fix(deps): bump smol-toml to 1.7.1 (GHSA-7w5x-hrqm-74c2)

[devin-ai-integration]

TL;DR

Bumps smol-toml 1.6.1 → 1.7.1 so the harness no longer resolves a version affected by GHSA-7w5x-hrqm-74c2 (CVE-2026-85730, high): parse() loops forever on malformed input such as a=[1 #.

What changed?

• package.json dependency smol-toml 1.6.1 → 1.7.1
• bun.lock resolves smol-toml@1.7.1 (sha512 PPlsspAZ…, same artifact the openrouter-web root lockfile already pins via its overrides); modal@0.8.0 (^1.3.3) shares the single copy

Why?

• 1.7.1 is the first patched version; the bump stays inside 1.x and is the parser fix only (1.8.0 exists but is a minor with unrelated changes, and 1.7.1 is what the monorepo already pins).
• The harness parses TOML from benchmark datasets in src/benchmarks/{terminal-bench,swe-atlas,wandr,deep-swe}/dataset.ts, so a malformed task file would pin a worker CPU indefinitely.
• This is the upstream half of the fix for openrouter-web Dependabot alert #897 (SEC-360): packages/bench-harness there is a vendored subtree guarded by scripts/check-subtree-integrity.ts, so the declaration can only move here and then be pulled with scripts/subtree-pull-bench-harness.sh. The grouped Dependabot PR lineage (#47 → #57 → #71, all closed unmerged; #82 open) bundles this with a major csv-parse bump, so this is the smol-toml-only split SEC-360 asks for. If deps: bump the dependencies group across 1 directory with 18 updates #82 lands first this PR becomes a no-op.

Source row: https://app.notion.com/p/3da2fd57c4dc813e885eefc714ef32a3 · dedup key: DEPS-smol-toml-1.7.1-GHSA-7w5x-hrqm-74c2

How to test

1. bun install --frozen-lockfile succeeds and rg 'smol-toml@' bun.lock prints exactly one entry, smol-toml@1.7.1.
2. timeout 20 bun -e 'import {parse} from "smol-toml"; parse("a=[1 #")' exits promptly with TomlError: Invalid TOML document: cannot find end of structure (on 1.6.1 this never returns).

Reviewer focus

• Two-line lockfile change; no code touched. Full local run of format:check, check, typecheck, bun test (1450 pass) and build is green.

Checklist

• Tests cover changed behavior (upstream fix; no harness behavior changed)
• Public API or configuration changes are backward compatible, or the break is documented
• Benchmark changes document dataset provenance and licensing (n/a)
• No credentials, private results, or restricted dataset contents are included
• Documentation is updated where needed (n/a)

Supersedes #88 (same branch, reopened under the requesting user's identity).

Link to Devin session: https://openrouter.devinenterprise.com/sessions/07a2fc6a827a4f6089b5a71000f926ac
Open in Devin Desktop: https://openrouter.devinenterprise.com/desktop/session/07a2fc6a827a4f6089b5a71000f926ac?variant=devin
Requested by: @robert-j-y

---

Note

Devin errored when opening this Pull Request as robert-j-y.
As a fallback, Devin opened this PR as itself.

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR that start with 'DevinAI' or '@devin'.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment, CI, and merge conflict monitoring

---

Original prompt from Robert

@playbook:playbook-90e65cd884c04a359412c30543fa21b9 30