From 5950dcf83ed37fb0383485e5a7b073471564df8b Mon Sep 17 00:00:00 2001
From: Kyle Sexton <153232337+kyle-sexton@users.noreply.github.com>
Date: Tue, 15 Sep 2026 16:10:26 -0400
Subject: [PATCH] fix(deps): override smol-toml to 1.7.2 for
 GHSA-7w5x-hrqm-74c2

markdownlint-cli2 0.23.2 (its latest release) exact-pins smol-toml 1.7.0,
which is vulnerable to a denial of service via malformed TOML documents. No
upstream release carries the fix yet, so an npm override forces the patched
1.7.2 into the resolved tree.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01KcBf2VNNsVTuiqZ1N5RuCu
---
 package-lock.json | 6 +++---
 package.json      | 3 +++
 2 files changed, 6 insertions(+), 3 deletions(-)

diff --git a/package-lock.json b/package-lock.json
index 7ec36cfd3..09514f4d1 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -1872,9 +1872,9 @@
       }
     },
     "node_modules/smol-toml": {
-      "version": "1.7.0",
-      "resolved": "https://registry.npmjs.org/smol-toml/-/smol-toml-1.7.0.tgz",
-      "integrity": "sha512-aqVvWoyO21L23mb+drl4RmMXbf6N7FdHjAhTRA9ZBL7apWBgfWC16KjrASI+1p9GAroljyMHj6fK67i0UiTNvQ==",
+      "version": "1.7.2",
+      "resolved": "https://registry.npmjs.org/smol-toml/-/smol-toml-1.7.2.tgz",
+      "integrity": "sha512-pXFZ9B2WinEPzxWkMmlYE/oYx2BP+qLrE95wP8tCuK901uLSMGdCb6QSr82z+wnhXkG4+cO+OMLbZB2Cn+97zw==",
       "dev": true,
       "license": "BSD-3-Clause",
       "engines": {
diff --git a/package.json b/package.json
index 57cbe5e55..ae87cea84 100644
--- a/package.json
+++ b/package.json
@@ -13,6 +13,9 @@
     "htmlhint": "1.9.2",
     "markdownlint-cli2": "0.23.2"
   },
+  "overrides": {
+    "smol-toml": "1.7.2"
+  },
   "allowScripts": {
     "@anthropic-ai/claude-code@2.1.246": true
   }