[Aymericr]

What does this PR do?

Removes the vulnerable toml@4.1.1 from bun.lock by refreshing the transitive react-doctor resolution from 0.5.0 to 0.9.18. This is a lockfile-only change: no package.json, override or app code edits.

High-severity advisories cleared (all toml <=5.0.0, CPU DoS in toml.parse(), published 2026-10-22):

• GHSA-4qx8-w7c3-pj3p
• GHSA-9j65-hcg3-gc64
• GHSA-9qmh-m7c6-f92p

The same toml@4.1.1 also carried two older high advisories, which this clears too: GHSA-82x6-q7mm-w9cf and GHSA-v5mp-jgw5-2x6j.

Dependency chain (verified against the lockfile):
apps/editor devDependency react-scan@^0.5.7 → react-doctor (declared as "latest" by react-scan, locked at 0.5.0) → effect@4.0.0-beta.70 → toml@^4.1.1.
effect had no other consumer. react-doctor 0.9.18 no longer depends on effect.

Exposure was dev-only. react-scan is an apps/editor devDependency, loaded only when NODE_ENV=development and PASCAL_DEV_DIAGNOSTICS=1. Its browser bundle never imports react-doctor; it only embeds the package.json metadata. The react-scan CLI runs npx react-doctor@latest rather than the locked copy.

Lockfile changes (bun update react-doctor, bun 1.4.4):

• react-doctor 0.5.0 → 0.9.18; oxlint-plugin-react-doctor 0.5.0 → 0.9.18
• Removed: toml, effect, @effect/platform-node-shared, deslop-js, fast-check, pure-rand, find-my-way-ts, ini, kubernetes-types, msgpackr (+ msgpackr-extract binaries), multipasta, uuid@14, ws, @types/ws, @standard-schema/spec, the vscode-languageserver* / vscode-jsonrpc / vscode-uri family, node-gyp-build-optional-packages
• Added for react-doctor 0.9.18: @astrojs/compiler, playwright-core, yoga-layout, @shaderfrog/glsl-parser, a nested lightningcss@1.33.0 under oxlint-plugin-react-doctor, react-doctor/typescript@5.9.3
• Moved within react-doctor's subtree: oxlint 1.69 → 1.81, oxc-parser 0.132 → 0.148, oxc-resolver 11.20 → 11.24.2 (and their native bindings), plus their wasm runtime helpers @napi-rs/wasm-runtime, @emnapi/*, @tybys/wasm-util
• No other packages changed. A broader re-resolve that bumped @babel/*, @floating-ui/* and others was tried and rejected.

bun audit: 38 → 33 advisories (32 → 27 high). None of the remaining ones involve toml or react-doctor's subtree.

How to test

1. bun install --frozen-lockfile. It should succeed with no lockfile changes, and grep '"toml"' bun.lock should return nothing.
2. bun audit. No toml entries should remain.
3. PASCAL_DEV_DIAGNOSTICS=1 bun dev, then open the editor. The react-scan overlay should appear: window.__REACT_SCAN__ and #react-scan-root are present.

Screenshots / screen recording

N/A — non-visual change

Checklist

• I've tested this locally with bun dev
• My code follows the existing code style (run bun check to verify)
• I've updated relevant documentation (if applicable)
• This PR targets the main branch

  

---

Note

Low Risk
Dev-only lockfile churn for a transitive CLI/tooling package; runtime and production bundles are unaffected, though CI/local installs pull a larger new dependency tree.

^{Reviewed by Cursor Bugbot for commit 5e9fec1. Bugbot is set up for automated code reviews on this repo. Configure here.}

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-22T21:13:14.670531Z	5e9fec1	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.