Update smol-toml to 1.7.1

[Copilot]

Updates the transitive smol-toml resolution to 1.7.1 to address the reported security vulnerability.

• Dependency resolution
  • Adds an npm override for smol-toml@1.7.1.
  • Updates package-lock.json so installs resolve the patched version.

"overrides": {
  "postcss": "8.5.23",
  "smol-toml": "1.7.1"
}

[abdulahmad307]

to fix this: https://github.com/github/vuln-mgmt/issues/250126

[abdulahmad307]

@copilot is the override necessary? or is the update in package-lock.json enough?

[Copilot]

🟢 Approval recommended

The override and lockfile consistently resolve the vulnerable dependency to the patched release.

Pull request overview

Updates the transitive smol-toml dependency to the patched version addressing its denial-of-service vulnerability.

Changes:

• Adds an npm override for smol-toml@1.7.1.
• Updates the lockfile resolution and integrity metadata.

File summaries

File	Description
package.json	Forces the patched transitive dependency version.
package-lock.json	Locks smol-toml to version 1.7.1.

Review details

• Files reviewed: 1/2 changed files
• Comments generated: 0
• Review effort level: Balanced

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Copilot]

@copilot is the override necessary? or is the update in package-lock.json enough?

The override is necessary. markdownlint-cli2 pins its own dependency to the exact version "smol-toml": "1.7.0". I tested removing the override and regenerating the lockfile: npm still resolves the top-level smol-toml correctly, but it also creates a nested node_modules/markdownlint-cli2/node_modules/smol-toml pinned at the vulnerable 1.7.0, since that's the exact version markdownlint-cli2's own manifest requires. The override forces all resolutions (including that nested one) to 1.7.1, so it's required to fully close the vulnerability.

[JoyceZhu]

@abdulahmad307 looks like the low-priority vulnerability patch isn't due til January, and the override won't be necessary once the release mentioned DavidAnson/markdownlint-cli2#936 happens upstream; wonder if we should just wait and see if that can fix it.

[abdulahmad307]

@abdulahmad307 looks like the low-priority vulnerability patch isn't due til January, and the override won't be necessary once the release mentioned DavidAnson/markdownlint-cli2#936 happens upstream; wonder if we should just wait and see if that can fix it.

I can close for now