[dependabot-agent] Fix smol-toml denial-of-service advisory (GHSA-7w5x-hrqm-74c2) via npm override

[cao-githubnext-gh-aw-cao-write]

Caution

Protected files were modified in this change.
This pull request is in request-review mode and requires explicit human scrutiny before merge.

Protected files: package-lock.json, package.json

Dependency Release Train Summary

What changed

• Package/ecosystem: npm (root workspace)
• Manifest(s): package.json, package-lock.json
• Old version: smol-toml@1.7.0 (transitive via markdownlint-cli2@0.23.2)
• New version: smol-toml@1.8.0 (pinned via overrides)
• Update type: security (patch, via override)

Why now

• Security advisory GHSA-7w5x-hrqm-74c2: smol-toml Denial of Service via malformed TOML documents (stack overflow via unrestricted recursion), affecting versions <=1.7.0. npm audit reports 2 high-severity findings. No newer markdownlint-cli2 release is available yet that bundles a fixed smol-toml, so an npm overrides pin is used.

Risk assessment

• Runtime/dev/build/CI scope: dev-only (markdownlint-cli2 is a devDependency used for linting)
• Direct/transitive: transitive (via markdownlint-cli2)
• Reachability: lockfile-only for the root package; not imported by application runtime source. docs-site/package-lock.json already resolves smol-toml to 1.8.0 independently and needs no change.

Validation

• Commands run: npm install --registry=https://registry.npmjs.org/ --package-lock-only --ignore-scripts, npm audit --registry=https://registry.npmjs.org/ --json
• Result: npm audit high-severity findings went from 2 → 0. Diff is exactly the 1-line override addition in package.json plus the corresponding single lockfile entry update (version/resolved/integrity) for node_modules/smol-toml. Both files verified as valid JSON.
• Remaining gaps: full npm install with lifecycle scripts was not exercised in this sandbox (pre-existing environment limitation with the default internal registry mirror); resolution was validated via --package-lock-only --ignore-scripts against the public npm registry, which is sufficient to confirm the dependency tree and audit outcome.

Toolchain / registry preflight

• Node v22.23.2, npm 10.9.8 (repo requires Node >=20.19.0, compatible)
• Registry preflight: repo's default .npmrc points at an internal Azure DevOps feed mirror (unreachable/403 in this sandbox); resolved instead against https://registry.npmjs.org/ directly, an existing documented limitation unrelated to this change

Why this manifest set is atomic

• Only the root package.json/package-lock.json pair is touched; they share one lockfile and one resolver invocation.
• docs-site has its own independent package-lock.json and already resolves the fixed version — excluded because it needs no change.
• No other manifests reference smol-toml.

Breaking changes

• None. smol-toml 1.7.0 → 1.8.0 is a minor bump with no known breaking changes for this dev-only linting dependency.

Sensitive surface area

• None (dev-only, linting tool dependency; no auth/crypto/payment/database/CI-runtime code paths).

Smart-Dependabot-Merge-Candidate: yes

Reviewer checklist

• CI passes
• CODEOWNERS or service owners reviewed
• Security-sensitive areas approved, if applicable
• Deployment/canary owner confirms runtime health, if needed

Rollback guidance

• Revert this PR (both package.json and package-lock.json must be reverted together).

Control Plane

• Correlation ID: 34446215902-944
• Central repo: githubnext/gh-aw-cao
• Run URL: https://github.com/githubnext/gh-aw-cao/actions/runs/34446215902

---

Note

This was originally intended as a pull request, but the git push operation failed.

Original error: The process '/usr/bin/git' failed with exit code 128

Workflow Run: View run details and download bundle artifact

The bundle file is available in the agent artifact in the workflow run linked above.

Create the pull request manually

# Download the artifact from the workflow run
gh run download '34446215902' -n agent -D '/tmp/agent-34446215902'

# Resolve the bundle source ref, fetch it into a temporary ref, then create the local branch
bundle_path='/tmp/agent-34446215902/aw-github-gh-aw-firewall-dependabot-agent-smol-toml-security-fix-20260910064458.bundle'
temp_ref='refs/bundles/create-pr-dependabot-agent-smol-toml-security-fix-20260910064458-d3bd7c78'
target_ref='refs/heads/dependabot-agent/smol-toml-security-fix-20260910064458'
bundle_source_ref=$(git bundle list-heads "$bundle_path" | awk '$2 ~ /^refs\/heads\// { print $2 }')
if [ -z "$bundle_source_ref" ]; then
  bundle_source_ref=$(git bundle list-heads "$bundle_path" | awk '$2 == "HEAD" { print $2 }')
fi
if [ "$(printf '%s\n' "$bundle_source_ref" | sed '/^$/d' | wc -l | tr -d ' ')" != "1" ]; then
  echo "Expected exactly one bundle source ref, found: $bundle_source_ref" >&2
  exit 1
fi
git fetch "$bundle_path" "${bundle_source_ref}:${temp_ref}"
git update-ref "$target_ref" "$temp_ref"
git checkout 'dependabot-agent/smol-toml-security-fix-20260910064458'
# Ensure the working tree matches the updated branch
git reset --hard
# Remove the temporary bundle ref
git update-ref -d "$temp_ref"

# Push the branch to the target remote
git push 'origin' 'dependabot-agent/smol-toml-security-fix-20260910064458'

# Create the pull request
gh pr create --title '[dependabot-agent] Fix smol-toml denial-of-service advisory (GHSA-7w5x-hrqm-74c2) via npm override' --base 'main' --head 'dependabot-agent/smol-toml-security-fix-20260910064458' --repo 'github/gh-aw-firewall'

Generated by Dependabot / Release Trains · copilot · auto · 75.1 AIC · ⌖ 13.4 AIC · ⊞ 18.6K · ◷

_{Add this agentic workflow to your repo}

To install this agentic workflow, run

gh aw add githubnext/gh-aw-cao/.github/workflows/dependabot-release-train-updater.md@main