Skip to content

build(deps)(deps): bump smol-toml and markdownlint-cli#36

Open
dependabot[bot] wants to merge 1 commit intomainfrom
dependabot/npm_and_yarn/multi-f10cdc3a96
Open

build(deps)(deps): bump smol-toml and markdownlint-cli#36
dependabot[bot] wants to merge 1 commit intomainfrom
dependabot/npm_and_yarn/multi-f10cdc3a96

Conversation

@dependabot
Copy link
Copy Markdown
Contributor

@dependabot dependabot bot commented on behalf of github Mar 25, 2026

Bumps smol-toml to 1.6.1 and updates ancestor dependency markdownlint-cli. These dependencies need to be updated together.

Updates smol-toml from 1.5.2 to 1.6.1

Release notes

Sourced from smol-toml's releases.

v1.6.1

This release addresses a minor security vulnerability where an attacker-controlled TOML document can exploit an unrestricted recustion and cause a stack overflow error with a document that contains thousands of sucessive commented lines. Security advisory: GHSA-v3rj-xjv7-4jmq

v1.6.0

As of this version, smol-toml now supports the newly released TOML 1.1.0 specification!

Highlights

Multiline inline tables

TOML 1.1.0 now allows inline tables to have newlines, as well as trailing commas.

database = {
  driver = "postgresql",
  server = {
    host = "127.0.0.1",
    port = 3307,
  },
}

Omitting seconds in datetime and time

TOML 1.1.0 renders the seconds component of time elements optional.

datetime-tz = 1979-05-27 07:32Z
datetime = 2001-09-21 10:17
time = 13:37

New string escapes

Strings now support 2 additional escape sequences:

  • \xHH for code points between 0 and 255
  • \e for the escape character (U+001B)

What's Changed

Full Changelog: squirrelchat/smol-toml@v1.5.2...v1.6.0

Commits
  • 072b64f chore: version bump
  • 19a5dc7 chore: upgrade dependencies and actions
  • f286f87 fix: don't use recursion in skipVoid
  • 399c545 chore: version bump
  • 06521ca Merge pull request #49 from squirrelchat/toml-110
  • f3a68a7 fix: properly test \e escape
  • 9743a86 fix: properly run toml-test v2
  • 1ec5303 docs: toml 1.1.0 in the readme
  • 8bc0e2b chore: upgrade dependencies, actions
  • 24618db feat: allow omitting seconds in datetime and time values
  • Additional commits viewable in compare view

Updates markdownlint-cli from 0.47.0 to 0.48.0

Release notes

Sourced from markdownlint-cli's releases.

v0.48.0

  • Update all dependencies via Dependabot
Commits
  • e72a3ca Bump version 0.48.0
  • 02c6132 Delete and recreate package-lock.json via "npm install".
  • 800b47c Bump ava from 6.4.1 to 7.0.0
  • e6eb97c Bump minimatch
  • 61da922 Bump tar from 7.5.7 to 7.5.9
  • 3731696 Bump minimatch from 10.2.0 to 10.2.2
  • d60f5af Bump minimatch from 10.1.2 to 10.2.0
  • 587b174 Bump markdown-it from 14.1.0 to 14.1.1
  • c3bfec9 Bump minimatch from 10.1.1 to 10.1.2
  • 1fba958 Bump @​isaacs/brace-expansion from 5.0.0 to 5.0.1
  • Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
    You can disable automated security fix PRs for this repo from the Security Alerts page.

@dependabot
build(deps)(deps): bump smol-toml and markdownlint-cli
d1e4ddf 
Bumps [smol-toml](https://github.com/squirrelchat/smol-toml) to 1.6.1 and updates ancestor dependency [markdownlint-cli](https://github.com/igorshubovych/markdownlint-cli). These dependencies need to be updated together.


Updates `smol-toml` from 1.5.2 to 1.6.1
- [Release notes](https://github.com/squirrelchat/smol-toml/releases)
- [Commits](squirrelchat/smol-toml@v1.5.2...v1.6.1)

Updates `markdownlint-cli` from 0.47.0 to 0.48.0
- [Release notes](https://github.com/igorshubovych/markdownlint-cli/releases)
- [Commits](igorshubovych/markdownlint-cli@v0.47.0...v0.48.0)

---
updated-dependencies:
- dependency-name: smol-toml
  dependency-version: 1.6.1
  dependency-type: indirect
- dependency-name: markdownlint-cli
  dependency-version: 0.48.0
  dependency-type: direct:development
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot @github
Copy link
Copy Markdown
Contributor Author

dependabot bot commented on behalf of github Mar 25, 2026

Labels

The following labels could not be found: automated, npm. Please create them before Dependabot can add them to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

@dependabot dependabot bot added the dependencies Pull requests that update a dependency file label Mar 25, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@github-actions github-actions[bot] github-actions[bot] approved these changes

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants