deps: bump smol-toml to 1.8.0

[devin-ai-integration]

TL;DR

Pin smol-toml 1.6.1 → 1.8.0 to clear the openrouter-web Dependabot alert for the vendored packages/bench-harness subtree (SEC-360), without waiting on the 18-package group bump in #82.

What changed?

• package.json: smol-toml 1.6.1 → 1.8.0
• bun.lock: matching resolution and integrity hash

Why?

smol-toml <= 1.7.0 is vulnerable (fixed in 1.7.1). #82 carries the same bump but fails CI at lint because its bundled oxlint 1.77 → 1.83 bump introduces 19 new no-redeclare errors on existing const + type declaration merging. Fixing those is a source change unrelated to the CVE, so this PR isolates the security bump. #82 can land on its own schedule.

The only consumer is parse from smol-toml in the terminal-bench, swe-atlas, deep-swe, and wandr dataset loaders. 1.6.1 → 1.8.0 is minor-only, no API break in the parse signature.

How to test

bun install --frozen-lockfile
bun test src/benchmarks/swe-atlas/schema.test.ts src/benchmarks/deep-swe/schema.test.ts
grep 'smol-toml@' bun.lock   # expect smol-toml@1.8.0 only

Local run before push: format:check, check, typecheck, bun test (1498 pass, 0 fail), build all green.

Reviewer focus

• Nothing beyond the two-line diff. Pure dependency pin.

Checklist

• Tests cover changed behavior (existing TOML parse tests exercise the new version)
• Public API or configuration changes are backward compatible, or the break is documented
• Benchmark changes document dataset provenance and licensing (n/a)
• No credentials, private results, or restricted dataset contents are included
• Documentation is updated where needed (n/a)

Link to Devin session: https://openrouter.devinenterprise.com/sessions/c453cb0617ec413c855147742848fb7b
Open in Devin Desktop: https://openrouter.devinenterprise.com/desktop/session/c453cb0617ec413c855147742848fb7b?variant=devin
Requested by: @alexb-openrouter

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR that start with 'DevinAI' or '@devin'.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment, CI, and merge conflict monitoring

---

Original prompt from Alex

SYSTEM:
<latest_message>
Alex Bujduveanu (U0BFFJD2XR8) [ts=1789656074.283889]: what are the open cve watch tickets in sec
</latest_message>

=== BEGIN THREAD HISTORY ===
Alex Bujduveanu (U0BFFJD2XR8) [ts=1789656074.283889]: what are the open cve watch tickets in sec
=== END THREAD HISTORY ===
Channel ID: D0BFEN3DLHK
Thread URL: https://openrouter.slack.com/archives/D0BFEN3DLHK/p1789656074283889?thread_ts=1789656074.283889&amp;cid=D0BFEN3DLHK

The <latest_message> is the message that you should use to guide your goals + task for this session, and you should use the rest of the slack thread as context.
A [ts=...] marker on a Slack message is that message's timestamp. To act on a specific message with the slack tool (e.g. adding an emoji reaction via the reaction command), pass that value as timestamp along with the Channel ID — no extra lookup call is needed.

[perry-the-pr-reviewer]

⚠️ The maintainer app lacks pull_requests:write on OpenRouterTeam, so this review posts as a COMMENT rather than an APPROVE. The review recommendation is to approve and merge — see the analysis below.

Perry's Review

Verdict: 💬 Comments — recommends APPROVE (auto-approve blocked by missing maintainer-app permission on this org)

Clean dependency pin: smol-toml 1.6.1 → 1.8.0, addressing the security advisory for versions ≤ 1.7.0 (fixed in 1.7.1). Two files changed — package.json and bun.lock — both consistent.

Risk: 🟢 Low

Analysis & risk assessment

Diff verification. The diff is exactly what the PR description claims: version bump in package.json and the matching resolution + integrity hash in bun.lock. No other files touched.

API compatibility. All six import sites (swe-atlas, deep-swe, terminal-bench, wandr dataset loaders + two schema test files) use only parse(string) from smol-toml, which has been the stable core export since v1.0. No API break between 1.6.1 and 1.8.0.

Security. 1.8.0 is above the 1.7.1 fix line, so the CVE is resolved. No new dependencies introduced by the bump.

CI. All checks pass — validate, CodeQL (actions + javascript-typescript).

Dimension	Severity	Risk	Reasoning
Implementation risk	🟩	Low	Two-line version pin with matching lock hash; no code changes.
Premise risk	🟩	Low	Bump targets the correct fix version; isolation from the unrelated #82 oxlint breakage is sound.
Estimated impact	🟩	Low	Worst case is a lock-file mismatch caught at install time.

Risk Factor	Severity	Risk	Reasoning
Reversibility	🟩	Low	Revert to 1.6.1 in one commit.
Detectability	🟩	Low	Frozen-lockfile install fails immediately on mismatch.
Blast radius	🟩	Low	Only TOML dataset loaders, all using the stable parse API.
Data integrity	🟩	Low	No persisted state touched.
Financial exposure		None	No billing or payment surface.
Security and privacy exposure	🟩	Low	Security posture improves — closes the CVE.
Propagation	🟩	Low	No downstream consumers of the pin beyond this repo.
Availability	🟩	Low	No serving path affected.
Recovery cost	🟩	Low	Single-commit revert.
Time to correct	🟩	Low	Immediate.

No inline comments — nothing actionable to flag.