fix(deps): bump smol-toml to 1.7.1 (GHSA-7w5x-hrqm-74c2)

[devin-ai-integration]

TL;DR

Bumps smol-toml 1.6.1 → 1.7.1 so the harness no longer resolves a version affected by GHSA-7w5x-hrqm-74c2 (CVE-2026-85730, high): parse() loops forever on malformed input such as a=[1 #.

What changed?

• package.json dependency smol-toml 1.6.1 → 1.7.1
• bun.lock resolves smol-toml@1.7.1 (sha512 PPlsspAZ…, same artifact the openrouter-web root lockfile already pins via its overrides); modal@0.8.0 (^1.3.3) shares the single copy

Why?

• 1.7.1 is the first patched version; the bump stays inside 1.x and is the parser fix only (1.8.0 exists but is a minor with unrelated changes, and 1.7.1 is what the monorepo already pins).
• The harness parses TOML from benchmark datasets in src/benchmarks/{terminal-bench,swe-atlas,wandr,deep-swe}/dataset.ts, so a malformed task file would pin a worker CPU indefinitely.
• This is the upstream half of the fix for openrouter-web Dependabot alert #897 (SEC-360): packages/bench-harness there is a vendored subtree guarded by scripts/check-subtree-integrity.ts, so the declaration can only move here and then be pulled with scripts/subtree-pull-bench-harness.sh. The grouped Dependabot PR lineage (#47 → #57 → #71, all closed unmerged; #82 open) bundles this with a major csv-parse bump, so this is the smol-toml-only split SEC-360 asks for. If deps: bump the dependencies group across 1 directory with 18 updates #82 lands first this PR becomes a no-op.

Source row: https://app.notion.com/p/3da2fd57c4dc813e885eefc714ef32a3 · dedup key: DEPS-smol-toml-1.7.1-GHSA-7w5x-hrqm-74c2

How to test

1. bun install --frozen-lockfile succeeds and rg 'smol-toml@' bun.lock prints exactly one entry, smol-toml@1.7.1.
2. timeout 20 bun -e 'import {parse} from "smol-toml"; parse("a=[1 #")' exits promptly with TomlError: Invalid TOML document: cannot find end of structure (on 1.6.1 this never returns).

Reviewer focus

• Two-line lockfile change; no code touched. Full local run of format:check, check, typecheck, bun test (1450 pass) and build is green.

Checklist

• Tests cover changed behavior (upstream fix; no harness behavior changed)
• Public API or configuration changes are backward compatible, or the break is documented
• Benchmark changes document dataset provenance and licensing (n/a)
• No credentials, private results, or restricted dataset contents are included
• Documentation is updated where needed (n/a)

Link to Devin session: https://openrouter.devinenterprise.com/sessions/54ba0ea11df04f22b33373c3dc850551
Open in Devin Desktop: https://openrouter.devinenterprise.com/desktop/session/54ba0ea11df04f22b33373c3dc850551?variant=devin
Requested by: @robert-j-y

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR that start with 'DevinAI' or '@devin'.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment, CI, and merge conflict monitoring

---

Original prompt from Devin Bot

!sourced_task
Task sourcing log: https://app.notion.com/p/b730d7a104214a9d84ca83e9a5fb05d6 (data source collection://4035ad06-59ce-45f9-8b0e-9a793ade5052)
Target task dedup key: DEPS-smol-toml-1.7.1-GHSA-7w5x-hrqm-74c2

@playbook:playbook-3af0ef23b8aa456587df8df94bdb7291

[perry-the-pr-reviewer]

Perry's Review

Verdict: 💬 Comments / questions — APPROVE recommended — smol-toml 1.6.1 → 1.7.1 (security bump). Safe to merge. Two-line dependency bump fixing GHSA-7w5x-hrqm-74c2 (CVE-2026-85730, high — DoS via infinite loop in parse() on malformed TOML).

Details

What changed

• package.json: smol-toml 1.6.1 → 1.7.1
• bun.lock: resolves smol-toml@1.7.1 with updated sha512

No source code touched.

Verification

Check	Result
npm registry integrity hash	✅ Matches lockfile (sha512-PPlsspAZ…)
Advisory GHSA-7w5x-hrqm-74c2	✅ Real — high severity, DoS, vulnerable <= 1.7.0, patched in 1.7.1
smol-toml usage in repo	✅ parse() imported in src/benchmarks/{terminal-bench,swe-atlas,wandr,deep-swe}/dataset.ts — malformed dataset TOML would pin a worker CPU indefinitely, confirming the exposure
Semver compatibility	✅ Minor bump within 1.x — backward compatible
CI (validate + CodeQL)	✅ All green

Risk assessment

Risk: 🟢 Low

Dimension	Severity	Risk	Reasoning
Implementation risk	🟩	Low	No code changes; lockfile hash verified against npm registry.
Premise risk	🟩	Low	Advisory is real and verified; 1.7.1 is the first patched version.
Estimated impact	🟩	Low	Patched dependency swap with no API surface change.

Risk Factor	Severity	Risk	Reasoning
Reversibility	🟩	Low	Fully reversible by reverting the version.
Detectability	🟩	Low	Any regression surfaces immediately at install/runtime.
Blast radius	🟩	Low	Single dependency, no new consumers.
Data integrity	None	Low	No persisted state touched.
Financial exposure	None	Low	No billing/payment path affected.
Security and privacy exposure	🟩	Low	Fixes a DoS vector; no new exposure introduced.
Propagation	🟩	Low	Vendored subtree in openrouter-web pulls this via subtree sync.
Availability	🟩	Low	Eliminates a CPU-pin DoS on benchmark dataset parsing.
Recovery cost	🟩	Low	Revert and reinstall.
Time to correct	🟩	Low	Single-line revert.

No inline comments — nothing for the author to act on.

[devin-ai-integration]

Superseded by #94 (same branch, reopened under @robert-j-y).

[devin-ai-integration]

Reopened. Re-attribution to @robert-j-y is not possible here: his access to this repository is read-only, so #94 and #95 both fell back to the bot author and were closed. This PR remains the canonical one.