fix(deps): override smol-toml to 1.7.2 for GHSA-7w5x-hrqm-74c2

[kyle-sexton]

No related issue: closes Dependabot alert #48 (GHSA-7w5x-hrqm-74c2), which has no tracking issue.

Summary

Dependabot reports one high-severity vulnerability on the default branch:
smol-toml <= 1.7.0 is open to a denial of service via malformed TOML
documents (GHSA-7w5x-hrqm-74c2). It reaches this repo as a transitive
development dependency of markdownlint-cli2, the markdown-format hook's
repo-local linter.

Dependabot could not open a bump PR for it: markdownlint-cli2@0.23.2 is its
own latest release and exact-pins smol-toml at 1.7.0, so no version of the
parent resolves the advisory.

Fix

Add an npm overrides entry pinning smol-toml to 1.7.2, the patched line
(first patched release is 1.7.1), and regenerate the lockfile. The pin stays
inside the 1.7.x patch line the parent selected rather than moving to 1.8.0.

Remove the override once markdownlint-cli2 depends on smol-toml >= 1.7.1 on
its own; until then an exact override would hold back a future parent bump that
requires a newer parser.

Verification

• npm install --package-lock-only --ignore-scripts — lockfile resolves
  smol-toml@1.7.2; the only changed entries are that package and its integrity hash.
• npm ci --dry-run --ignore-scripts — clean install resolves smol-toml 1.7.2.
• npm audit — found 0 vulnerabilities (was 1 high).
• npm ci --ignore-scripts then markdownlint-cli2 README.md —
  markdownlint-cli2 v0.23.2 (markdownlint v0.41.1), 0 issues in 0 files; the
  linter loads and runs against the overridden parser.
• smol-toml TOML parse smoke test against the overridden install returns the
  expected object, confirming the config-parsing path markdownlint-cli2 uses
  still works.
• Clean-room check: fresh git clone --depth 1 of this branch into an empty
  directory, then npm ci — npm ls smol-toml reports
  markdownlint-cli2@0.23.2 -> smol-toml@1.7.2 overridden, and npm audit
  reports found 0 vulnerabilities. Same state ci.yml:1445 runs in.

npm 11.19.0 does not mirror the overrides field into the lockfile's root
packages[""] entry; it records the override by resolving the tree instead.
rm -rf node_modules && npm install --package-lock-only reproduces the
committed lockfile byte-for-byte, and npm ci reads overrides from
package.json directly, so that field's absence from the lock is npm's own
output rather than drift.

Related

• Dependabot alert: https://github.com/melodic-software/claude-code-plugins/security/dependabot/48
• Advisory: GHSA-7w5x-hrqm-74c2

🤖 Generated with Claude Code

https://claude.ai/code/session_01KcBf2VNNsVTuiqZ1N5RuCu

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-09-15T20:12:13.041355Z	5950dcf	Draft marked ready

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[claude]

Claude finished @kyle-sexton's task in 3m 44s —— View job

---

Code review complete

• Gather context (PR diff, CLAUDE.md, skip gate)
• Review package.json override entry
• Review package-lock.json regeneration
• Post findings

Ran /review:code-review against the two changed files.

package.json — the new overrides block pinning smol-toml to 1.7.2 is syntactically correct and matches the stated intent (stay in the 1.7.x line the parent already pins rather than jumping to 1.8.0).

package-lock.json — the node_modules/smol-toml node correctly resolves to 1.7.2 with a matching resolved/integrity, and it's the only smol-toml node in the tree (hoisted, single copy). One finding posted inline: the lockfile's root packages[""] entry doesn't mirror the new overrides field the way a genuine npm install/npm install --package-lock-only run normally writes it, which is a sign the lockfile edit may not have come from actually running npm — worth double-checking against a clean install since this repo's CI runs a strict npm ci against this exact file on every run. See the inline comment on package-lock.json for details and a one-liner to verify.

No other issues found — this is a small, well-scoped dependency-override fix with a clear removal condition documented in the PR description.
· branch

[claude]

Claude finished @kyle-sexton's task in 30s —— View job

---

Security review complete

• Gather context (PR diff, changed files)
• Apply skip gate / assess security-relevant surface
• Review changed files for security issues
• Post findings

Skip gate applied — no security-relevant surface.

The diff is limited to package.json/package-lock.json:

• package.json adds an npm overrides entry pinning smol-toml to 1.7.2.
• package-lock.json updates the resolved version and integrity hash to match.

This is a dependency-version pin that fixes GHSA-7w5x-hrqm-74c2 (moving smol-toml from the vulnerable 1.7.0 to the patched 1.7.1+ line) with no code changes. There's no logic, authorization, injection, or secrets-handling surface introduced. It's a tightening (exact pin) rather than a loosening of a dependency constraint, and the resolved version/integrity pair in the lockfile is internally consistent, so there's no supply-chain concern for this lane. GitHub Actions/workflow hardening and unpinned-dependency risk are zizmor's advisory lane, not this one, and don't apply here regardless.

No security findings for this PR.

[github-actions]

Last security-reviewed head: 5950dcf83ed37fb0383485e5a7b073471564df8b. On the next push, the relevance gate compares only the commits since this SHA; delete this comment to force a full re-review.

[github-actions]

Claude has reviewed this PR 1 time. The lane skips further automatic reviews after 5; deleting this comment resets the count.