dependabot[bot] opened a new pull request, #1843: URL: https://github.com/apache/camel-website/pull/1843
Bumps [toml](https://github.com/BinaryMuse/toml-node) from 4.2.0 to 5.0.1. <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/BinaryMuse/toml-node/blob/main/CHANGELOG.md";>toml's changelog</a>.</em></p> <blockquote> <h1>5.0.1 - October 12 2026</h1> <ul> <li>Address four security advisories, each reachable by parsing untrusted input: <ul> <li><a href="https://github.com/BinaryMuse/toml-node/security/advisories/GHSA-h895-cgqg-jf52";>CVE-2026-114142</a>, in which a crafted document could still write to <code>Object.prototype</code>. Two distinct key paths could render to the same bookkeeping string, letting an array-of-tables header clear the guard on an unrelated key, after which a dotted key could descend through a date value into its prototype chain. The compiler now records how each table was defined on the table itself rather than in string-keyed sets, so paths cannot collide and key paths can only descend through tables the compiler created.</li> <li><a href="https://github.com/BinaryMuse/toml-node/security/advisories/GHSA-9j65-hcg3-gc64";>CVE-2026-114143</a>, in which dotted keys, table headers, and inline-table keys with many segments took quadratic time to resolve.</li> <li><a href="https://github.com/BinaryMuse/toml-node/security/advisories/GHSA-4qx8-w7c3-pj3p";>CVE-2026-114141</a>, in which every array-of-tables header rescanned all paths defined so far, so documents with many such headers took quadratic time.</li> <li><a href="https://github.com/BinaryMuse/toml-node/security/advisories/GHSA-9qmh-m7c6-f92p";>CVE-2026-114144</a>, in which integer literals were converted to <code>BigInt</code> before any size check, so a multi-megabyte literal consumed super-linear CPU time before being rejected. Literals with more digits than any 64-bit integer are now rejected before conversion.</li> </ul> </li> </ul> <h1>5.0.0 - July 14 2026</h1> <ul> <li><strong>Breaking:</strong> Integers outside JavaScript's safe range (beyond ±<code>Number.MAX_SAFE_INTEGER</code>) now throw a parse error instead of silently returning a rounded value (<a href="https://redirect.github.com/BinaryMuse/toml-node/issues/28";>#28</a>). Opt in to lossless handling of the full 64-bit range with <code>toml.parse(input, { bigint: true })</code>, which returns all integer values as <code>BigInt</code>.</li> <li><strong>Breaking:</strong> Integers outside TOML's 64-bit signed integer range now throw a parse error in either mode, as required by the spec. Previously they were silently rounded.</li> </ul> <h1>4.3.0 - July 13 2026</h1> <ul> <li>Add opt-in <a href="https://developer.mozilla.org/docs/Web/JavaScript/Reference/Global_Objects/Temporal";>Temporal</a> support via <code>toml.parse(input, { useTemporal: true })</code>, mapping offset date-times to <code>Temporal.ZonedDateTime</code> and local date-times/dates/times to <code>Temporal.PlainDateTime</code>/<code>PlainDate</code>/<code>PlainTime</code>. An implementation can be supplied via the <code>temporal</code> option on runtimes without a <code>Temporal</code> global. (<a href="https://redirect.github.com/BinaryMuse/toml-node/issues/69";>#69</a>)</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/BinaryMuse/toml-node/commit/9ebfa698682500bbd30ce28e612ecc0208d9f70e";><code>9ebfa69</code></a> 5.0.1</li> <li><a href="https://github.com/BinaryMuse/toml-node/commit/22cf8bbe057dc22b444ed0b2cf5c54994aebd491";><code>22cf8bb</code></a> Update changelog for 5.0.1</li> <li><a href="https://github.com/BinaryMuse/toml-node/commit/9d52e384f6030932174d1afb0d910154dd62dead";><code>9d52e38</code></a> Reject integer literals too long for int64 before converting to BigInt</li> <li><a href="https://github.com/BinaryMuse/toml-node/commit/609c873fffea0a27ebe5b4dd098eed2b3daf3606";><code>609c873</code></a> Track table origin on the table instead of in string-keyed path sets</li> <li><a href="https://github.com/BinaryMuse/toml-node/commit/df2bd01946f67e96a7a2c4743e98dd48971fa5e1";><code>df2bd01</code></a> Add tests for advisories GHSA-h895-cgqg-jf52, GHSA-9j65-hcg3-gc64, GHSA-4qx8-...</li> <li><a href="https://github.com/BinaryMuse/toml-node/commit/1b2ac40b0a9c0040f74308507c78ed917689b669";><code>1b2ac40</code></a> Update CHANGELOG with assigned CVE</li> <li><a href="https://github.com/BinaryMuse/toml-node/commit/ccd8b103f08bea6d39541271b1e6c3dba9e73275";><code>ccd8b10</code></a> 5.0.0</li> <li><a href="https://github.com/BinaryMuse/toml-node/commit/00ac4a6bea7278fe13e6680db3a57cc71780c4b2";><code>00ac4a6</code></a> Update changelog</li> <li><a href="https://github.com/BinaryMuse/toml-node/commit/121e5fa35802f7d12cc58cee24ea91baf5b4e2c7";><code>121e5fa</code></a> Merge pull request <a href="https://redirect.github.com/BinaryMuse/toml-node/issues/74";>#74</a> from BinaryMuse/mkt/big-ints</li> <li><a href="https://github.com/BinaryMuse/toml-node/commit/2b6bcb702a1f73092686e72bfaa4d42be7875efa";><code>2b6bcb7</code></a> Add opt-in BigInt support, throw when parsing out of bounds values</li> <li>Additional commits viewable in <a href="https://github.com/BinaryMuse/toml-node/compare/v4.2.0...v5.0.1";>compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/apache/camel-website/network/alerts). </details> -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
