[dependabot]

Bumps toml to 5.0.1 and updates ancestor dependency spellchecker-cli. These dependencies need to be updated together.

Updates toml from 3.0.0 to 5.0.1

Changelog

Sourced from toml's changelog.

5.0.1 - October 12 2026

• Address four security advisories, each reachable by parsing untrusted input:
  • CVE-2026-114142, in which a crafted document could still write to Object.prototype. Two distinct key paths could render to the same bookkeeping string, letting an array-of-tables header clear the guard on an unrelated key, after which a dotted key could descend through a date value into its prototype chain. The compiler now records how each table was defined on the table itself rather than in string-keyed sets, so paths cannot collide and key paths can only descend through tables the compiler created.
  • CVE-2026-114143, in which dotted keys, table headers, and inline-table keys with many segments took quadratic time to resolve.
  • CVE-2026-114141, in which every array-of-tables header rescanned all paths defined so far, so documents with many such headers took quadratic time.
  • CVE-2026-114144, in which integer literals were converted to BigInt before any size check, so a multi-megabyte literal consumed super-linear CPU time before being rejected. Literals with more digits than any 64-bit integer are now rejected before conversion.

5.0.0 - July 14 2026

• Breaking: Integers outside JavaScript's safe range (beyond ±Number.MAX_SAFE_INTEGER) now throw a parse error instead of silently returning a rounded value (#28). Opt in to lossless handling of the full 64-bit range with toml.parse(input, { bigint: true }), which returns all integer values as BigInt.
• Breaking: Integers outside TOML's 64-bit signed integer range now throw a parse error in either mode, as required by the spec. Previously they were silently rounded.

4.3.0 - July 13 2026

• Add opt-in Temporal support via toml.parse(input, { useTemporal: true }), mapping offset date-times to Temporal.ZonedDateTime and local date-times/dates/times to Temporal.PlainDateTime/PlainDate/PlainTime. An implementation can be supplied via the temporal option on runtimes without a Temporal global. (#69)

4.2.0 - July 13 2026

• Address CVE-2026-77465, in which deeply nested arrays or inline tables could overflow the call stack and crash the process with an uncatchable RangeError. Nesting is now bounded (default 500 levels), and input past the limit throws a normal parse error. The limit is configurable via toml.parse(input, { maxDepth }).

4.1.2 - June 30 2026

• Address CVE-2026-63376, in which a specially crafted TOML string could pollute Object.prototype process-wide.

4.1.1 - March 31 2026

• Increase performance ~5x (#68)

4.1.0 - March 31 2026

• Add spec v1.1.0 support (#67)

4.0.1 - March 31 2026

• Minor packaging changes

4.0.0 - March 31 2026

• Modernize tooling and support TOML v1.0.0 spec (#66)

... (truncated)

Commits

• 9ebfa69 5.0.1
• 22cf8bb Update changelog for 5.0.1
• 9d52e38 Reject integer literals too long for int64 before converting to BigInt
• 609c873 Track table origin on the table instead of in string-keyed path sets
• df2bd01 Add tests for advisories GHSA-h895-cgqg-jf52, GHSA-9j65-hcg3-gc64, GHSA-4qx8-...
• 1b2ac40 Update CHANGELOG with assigned CVE
• ccd8b10 5.0.0
• 00ac4a6 Update changelog
• 121e5fa Merge pull request #74 from BinaryMuse/mkt/big-ints
• 2b6bcb7 Add opt-in BigInt support, throw when parsing out of bounds values
• Additional commits viewable in compare view

Updates spellchecker-cli from 6.2.0 to 7.0.4

Changelog

Sourced from spellchecker-cli's changelog.

[7.0.4] - 2026-09-06

• Upgrade dependencies to fix 58 security vulnerabilities (22 Moderate, 36 High).
• Upgrade toml from 3 to 5. This raises the minimum supported Node.js version for TOML frontmatter parsing to Node.js 20.

[7.0.3] - 2026-03-05

• Upgrade all dependencies to fix 25 security vulnerabilities (5 Low, 4 Moderate, 16 High).

[7.0.2] - 2025-12-02

• Upgrade mdast-util-to-hast.

[7.0.1] - 2025-11-15

• Upgrade js-yaml.

[7.0.0] - 2024-10-21

• Parse HTML before spell-checking, using rehype-retext.

Commits

• b15b469 7.0.4: fix 58 security vulnerabilities (#139)
• 453ef35 7.0.3
• 194466d Fix security vulnerabilities by upgrading dependencies (#135)
• 9d40cee 7.0.2
• 4757059 Bump mdast-util-to-hast from 13.2.0 to 13.2.1 (#133)
• 26baa75 Upgrade Mocha
• ddb8f07 7.0.1
• b6b7178 Bump js-yaml from 3.14.1 to 4.1.1 (#132)
• 31f89c6 Potential fix for code scanning alert no. 1: Workflow does not contain permis...
• 2bca4b9 Upgrade eslint, mocha, and pretty-quick (#130)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.

[cloudflare-workers-and-pages]

Deploying fida-website with    Cloudflare Pages

Latest commit:	8cb8010
Status:	✅  Deploy successful!
Preview URL:	https://314da671.fida-website.pages.dev
Branch Preview URL:	https://dependabot-npm-and-yarn-mult-qo19.fida-website.pages.dev

View logs