From 3ee1a6733cd0daf7d72c6f78adfa3201adaf8e69 Mon Sep 17 00:00:00 2001
From: "claude[bot]" <41898282+claude[bot]@users.noreply.github.com>
Date: Thu, 10 Sep 2026 12:38:14 +0000
Subject: [PATCH 1/2] chore: upgrade smol-toml to 1.8.0

Raises the existing qualified `smol-toml@npm:^1.6.0` resolution floor from
`^1.6.1` to `^1.7.1` and refreshes yarn.lock, which now resolves 1.8.0.
smol-toml reaches the tree only through @react-grab/cli, which pins it
behind a resolution, so the floor is what has to move.

Addresses CVE-2026-85730.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
---
 package.json | 2 +-
 yarn.lock    | 8 ++++----
 2 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/package.json b/package.json
index df0ace807..94942a4cd 100644
--- a/package.json
+++ b/package.json
@@ -60,7 +60,7 @@
         "yaml@npm:^2.3.4": "^2.8.3",
         "yaml@npm:^2.8.0": "^2.8.3",
         "ajv@npm:^6.12.4": "^6.14.0",
-        "smol-toml@npm:^1.6.0": "^1.6.1",
+        "smol-toml@npm:^1.6.0": "^1.7.1",
         "teeny-request@npm:^10.0.0": "^10.1.2",
         "uuid": "^14.0.0",
         "fast-uri@npm:^3.0.1": "^3.1.2",
diff --git a/yarn.lock b/yarn.lock
index 0a6a1934e..5dde4f4d5 100644
--- a/yarn.lock
+++ b/yarn.lock
@@ -21569,10 +21569,10 @@ __metadata:
   languageName: node
   linkType: hard
 
-"smol-toml@npm:^1.6.1":
-  version: 1.6.1
-  resolution: "smol-toml@npm:1.6.1"
-  checksum: 10c0/511a78722f99c7616fdb46af708de3d7e81434b5a3d58061166da73f28bfc6cae4f0cd04683f60515b9c490cd10152fce72287c960b337419c0299cc1f0f2a22
+"smol-toml@npm:^1.7.1":
+  version: 1.8.0
+  resolution: "smol-toml@npm:1.8.0"
+  checksum: 10c0/4e01dbfb7c7af142176b037ebedaccccafb8229cc873feaa47c184ee31073d86e30b4b1b0fe9a5a6d083ed3ce21615eda9e81d1f5d779ad8b2e2e9459b900aea
   languageName: node
   linkType: hard
 

From b078ee27ec24a34b0ec6c9a54509598da262854d Mon Sep 17 00:00:00 2001
From: "claude[bot]" <41898282+claude[bot]@users.noreply.github.com>
Date: Thu, 10 Sep 2026 12:38:26 +0000
Subject: [PATCH 2/2] Update changelog

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
---
 CHANGELOG.md | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index e091548b4..18c6de2ed 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -7,6 +7,9 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+### Fixed
+- Upgraded `smol-toml` to `1.8.0`. [#1644](https://github.com/sourcebot-dev/sourcebot/pull/1644)
+
 ## [5.1.11] - 2026-09-10
 
 ### Added