[dependabot]

Bumps smol-toml to 1.9.0 and updates ancestor dependency nx. These dependencies need to be updated together.

Updates smol-toml from 1.6.1 to 1.9.0

Release notes

Sourced from smol-toml's releases.

v1.9.0

Huge update!!! This is most likely the largest update the library received since its release, with lots of new features and improvements.

Performance improvements

Significant parts of the internal parse logic have been rewritten, improving performance by 1.5x-2x. The library was already comfortably ahead of the others, but it is now faster than ever, sitting at 4x faster parse performance than the closest maintained implementation.

Problematic code paths have also been replaced by safer implementations, solving potential DoS vectors. See GHSA-r4xh-jqrq-34v2.

Note: the objects returned by the library now have a null prototype. This is a transparent change for 99.9% of users, and is one of the most significant contributors to the major performance gains in this version.

Full Temporal support

Version 1.8.0 brought support for Temporal in stringify; now the library is also able to emit Temporal objects instead of its own ad-hoc TomlDate object. It is not enabled by default, but it will become the default in v2. Enable by setting useLegacyDate: false in the parser's options.

Better Temporal support in stringify

Temporal support has been improved since it released: Temporal objects that cannot be represented (such as Temporal.PlainMonthDay) now throw an error (instead of silently emitting a bogus object).

A new option has been added to stringify to disallow Temporal objects that cannot be fully represented in TOML. This includes ZonedDateTime objects with a IANA timezone attached instead of a plain offset, and dates with a specific calendar value set. Enable by setting strictTemporal: true in the options.

Handling of unsafe keys

Since its release the library has been protected against prototype pollution attacks, setting properties like __proto__ using safe mechanisms that do not trigger prototype pollution. However, while the returned objects are safe on their own, they may become problematic if used carelessly.

Inspired by secure-json-parse, the library now offers a way to either drop unsafe properties from the returned object, or to throw an error and reject documents altogether. By default, these potentially unsafe keys are preserved and returned.

Miscellaneous updates

• Unicode BOM is now gracefully accepted and ignored.
• Table array headers are now properly checked again. Reported in #65.
• Closed certain gaps where invalid whitespace would be accepted. Reported in #61.
• Bogus local date and local time values with a UTC offset are no longer accepted.
• Certain error messages are more accurate and handle errors at line boundaries better.
• The default export of the lib is now formally deprecated; use a import * instead. Proposed in #50.
• On Node 20+, strings that contain lone surrogates are now normalised to well-formed strings.
• On Node 20+, keys that contain lone surrogates are now rejected.

Full Changelog: squirrelchat/smol-toml@v1.8.0...v1.9.0

v1.8.0

What's Changed

• feat: stringify temporal objects by @​Gouvernathor and @​cyyynthia

Full Changelog: squirrelchat/smol-toml@v1.7.2...v1.8.0

v1.7.2

What's Changed

• refactor: improve performance of the parser by @​cyyynthia
• chore: revert sourcemap publishing by @​cyyynthia

... (truncated)

Commits

• 6f9739a fix: gate [is|to]WellFormed (Node 18 compat)
• a73ca32 fix: no Temporal with toml-test when Node < 26
• 7727890 chore: version bump
• 641903d chore: rewrite README.md
• 2df14c5 fix(types): make it work if Temporal doesn't exist
• 3eaa44e chore: update benchmark harness
• cd3ba60 feat: safety option for dangerous properties
• 6746a7f perf: refactor TomlDate to avoid regex path
• 16fa64f chore: move benchmarks and test harness under 0BSD
• bbd14b1 fix: correct sign for single-char numbers
• Additional commits viewable in compare view

Updates nx from 22.7.6 to 24.0.2

Release notes

Sourced from nx's releases.

24.0.2 (2026-10-26)

🩹 Fixes

• angular: register the ssr dev server afterEmit hook only once (#37589, #37587)
• angular-rspack: refresh SSR apps after server changes (#37607, #37586)
• core: allow options in object dependsOn entries of project and nx.json schemas (#37600)
• core: fail run-commands tasks that exit before printing readyWhen text (#37591)
• core: honor run-commands readyWhen for a single command in a terminal (#37594)
• core: preserve completed task timings across TUI modes (#37592)
• core: exit 1 on --nx-bail and show why batch tasks were skipped (#37604)
• core: await file watcher registration before reporting readiness (#37076)
• nextjs: bump Next.js 15 and 16 to releases patching critical RCEs (#37601)
• testing: select the test files jest runs for atomized targets (#37505)
• testing: infer the serve task from bunx-prefixed playwright webServer commands (#37606, #37597)

❤️ Thank You

• Craigory Coppola @​AgentEnder
• Leosvel Pérez Espinosa @​leosvelperez
• leosvelperez @​leosvelperez
• MaxKless @​MaxKless
• sarankumar @​sarankumar1325

24.0.1 (2026-10-23)

🩹 Fixes

• angular-rspack: install the plugin after Angular dependencies (#37562)
• core: resolve pnpm aliased dependencies to their own snapshot (#37538, #37429)
• core: drop repository-local git env from the ai-config clone (#37498, #37436)
• core: pin the package manager version in generated workspaces (#37261)
• core: match project patterns with unknown colon prefixes or regex characters (#37500)
• core: keep migrations.json and prompt files out of migrate commits (#37530)
• core: load Nx Cloud code in the daemon with Node's native .js loader (#37534)
• core: keep the daemon running when PROCESS_IN_BACKGROUND fails (#37535)
• core: stop readyWhen logMatches from matching Nx command lines (#37550)
• core: avoid MaxListenersExceededWarning on Nx Cloud agents (#37553)
• core: let readyWhen read the NX_READY_URL its producer reports (#37554)
• core: name every pending dependency in the readiness wait line (#37555)
• core: avoid MaxListenersExceededWarning with parallel run-commands (#37556)
• core: preserve TUI task start times across mode switches (#37558)
• core: recover external dependencies after configuration errors (#37560)
• core: avoid pnpm store probes during version detection (#37561)
• core: count every run-commands readyWhen match, including on stderr (#37567)
• core: exit 1, not 130, when dependents of a failed task are skipped (#37574, #37506)
• maven: suppress wire payloads in verbose batch builds (#37566)
• misc: write versioned docs lockfile into the staging dir (#37546)
• nx-plugin: preserve the working directory in generated e2e tests (#37565)
• release: stop release e2e flaking on the GitHub username lookup (#37544)

... (truncated)

Commits

• a93cf7c fix(core): await file watcher registration before reporting readiness (#37076)
• a5de223 fix(core): exit 1 on --nx-bail and show why batch tasks were skipped (#37604)
• 5c36e0e fix(core): preserve completed task timings across TUI modes (#37592)
• e4cdb6b fix(core): honor run-commands readyWhen for a single command in a terminal (#...
• c8814f6 fix(core): fail run-commands tasks that exit before printing readyWhen text (...
• dcacb43 fix(core): allow options in object dependsOn entries of project and nx.json s...
• 70e7c33 fix(core): exit 1, not 130, when dependents of a failed task are skipped (#37...
• d88fd0b fix(core): count every run-commands readyWhen match, including on stderr (#37...
• 3149837 fix(core): avoid pnpm store probes during version detection (#37561)
• 20ae7b0 fix(core): recover external dependencies after configuration errors (#37560)
• Additional commits viewable in compare view

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: defaults
• Review profile: CHILL
• Plan: Advanced
• Run ID: 5cc40106-0725-43bd-87bc-1b9431f969f7

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[tada5hi]

Merge PrivateAIM/node#‍44?

All checks passed. Automatic merge is not allowed because this includes a breaking major upgrade: nx 22.7.6 → 24.0.2. Also updates smol-toml 1.6.1 → 1.9.0 (minor). Approve merging this head?

Head: 17128ec8f66b9b6d0983e6bea1428eb18ad7bf36

Waiting for approval until 2026-10-29T05:59:58.911Z. Approve or deny: https://maintainer.placzek.dev/ui/approvals?run=2212273a-9d99-412c-9300-f0dff5957d8e&approval=1%3Acall_1d1746d080524dbb887f7e92dcb36336%3A0
Run 2212273a-9d99-412c-9300-f0dff5957d8e of agent maintainer.

[tada5hi]

Merge PrivateAIM/node#‍44?

The head changed after the previous approval, so that approval cannot authorize this head. Updates: smol-toml 1.6.1 → 1.9.0 (minor), nx 22.7.6 → 24.0.2 (breaking). All checks passed. Auto-merge is disallowed because the bump is breaking and GitHub has not computed mergeability (mergeable_state unknown). Approve this new head, subject to confirmed mergeability and successful checks?

Head: 77c52217c4c8dcb8d4ae2b6ff793dfa4a776c183

Waiting for approval until 2026-10-29T07:50:38.032Z. Approve or deny: https://maintainer.placzek.dev/ui/approvals?run=2212273a-9d99-412c-9300-f0dff5957d8e&approval=3%3Acall_bb8fe24aa2334a58a9e52d4121c71414%3A0
Run 2212273a-9d99-412c-9300-f0dff5957d8e of agent maintainer.