o smol-toml-1.9.0
![devin-ai-integration[bot]](https://avatars.githubusercontent.com/in/811515?s=60&v=4){kind=small}
This comment was marked as resolved.
This comment was marked as resolved.
Sorry, something went wrong.
dario-piotrowicz
approved these changes
Sep 24, 2026
dario-piotrowicz
left a comment
dario-piotrowicz
left a comment
Member
There was a problem hiding this comment.
LGTM, Thanks for this improvement @oddharsh 😄
workers-devprod
approved these changes
Sep 24, 2026
workers-devprod
left a comment
workers-devprod
left a comment
Contributor
There was a problem hiding this comment.
Codeowners reviews satisfied
Merged
Wichtowski
pushed a commit
to Wichtowski/workers-sdk
that referenced
this pull request
Sep 24, 2026
Co-authored-by: Aadharsh Pannirselvam <19518661+oddharsh@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes: no issue filed; same shape as #15662, a dependency bump small enough to go straight to a PR. Happy to open one if you'd rather track it.
#15662 moved
smol-tomlto 1.8.0 and merged at 15:52 UTC on 2026-09-22. Forty-eight minutes later, at 16:40, smol-toml published GHSA-r4xh-jqrq-34v2, affecting every version up to and including 1.8.0. 1.9.0 followed at 17:07. So the version that PR landed was covered by an advisory before it reached a release.That timing is funny, and it also matters. #15662 existed because downstream OSV scans kept flagging wrangler's bundled copy, and the root Dependabot block only
allowsworkerdand@cloudflare/workers-types, so nothing here bumps this on its own. Since that change shipped, the same scans flag the bundle again under the new advisory. Without a manual bump it stays flagged until somebody else notices.The advisory
parseKeyrescanned to the end of the document on every key line, so parse time grows with the square of the key count. Measured on Node 26.9 withsmol-toml.parseoverk<i> = <i>lines:wrangler.toml(20 KV bindings)Real exposure through wrangler is small: the file is almost always the user's own, and a normal config parses in the same time on both versions. The case for the bump is the advisory plus the scanner noise, since the release notes' speedup doesn't show up at config sizes.
What changed
pnpm-workspace.yaml:smol-tomlcatalog entry1.8.0to1.9.0.pnpm-lock.yamlchanges only the smol-toml lines this time, with none of the peer-suffix drift [wrangler] Update smol-toml to 1.8.0 #15662 had to trim.packages/workers-utils/tests/parse.test.ts: 1.9.0 returns parsed tables with a null prototype, so threetoStrictEqual({...})assertions failed with "expected {} to strictly equal {}". They now usetoEqual.packages/wrangler/src/__tests__/pages/pages-build-env.test.ts: one inline snapshot. ForINVALID "FILE, 1.9.0 reportsillegal character in keyat1:8, pointing at the", where 1.8.0 reportedincomplete key-value: cannot find end of keyat1:0. Updated to the new output, which is more useful.import TOML from "smol-toml"toimport * as TOML from "smol-toml"(see below)..changeset/smol-toml-1-9.md: one patch changeset for the four packages that bundle it.Behaviour changes checked, since this is a larger release than 1.8
obj.hasOwnProperty(...)on a parsed table would throw. I greppedworkers-utils,wrangler,create-cloudflareandworkers-authsource forhasOwnProperty(,instanceof Object,getPrototypeOf,.constructorandisPlainObject. The only hits areObject.prototype.hasOwnProperty.callinvectorize/query.ts, which is safe on a null-prototype object and parses JSON anyway.validation.tsrejects TOML dates invarsviavarValue instanceof Date. On 1.9.0's default path the value is still aTomlDate(which extendsDate), so the check still fires. One thing to know for later: 1.9.0 adds opt-in Temporal output (useLegacyDate: false) and says it becomes the default in v2, where thatinstanceof Datecheck would stop matching.import TOML from "smol-toml", andcheck:lint(--deny-warnings --type-aware) reports each use as an error. All twelve default imports across the four packages now useimport * as TOML from "smol-toml", the form wrangler's tests already used, andparse.tsreadsTOML.TomlErroroff the namespace. My first push missed this because I ran the tests but not the lint locally.Locally, after
pnpm run build --filter wrangler:@cloudflare/workers-utils1087/1087;wrangler259 files, 5430 passed, 1 failed, 3 skipped, 9 todo before the snapshot update, where the one failure was the TOML error text above, andpages-build-env.test.tspasses 14/14 after it;create-cloudflaretest:unit262/262;@cloudflare/workers-auth191 passed, 3 skipped.pnpm check:lint,check:typein all four packages,oxfmt --checkandpnpm check:catalogpass.