chore(deps): bump the security group across 10 directories with 6 updates by dependabot[bot] · Pull Request #38 · hostinger/hostinger-templates

dependabot · 2026-10-06T13:00:58Z

Bumps the security group with 3 updates in the /templates/consultancy directory: brace-expansion, devalue and source-map-js.
Bumps the security group with 1 update in the /templates/console directory: brace-expansion.
Bumps the security group with 5 updates in the /templates/compare directory:

Package	From	To
brace-expansion	`1.1.18`	`1.1.21`
devalue	`5.9.2`	`5.9.4`
source-map-js	`1.2.1`	`1.2.2`
http-cache-semantics	`4.2.0`	`4.3.0`
smol-toml	`1.8.0`	`1.9.0`

Bumps the security group with 2 updates in the /templates/client-gallery directory: brace-expansion and source-map-js.
Bumps the security group with 5 updates in the /templates/class-timetable directory:

Package	From	To
brace-expansion	`5.0.9`	`5.0.12`
devalue	`5.9.2`	`5.9.4`
source-map-js	`1.2.1`	`1.2.2`
http-cache-semantics	`4.2.0`	`4.3.0`
smol-toml	`1.8.0`	`1.9.0`

Bumps the security group with 5 updates in the /templates/changelog directory:

Package	From	To
brace-expansion	`5.0.9`	`5.0.12`
devalue	`5.9.2`	`5.9.4`
source-map-js	`1.2.1`	`1.2.2`
http-cache-semantics	`4.2.0`	`4.3.0`
smol-toml	`1.8.0`	`1.9.0`

Bumps the security group with 2 updates in the /templates/careers directory: brace-expansion and source-map-js.
Bumps the security group with 2 updates in the /templates/callout directory: brace-expansion and source-map-js.
Bumps the security group with 5 updates in the /templates/bakery-preorder directory:

Package	From	To
brace-expansion	`5.0.9`	`5.0.12`
devalue	`5.9.2`	`5.9.4`
source-map-js	`1.2.1`	`1.2.2`
http-cache-semantics	`4.2.0`	`4.3.0`
smol-toml	`1.8.0`	`1.9.0`

Bumps the security group with 2 updates in the /templates/api-reference directory: brace-expansion and proxy-addr.

Updates brace-expansion from 2.1.4 to 2.1.7

Commits

714b622 2.1.7
bdff773 Merge commit from fork
5a5c07b 2.1.6
6463f2f update lockfile
1ba3c71 Merge commit from fork
aae3387 2.1.5
5171e68 Merge commit from fork
See full diff in compare view

Updates devalue from 5.9.2 to 5.9.4

Release notes

Sourced from devalue's releases.

v5.9.4

Patch Changes

067b125: perf: annotate module-level Object.freeze calls as pure so unused operation tables tree-shake

v5.9.3

Patch Changes

6861dbb: fix: avoid scanning sparse array holes in uneval traversal and shared-array population

9ec5130: fix: reject non-string null-prototype object keys in parse and unflatten to prevent bypassing the __proto__ check

dae8153: fix: prevent unhandled internal rejections in stringifyAsync when serializing multiple promises

84f6f67: fix: prevent quadratic uneval output expansion for repeated strings and bigints

6861dbb: fix: avoid eager allocation when evaluating sparse arrays emitted by uneval

8f8d78e: fix: validate revived backing buffers before constructing typed arrays

46dc877: fix: serialize only the visible bytes of Node Buffers in stringify, stringifyAsync and uneval, preventing disclosure of unrelated data from their shared allocation pool

Changelog

Sourced from devalue's changelog.

5.9.4

Patch Changes

067b125: perf: annotate module-level Object.freeze calls as pure so unused operation tables tree-shake

5.9.3

Patch Changes

6861dbb: fix: avoid scanning sparse array holes in uneval traversal and shared-array population

9ec5130: fix: reject non-string null-prototype object keys in parse and unflatten to prevent bypassing the __proto__ check

dae8153: fix: prevent unhandled internal rejections in stringifyAsync when serializing multiple promises

84f6f67: fix: prevent quadratic uneval output expansion for repeated strings and bigints

6861dbb: fix: avoid eager allocation when evaluating sparse arrays emitted by uneval

8f8d78e: fix: validate revived backing buffers before constructing typed arrays

46dc877: fix: serialize only the visible bytes of Node Buffers in stringify, stringifyAsync and uneval, preventing disclosure of unrelated data from their shared allocation pool

Commits

434358a Version Packages (#202)
067b125 perf: annotate module-level Object.freeze calls as pure (#200)
53cd3db Version Packages (#201)
46dc877 Merge commit from fork
84f6f67 Merge commit from fork
6861dbb Merge commit from fork
8f8d78e Merge commit from fork
dae8153 Merge commit from fork
9ec5130 Merge commit from fork
8ade61d chore: fix bench:compare script (#198)
See full diff in compare view

Updates source-map-js from 1.2.1 to 1.2.2

Release notes

Sourced from source-map-js's releases.

v1.2.2

Fix crash when executing in browser with CSP script-src that don't permit unsafe-eval (#29) @xfournet

Fix denial of service from malicious indexed source maps (CVE-2026-93749) (#79)

Reported by @waydeshi in #76. A fix was also proposed by @aniebiet in #78.

Changelog

Sourced from source-map-js's changelog.

1.2.2

Fix crash when executing in browser with CSP script-src that don't permit unsafe-eval (#29) @xfournet

Fix denial of service from malicious indexed source maps (CVE-2026-93749) (#79)

Reported by @waydeshi in #76. A fix was also proposed by @aniebiet in #78.

Commits

0a1d334 1.2.2
4c6fa26 Update changelog
cf76580 Fix denial of service from malicious indexed source maps (CVE-2026-93749) (#79)
7899a86 Fix crash when executing browser with CSP script-src that don't permit unsafe...
See full diff in compare view

Updates brace-expansion from 1.1.18 to 1.1.21

Commits

714b622 2.1.7
bdff773 Merge commit from fork
5a5c07b 2.1.6
6463f2f update lockfile
1ba3c71 Merge commit from fork
aae3387 2.1.5
5171e68 Merge commit from fork
See full diff in compare view

Updates brace-expansion from 1.1.18 to 1.1.21

Commits

714b622 2.1.7
bdff773 Merge commit from fork
5a5c07b 2.1.6
6463f2f update lockfile
1ba3c71 Merge commit from fork
aae3387 2.1.5
5171e68 Merge commit from fork
See full diff in compare view

Updates devalue from 5.9.2 to 5.9.4

Release notes

Sourced from devalue's releases.

v5.9.4

Patch Changes

067b125: perf: annotate module-level Object.freeze calls as pure so unused operation tables tree-shake

v5.9.3

Patch Changes

6861dbb: fix: avoid scanning sparse array holes in uneval traversal and shared-array population

9ec5130: fix: reject non-string null-prototype object keys in parse and unflatten to prevent bypassing the __proto__ check

dae8153: fix: prevent unhandled internal rejections in stringifyAsync when serializing multiple promises

84f6f67: fix: prevent quadratic uneval output expansion for repeated strings and bigints

6861dbb: fix: avoid eager allocation when evaluating sparse arrays emitted by uneval

8f8d78e: fix: validate revived backing buffers before constructing typed arrays

46dc877: fix: serialize only the visible bytes of Node Buffers in stringify, stringifyAsync and uneval, preventing disclosure of unrelated data from their shared allocation pool

Changelog

Sourced from devalue's changelog.

5.9.4

Patch Changes

067b125: perf: annotate module-level Object.freeze calls as pure so unused operation tables tree-shake

5.9.3

Patch Changes

6861dbb: fix: avoid scanning sparse array holes in uneval traversal and shared-array population

9ec5130: fix: reject non-string null-prototype object keys in parse and unflatten to prevent bypassing the __proto__ check

dae8153: fix: prevent unhandled internal rejections in stringifyAsync when serializing multiple promises

84f6f67: fix: prevent quadratic uneval output expansion for repeated strings and bigints

6861dbb: fix: avoid eager allocation when evaluating sparse arrays emitted by uneval

8f8d78e: fix: validate revived backing buffers before constructing typed arrays

46dc877: fix: serialize only the visible bytes of Node Buffers in stringify, stringifyAsync and uneval, preventing disclosure of unrelated data from their shared allocation pool

Commits

434358a Version Packages (#202)
067b125 perf: annotate module-level Object.freeze calls as pure (#200)
53cd3db Version Packages (#201)
46dc877 Merge commit from fork
84f6f67 Merge commit from fork
6861dbb Merge commit from fork
8f8d78e Merge commit from fork
dae8153 Merge commit from fork
9ec5130 Merge commit from fork
8ade61d chore: fix bench:compare script (#198)
See full diff in compare view

Updates source-map-js from 1.2.1 to 1.2.2

Release notes

Sourced from source-map-js's releases.

v1.2.2

Fix crash when executing in browser with CSP script-src that don't permit unsafe-eval (#29) @xfournet

Fix denial of service from malicious indexed source maps (CVE-2026-93749) (#79)

Reported by @waydeshi in #76. A fix was also proposed by @aniebiet in #78.

Changelog

Sourced from source-map-js's changelog.

1.2.2

Fix crash when executing in browser with CSP script-src that don't permit unsafe-eval (#29) @xfournet

Fix denial of service from malicious indexed source maps (CVE-2026-93749) (#79)

Reported by @waydeshi in #76. A fix was also proposed by @aniebiet in #78.

Commits

0a1d334 1.2.2
4c6fa26 Update changelog
cf76580 Fix denial of service from malicious indexed source maps (CVE-2026-93749) (#79)
7899a86 Fix crash when executing browser with CSP script-src that don't permit unsafe...
See full diff in compare view

Updates http-cache-semantics from 4.2.0 to 4.3.0

Commits

See full diff in compare view

Updates smol-toml from 1.8.0 to 1.9.0

Release notes

Sourced from smol-toml's releases.

v1.9.0

Huge update!!! This is most likely the largest update the library received since its release, with lots of new features and improvements.

Performance improvements

Significant parts of the internal parse logic have been rewritten, improving performance by 1.5x-2x. The library was already comfortably ahead of the others, but it is now faster than ever, sitting at 4x faster parse performance than the closest maintained implementation.

Problematic code paths have also been replaced by safer implementations, solving potential DoS vectors. See GHSA-r4xh-jqrq-34v2.

Note: the objects returned by the library now have a null prototype. This is a transparent change for 99.9% of users, and is one of the most significant contributors to the major performance gains in this version.

Full Temporal support

Version 1.8.0 brought support for Temporal in stringify; now the library is also able to emit Temporal objects instead of its own ad-hoc TomlDate object. It is not enabled by default, but it will become the default in v2. Enable by setting useLegacyDate: false in the parser's options.

Better Temporal support in stringify

Temporal support has been improved since it released: Temporal objects that cannot be represented (such as Temporal.PlainMonthDay) now throw an error (instead of silently emitting a bogus object).

A new option has been added to stringify to disallow Temporal objects that cannot be fully represented in TOML. This includes ZonedDateTime objects with a IANA timezone attached instead of a plain offset, and dates with a specific calendar value set. Enable by setting strictTemporal: true in the options.

Handling of unsafe keys

Since its release the library has been protected against prototype pollution attacks, setting properties like __proto__ using safe mechanisms that do not trigger prototype pollution. However, while the returned objects are safe on their own, they may become problematic if used carelessly.

Inspired by secure-json-parse, the library now offers a way to either drop unsafe properties from the returned object, or to throw an error and reject documents altogether. By default, these potentially unsafe keys are preserved and returned.

Miscellaneous updates

Unicode BOM is now gracefully accepted and ignored.

Table array headers are now properly checked again. Reported in #65.

Closed certain gaps where invalid whitespace would be accepted. Reported in #61.

Bogus local date and local time values with a UTC offset are no longer accepted.

Certain error messages are more accurate and handle errors at line boundaries better.

The default export of the lib is now formally deprecated; use a import * instead. Proposed in #50.

On Node 20+, strings that contain lone surrogates are now normalised to well-formed strings.

On Node 20+, keys that contain lone surrogates are now rejected.

Full Changelog: squirrelchat/smol-toml@v1.8.0...v1.9.0

Commits

6f9739a fix: gate [is|to]WellFormed (Node 18 compat)
a73ca32 fix: no Temporal with toml-test when Node < 26
7727890 chore: version bump
641903d chore: rewrite README.md
2df14c5 fix(types): make it work if Temporal doesn't exist
3eaa44e chore: update benchmark harness
cd3ba60 feat: safety option for dangerous properties
6746a7f perf: refactor TomlDate to avoid regex path
16fa64f chore: move benchmarks and test harness under 0BSD
bbd14b1 fix: correct sign for single-char numbers
Additional commits viewable in compare view

Updates brace-expansion from 5.0.9 to 5.0.12

Commits

714b622 2.1.7
bdff773 Merge commit from fork
5a5c07b 2.1.6
6463f2f update lockfile
1ba3c71 Merge commit from fork
aae3387 2.1.5
5171e68 Merge commit from fork
See full diff in compare view

Updates source-map-js from 1.2.1 to 1.2.2

Release notes

Sourced from source-map-js's releases.

v1.2.2

Fix crash when executing in browser with CSP script-src that don't permit unsafe-eval (#29) @xfournet

Fix denial of service from malicious indexed source maps (CVE-2026-93749) (#79)

Reported by @waydeshi in #76. A fix was also proposed by @aniebiet in #78.

Changelog

Sourced from source-map-js's changelog.

1.2.2

Fix crash when executing in browser with CSP script-src that don't permit unsafe-eval (#29) @xfournet

Fix denial of service from malicious indexed source maps (CVE-2026-93749) (#79)

Reported by @waydeshi in #76. A fix was also proposed by @aniebiet in #78.

Commits

0a1d334 1.2.2
4c6fa26 Update changelog
cf76580 Fix denial of service from malicious indexed source maps (CVE-2026-93749) (#79)
7899a86 Fix crash when executing browser with CSP script-src that don't permit unsafe...
See full diff in compare view

Updates brace-expansion from 5.0.9 to 5.0.12

Commits

714b622 2.1.7
bdff773 Merge commit from fork
5a5c07b 2.1.6
6463f2f update lockfile
1ba3c71 Merge commit from fork
aae3387 2.1.5
5171e68 Merge commit from fork
See full diff in compare view

Updates devalue from 5.9.2 to 5.9.4

Release notes

Sourced from devalue's releases.

v5.9.4

Patch Changes

067b125: perf: annotate module-level Object.freeze calls as pure so unused operation tables tree-shake

v5.9.3

Patch Changes

6861dbb: fix: avoid scanning sparse array holes in uneval traversal and shared-array population

9ec5130: fix: reject non-string null-prototype object keys in parse and unflatten to prevent bypassing the __proto__ check

dae8153: fix: prevent unhandled internal rejections in stringifyAsync when serializing multiple promises

84f6f67: fix: prevent quadratic uneval output expansion for repeated strings and bigints

6861dbb: fix: avoid eager allocation when evaluating sparse arrays emitted by uneval

8f8d78e: fix: validate revived backing buffers before constructing typed arrays

46dc877: fix: serialize only the visible bytes of Node Buffers in stringify, stringifyAsync and uneval, preventing disclosure of unrelated data from their shared allocation pool

Changelog

Sourced from devalue's changelog.

5.9.4

Patch Changes

067b125: perf: annotate module-level Object.freeze calls as pure so unused operation tables tree-shake

5.9.3

Patch Changes

6861dbb: fix: avoid scanning sparse array holes in uneval traversal and shared-array population

9ec5130: fix: reject non-string null-prototype object keys in parse and unflatten to prevent bypassing the __proto__ check

dae8153: fix: prevent unhandled internal rejections in stringifyAsync when serializing multiple promises

84f6f67: fix: prevent quadratic uneval output expansion for repeated strings and bigints

6861dbb: fix: avoid eager allocation when evaluating sparse arrays emitted by uneval

8f8d78e: fix: validate revived backing buffers before constructing typed arrays

46dc877: fix: serialize only the visible bytes of Node Buffers in stringify, stringifyAsync and uneval, preventing disclosure of unrelated data from their shared allocation pool

Commits

434358a Version Packages (#202)
067b125 perf: annotate module-level Object.freeze calls as pure (#200)
53cd3db Version Packages (#201)
46dc877 Merge commit from fork
84f6f67 Merge commit from fork
6861dbb Merge commit from fork
8f8d78e Merge commit from fork
dae8153 Merge commit from fork
9ec5130 Merge commit from fork
8ade61d chore: fix bench:compare script (#198)
See full diff in compare view

Updates source-map-js from 1.2.1 to 1.2.2

Release notes

Sourced from source-map-js's releases.

v1.2.2

Fix crash when executing in browser with CSP script-src that don't permit unsafe-eval (#29) @xfournet

Fix denial of service from malicious indexed source maps (CVE-2026-93749) (#79)

Reported by @waydeshi in #76. A fix was also proposed by @aniebiet in #78.

Changelog

Sourced from source-map-js's changelog.

1.2.2

Fix crash when executing in browser with CSP script-src that don't permit unsafe-eval (#29) @xfournet

Fix denial of service from malicious indexed source maps (CVE-2026-93749) (#79)

Reported by @waydeshi in #76. A fix was also proposed by @aniebiet in #78.

Commits

0a1d334 1.2.2
4c6fa26 Update changelog
cf76580 Fix denial of service from malicious indexed source maps (CVE-2026-93749) (#79)
7899a86 Fix crash when executing browser with CSP script-src that don't permit unsafe...
See full diff in compare view

Updates http-cache-semantics from 4.2.0 to 4.3.0

Commits

See full diff in compare view

Updates smol-toml from 1.8.0 to 1.9.0

Release notes

Sourced from smol-toml's releases.

v1.9.0

Huge update!!! This is most likely the largest update the library received since its release, with lots of new features and improvements.

Performance improvements

Significant parts of the internal parse logic have been rewritten, improving performance by 1.5x-2x. The library was already comfortably ahead of the others, but it is now faster than ever, sitting at 4x faster parse performance than the closest maintained implementation.

Problematic code paths have also been replaced by safer implementations, solving potential DoS vectors. See GHSA-r4xh-jqrq-34v2.

Note: the objects returned by the library now have a null prototype. This is a transparent change for 99.9% of users, and is one of the most significant contributors to the major performance gains in this version.

Full Temporal support

Version 1.8.0 brought support for Temporal in stringify; now the library is also able to emit Temporal objects instead of its own ad-hoc TomlDate object. It is not enabled by default, but it will become the default in v2. Enable by setting useLegacyDate: false in the parser's options.

Better Temporal support in stringify

Temporal support has been improved since it released: Temporal objects that cannot be represented (such as Temporal.PlainMonthDay) now throw an error (instead of silently emitting a bogus object).

A new option has been added to stringify to disallow Temporal objects that cannot be fully represented in TOML. This includes ZonedDateTime objects with a IANA timezone attached instead of a plain offset, and dates with a specific calendar value set. Enable by setting strictTemporal: true in the options.

Handling of unsafe keys

Since its release the library has been protected against prototype pollution attacks, setting properties like __proto__ using safe mechanisms that do not trigger prototype pollution. However, while the returned objects are safe on their own, they may become problematic if used carelessly.

Inspired by secure-json-parse, the library now offers a way to either drop unsafe properties from the returned object, or to throw an error and reject documents altogether. By default, these potentially unsafe keys are preserved and returned.

Miscellaneous updates

Unicode BOM is now gracefully accepted and ignored.

Table array headers are now properly checked again. Reported in #65.

Closed certain gaps where invalid whitespace would be accepted. Reported in #61.

Bogus local date and local time values with a UTC offset are no longer accepted.

Certain error messages are more accurate and handle errors at line boundaries better.

The default export of the lib is now formally deprecated; use a import * instead. Proposed in #50.

On Node 20+, strings that contain lone surrogates are now normalised to well-formed strings.

On Node 20+, keys that contain lone surrogates are now rejected.

Full Changelog: squirrelchat/smol-toml@v1.8.0...v1.9.0

Commits

6f9739a fix: gate [is|to]WellFormed (Node 18 compat)
a73ca32 fix: no Temporal with toml-test when Node < 26
7727890 chore: version bump
641903d chore: rewrite README.md
2df14c5 fix(types): make it work if Temporal doesn't exist
3eaa44e chore: update benchmark harness
cd3ba60 feat: safety option for dangerous properties
6746a7f perf: refactor TomlDate to avoid regex path
16fa64f chore: move benchmarks and test harness under 0BSD
bbd14b1 fix: correct sign for single-char numbers
Additional commits viewable in compare view

Updates brace-expansion from 5.0.9 to 5.0.12

Commits

714b622 2.1.7
bdff773 Merge commit from fork
5a5c07b 2.1.6
6463f2f update lockfile
1ba3c71 Merge commit from fork
aae3387 2.1.5
5171e68 Merge commit from fork
See full diff in compare view

Updates devalue from 5.9.2 to 5.9.4

Release notes

Sourced from devalue's releases.

v5.9.4

Patch Changes

067b125: perf: annotate module-level Object.freeze calls as pure so unused operation tables tree-shake

v5.9.3

Patch Changes

6861dbb: fix: avoid scanning sparse array holes in uneval traversal and shared-array population

9ec5130: fix: reject non-string null-prototype object keys in parse and unflatten to prevent bypassing the __proto__ check

dae8153: fix: prevent unhandled internal rejections in stringifyAsync when serializing multiple promises

84f6f67: fix: prevent quadratic uneval output expansion for repeated strings and bigints

6861dbb: fix: avoid eager allocation when evaluating sparse arrays emitted by uneval

8f8d78e: fix: validate revived backing buffers before constructing typed arrays

46dc877: fix: serialize only the visible bytes of Node Buffers in stringify, stringifyAsync and uneval, preventing disclosure of unrelated data from their shared allocation pool

Changelog

Sourced from devalue's changelog.

5.9.4

Patch Changes

067b125: perf: annotate module-level Object.freeze calls as pure so unused operation tables tree-shake

5.9.3

Patch Changes

6861dbb: fix: avoid scanning sparse array holes in uneval traversal and shared-array population

9ec5130: fix: reject non-string null-prototype object keys in parse and unflatten to prevent bypassing the __proto__ check

dae8153: fix: prevent unhandled internal rejections in stringifyAsync when serializing multiple promises

84f6f67: fix: prevent quadratic uneval output expansion for repeated strings and bigints

6861dbb: fix: avoid eager allocation when evaluating sparse arrays emitted by uneval

8f8d78e: fix: validate revived backing buffers before constructing typed arrays

46dc877: fix: serialize only the visible bytes of Node Buffers in stringify, stringifyAsync and uneval, preventing disclosure of unrelated data from their shared allocation pool

Commits

434358a Version Packages (#202)
067b125 perf: annotate module-level Object.freeze calls as pure (#200)
53cd3db Version Packages (#201)
46dc877 Merge commit from fork
84f6f67 Merge commit from fork
6861dbb Merge commit from fork
8f8d78e Merge commit from fork
dae8153 Merge commit from fork
9ec5130 Merge commit from fork
8ade61d chore: fix bench:compare script (#198)
See full diff in compare view

Updates source-map-js from 1.2.1 to 1.2.2

Release notes

Sourced from source-map-js's releases.

v1.2.2

Fix crash when executing in browser with CSP script-src that don't permit unsafe-eval (#29) @xfournet

Fix denial of service from malicious indexed source maps (CVE-2026-93749) (#79)

Reported by @waydeshi in #76. A fix was also proposed by @aniebiet in #78.

Changelog

Sourced from source-map-js's changelog.

1.2.2

Fix crash when executing in browser with CSP script-src that don't permit unsafe-eval (#29) @xfournet

Fix denial of service from malicious indexed source maps (CVE-2026-93749) (#79)

Reported by @waydeshi in #76. A fix was also proposed by @aniebiet in #78.

Commits

0a1d334 1.2.2
4c6fa26 Update changelog
cf76580 Fix denial of service from malicious indexed source maps (CVE-2026-93749) (#79)
7899a86 Fix crash when executing browser with CSP script-src that don't permit unsafe...
See full diff in compare view

Updates http-cache-semantics from 4.2.0 to 4.3.0

Commits

See full diff in compare view

Updates smol-toml from 1.8.0 to 1.9.0

Release notes

Sourced from smol-toml's releases.

v1.9.0

Huge update!!! This is most likely the largest update the library received since its release, with lots of new features and improvements.

Performance improvements

Significant parts of the internal parse logic have been rewritten, improving performance by 1.5x-2x. The library was already comfortably ahead of the others, but it is now faster than ever, sitting at 4x faster parse performance than the closest maintained implementation.

Problematic code paths have also been replaced by safer implementations, solving potential DoS vectors. See GHSA-r4xh-jqrq-34v2.

Note: the objects returned by the library now have a null prototype. This is a transparent change for 99.9% of users, and is one of the most significant contributors to the major performance gains in this version.

Full Temporal support

Version 1.8.0 brought support for Temporal in stringify; now the library is also able to emit Temporal objects instead of its own ad-hoc TomlDate object. It is not enabled by default, but it will become the default in v2. Enable by setting useLegacyDate: false in the parser's options.

Better Temporal support in stringify

Temporal support has been improved since it released: Temporal objects that cannot be represented (such as Temporal.PlainMonthDay) now throw an error (instead of silently emitting a bogus object).

A new option has been added to stringify to disallow Temporal objects that cannot be fully represented in TOML. This includes ZonedDateTime objects with a IANA timezone attached instead of a plain offset, and dates with a specific calendar value set. Enable by setting strictTemporal: true in the options.

Handling of unsafe keys

Since its release the library has been protected against prototype pollution attacks, setting properties like __proto__ using safe mechanisms that do not trigger prototype pollution. However, while the returned objects are safe on their own, they may become problematic if used carelessly.

Inspired by secure-json-parse, the library now offers a way to either drop unsafe properties from the returned object, or to throw an error and reject documents altogether. By default, these potentially unsafe keys are preserved and returned.

Miscellaneous updates

Unicode BOM is now gracefully accepted and ignored.

Table array headers are now properly checked again. Reported in #65.

Closed certain gaps where invalid whitespace would be accepted. Reported in #61.

Bogus local date and local time values with a UTC offset are no longer accepted.

Certain error messages are more accurate and handle errors at line boundaries better.

The default export of the lib is now formally deprecated; use a import * instead. Proposed in #50.

On Node 20+, strings that contain lone surrogates are now normalised to well-formed strings.

On Node 20+, keys that contain lone surrogates are now rejected.

Full Changelog: squirrelchat/smol-toml@v1.8.0...v1.9.0

Commits

6f9739a fix: gate [is|to]WellFormed (Node 18 compat)
a73ca32 fix: no Temporal with toml-test when Node < 26
7727890 chore: version bump
641903d chore: rewrite README.md
2df14c5 fix(types): make it work if Temporal doesn't exist
3eaa44e chore: update benchmark harness
cd3ba60 feat: safety option for dangerous properties
6746a7f perf: refactor TomlDate to avoid regex path
16fa64f chore: move benchmarks and test harness under 0BSD
bbd14b1 fix: correct sign for single-char numbers
Additional commits viewable in compare view

Updates brace-expansion from 1.1.18 to 1.1.21

Commits

714b622 2.1.7
bdff773 Merge commit from fork
5a5c07b 2.1.6
6463f2f update lockfile
1ba3c71 Merge commit from fork
aae3387 2.1.5
5171e68 Merge commit from fork
See full diff in compare view

Updates source-map-js from 1.2.1 to 1.2.2

Release notes

Sourced from source-map-js's releases.

v1.2.2

Fix crash when executing in browser with CSP script-src that don't permit unsafe-eval (#29) Description has been truncated

…ates Bumps the security group with 3 updates in the /templates/consultancy directory: [brace-expansion](https://github.com/juliangruber/brace-expansion), [devalue](https://github.com/sveltejs/devalue) and [source-map-js](https://github.com/7rulnik/source-map-js). Bumps the security group with 1 update in the /templates/console directory: [brace-expansion](https://github.com/juliangruber/brace-expansion). Bumps the security group with 5 updates in the /templates/compare directory: | Package | From | To | | --- | --- | --- | | [brace-expansion](https://github.com/juliangruber/brace-expansion) | `1.1.18` | `1.1.21` | | [devalue](https://github.com/sveltejs/devalue) | `5.9.2` | `5.9.4` | | [source-map-js](https://github.com/7rulnik/source-map-js) | `1.2.1` | `1.2.2` | | [http-cache-semantics](https://github.com/kornelski/http-cache-semantics) | `4.2.0` | `4.3.0` | | [smol-toml](https://github.com/squirrelchat/smol-toml) | `1.8.0` | `1.9.0` | Bumps the security group with 2 updates in the /templates/client-gallery directory: [brace-expansion](https://github.com/juliangruber/brace-expansion) and [source-map-js](https://github.com/7rulnik/source-map-js). Bumps the security group with 5 updates in the /templates/class-timetable directory: | Package | From | To | | --- | --- | --- | | [brace-expansion](https://github.com/juliangruber/brace-expansion) | `5.0.9` | `5.0.12` | | [devalue](https://github.com/sveltejs/devalue) | `5.9.2` | `5.9.4` | | [source-map-js](https://github.com/7rulnik/source-map-js) | `1.2.1` | `1.2.2` | | [http-cache-semantics](https://github.com/kornelski/http-cache-semantics) | `4.2.0` | `4.3.0` | | [smol-toml](https://github.com/squirrelchat/smol-toml) | `1.8.0` | `1.9.0` | Bumps the security group with 5 updates in the /templates/changelog directory: | Package | From | To | | --- | --- | --- | | [brace-expansion](https://github.com/juliangruber/brace-expansion) | `5.0.9` | `5.0.12` | | [devalue](https://github.com/sveltejs/devalue) | `5.9.2` | `5.9.4` | | [source-map-js](https://github.com/7rulnik/source-map-js) | `1.2.1` | `1.2.2` | | [http-cache-semantics](https://github.com/kornelski/http-cache-semantics) | `4.2.0` | `4.3.0` | | [smol-toml](https://github.com/squirrelchat/smol-toml) | `1.8.0` | `1.9.0` | Bumps the security group with 2 updates in the /templates/careers directory: [brace-expansion](https://github.com/juliangruber/brace-expansion) and [source-map-js](https://github.com/7rulnik/source-map-js). Bumps the security group with 2 updates in the /templates/callout directory: [brace-expansion](https://github.com/juliangruber/brace-expansion) and [source-map-js](https://github.com/7rulnik/source-map-js). Bumps the security group with 5 updates in the /templates/bakery-preorder directory: | Package | From | To | | --- | --- | --- | | [brace-expansion](https://github.com/juliangruber/brace-expansion) | `5.0.9` | `5.0.12` | | [devalue](https://github.com/sveltejs/devalue) | `5.9.2` | `5.9.4` | | [source-map-js](https://github.com/7rulnik/source-map-js) | `1.2.1` | `1.2.2` | | [http-cache-semantics](https://github.com/kornelski/http-cache-semantics) | `4.2.0` | `4.3.0` | | [smol-toml](https://github.com/squirrelchat/smol-toml) | `1.8.0` | `1.9.0` | Bumps the security group with 2 updates in the /templates/api-reference directory: [brace-expansion](https://github.com/juliangruber/brace-expansion) and [proxy-addr](https://github.com/jshttp/proxy-addr). Updates `brace-expansion` from 2.1.4 to 2.1.7 - [Release notes](https://github.com/juliangruber/brace-expansion/releases) - [Commits](juliangruber/brace-expansion@v2.1.4...v2.1.7) Updates `devalue` from 5.9.2 to 5.9.4 - [Release notes](https://github.com/sveltejs/devalue/releases) - [Changelog](https://github.com/sveltejs/devalue/blob/main/CHANGELOG.md) - [Commits](sveltejs/devalue@v5.9.2...v5.9.4) Updates `source-map-js` from 1.2.1 to 1.2.2 - [Release notes](https://github.com/7rulnik/source-map-js/releases) - [Changelog](https://github.com/7rulnik/source-map-js/blob/main/CHANGELOG.md) - [Commits](7rulnik/source-map-js@v1.2.1...v1.2.2) Updates `brace-expansion` from 1.1.18 to 1.1.21 - [Release notes](https://github.com/juliangruber/brace-expansion/releases) - [Commits](juliangruber/brace-expansion@v2.1.4...v2.1.7) Updates `brace-expansion` from 1.1.18 to 1.1.21 - [Release notes](https://github.com/juliangruber/brace-expansion/releases) - [Commits](juliangruber/brace-expansion@v2.1.4...v2.1.7) Updates `devalue` from 5.9.2 to 5.9.4 - [Release notes](https://github.com/sveltejs/devalue/releases) - [Changelog](https://github.com/sveltejs/devalue/blob/main/CHANGELOG.md) - [Commits](sveltejs/devalue@v5.9.2...v5.9.4) Updates `source-map-js` from 1.2.1 to 1.2.2 - [Release notes](https://github.com/7rulnik/source-map-js/releases) - [Changelog](https://github.com/7rulnik/source-map-js/blob/main/CHANGELOG.md) - [Commits](7rulnik/source-map-js@v1.2.1...v1.2.2) Updates `http-cache-semantics` from 4.2.0 to 4.3.0 - [Commits](https://github.com/kornelski/http-cache-semantics/commits) Updates `smol-toml` from 1.8.0 to 1.9.0 - [Release notes](https://github.com/squirrelchat/smol-toml/releases) - [Commits](squirrelchat/smol-toml@v1.8.0...v1.9.0) Updates `brace-expansion` from 5.0.9 to 5.0.12 - [Release notes](https://github.com/juliangruber/brace-expansion/releases) - [Commits](juliangruber/brace-expansion@v2.1.4...v2.1.7) Updates `source-map-js` from 1.2.1 to 1.2.2 - [Release notes](https://github.com/7rulnik/source-map-js/releases) - [Changelog](https://github.com/7rulnik/source-map-js/blob/main/CHANGELOG.md) - [Commits](7rulnik/source-map-js@v1.2.1...v1.2.2) Updates `brace-expansion` from 5.0.9 to 5.0.12 - [Release notes](https://github.com/juliangruber/brace-expansion/releases) - [Commits](juliangruber/brace-expansion@v2.1.4...v2.1.7) Updates `devalue` from 5.9.2 to 5.9.4 - [Release notes](https://github.com/sveltejs/devalue/releases) - [Changelog](https://github.com/sveltejs/devalue/blob/main/CHANGELOG.md) - [Commits](sveltejs/devalue@v5.9.2...v5.9.4) Updates `source-map-js` from 1.2.1 to 1.2.2 - [Release notes](https://github.com/7rulnik/source-map-js/releases) - [Changelog](https://github.com/7rulnik/source-map-js/blob/main/CHANGELOG.md) - [Commits](7rulnik/source-map-js@v1.2.1...v1.2.2) Updates `http-cache-semantics` from 4.2.0 to 4.3.0 - [Commits](https://github.com/kornelski/http-cache-semantics/commits) Updates `smol-toml` from 1.8.0 to 1.9.0 - [Release notes](https://github.com/squirrelchat/smol-toml/releases) - [Commits](squirrelchat/smol-toml@v1.8.0...v1.9.0) Updates `brace-expansion` from 5.0.9 to 5.0.12 - [Release notes](https://github.com/juliangruber/brace-expansion/releases) - [Commits](juliangruber/brace-expansion@v2.1.4...v2.1.7) Updates `devalue` from 5.9.2 to 5.9.4 - [Release notes](https://github.com/sveltejs/devalue/releases) - [Changelog](https://github.com/sveltejs/devalue/blob/main/CHANGELOG.md) - [Commits](sveltejs/devalue@v5.9.2...v5.9.4) Updates `source-map-js` from 1.2.1 to 1.2.2 - [Release notes](https://github.com/7rulnik/source-map-js/releases) - [Changelog](https://github.com/7rulnik/source-map-js/blob/main/CHANGELOG.md) - [Commits](7rulnik/source-map-js@v1.2.1...v1.2.2) Updates `http-cache-semantics` from 4.2.0 to 4.3.0 - [Commits](https://github.com/kornelski/http-cache-semantics/commits) Updates `smol-toml` from 1.8.0 to 1.9.0 - [Release notes](https://github.com/squirrelchat/smol-toml/releases) - [Commits](squirrelchat/smol-toml@v1.8.0...v1.9.0) Updates `brace-expansion` from 1.1.18 to 1.1.21 - [Release notes](https://github.com/juliangruber/brace-expansion/releases) - [Commits](juliangruber/brace-expansion@v2.1.4...v2.1.7) Updates `source-map-js` from 1.2.1 to 1.2.2 - [Release notes](https://github.com/7rulnik/source-map-js/releases) - [Changelog](https://github.com/7rulnik/source-map-js/blob/main/CHANGELOG.md) - [Commits](7rulnik/source-map-js@v1.2.1...v1.2.2) Updates `brace-expansion` from 5.0.9 to 5.0.12 - [Release notes](https://github.com/juliangruber/brace-expansion/releases) - [Commits](juliangruber/brace-expansion@v2.1.4...v2.1.7) Updates `source-map-js` from 1.2.1 to 1.2.2 - [Release notes](https://github.com/7rulnik/source-map-js/releases) - [Changelog](https://github.com/7rulnik/source-map-js/blob/main/CHANGELOG.md) - [Commits](7rulnik/source-map-js@v1.2.1...v1.2.2) Updates `brace-expansion` from 5.0.9 to 5.0.12 - [Release notes](https://github.com/juliangruber/brace-expansion/releases) - [Commits](juliangruber/brace-expansion@v2.1.4...v2.1.7) Updates `devalue` from 5.9.2 to 5.9.4 - [Release notes](https://github.com/sveltejs/devalue/releases) - [Changelog](https://github.com/sveltejs/devalue/blob/main/CHANGELOG.md) - [Commits](sveltejs/devalue@v5.9.2...v5.9.4) Updates `source-map-js` from 1.2.1 to 1.2.2 - [Release notes](https://github.com/7rulnik/source-map-js/releases) - [Changelog](https://github.com/7rulnik/source-map-js/blob/main/CHANGELOG.md) - [Commits](7rulnik/source-map-js@v1.2.1...v1.2.2) Updates `http-cache-semantics` from 4.2.0 to 4.3.0 - [Commits](https://github.com/kornelski/http-cache-semantics/commits) Updates `smol-toml` from 1.8.0 to 1.9.0 - [Release notes](https://github.com/squirrelchat/smol-toml/releases) - [Commits](squirrelchat/smol-toml@v1.8.0...v1.9.0) Updates `brace-expansion` from 5.0.9 to 5.0.12 - [Release notes](https://github.com/juliangruber/brace-expansion/releases) - [Commits](juliangruber/brace-expansion@v2.1.4...v2.1.7) Updates `proxy-addr` from 2.0.7 to 2.0.8 - [Release notes](https://github.com/jshttp/proxy-addr/releases) - [Changelog](https://github.com/jshttp/proxy-addr/blob/master/HISTORY.md) - [Commits](jshttp/proxy-addr@v2.0.7...v2.0.8) --- updated-dependencies: - dependency-name: brace-expansion dependency-version: 2.1.7 dependency-type: indirect dependency-group: security - dependency-name: devalue dependency-version: 5.9.4 dependency-type: indirect dependency-group: security - dependency-name: source-map-js dependency-version: 1.2.2 dependency-type: indirect dependency-group: security - dependency-name: brace-expansion dependency-version: 1.1.21 dependency-type: indirect dependency-group: security - dependency-name: brace-expansion dependency-version: 1.1.21 dependency-type: indirect dependency-group: security - dependency-name: devalue dependency-version: 5.9.4 dependency-type: indirect dependency-group: security - dependency-name: source-map-js dependency-version: 1.2.2 dependency-type: indirect dependency-group: security - dependency-name: http-cache-semantics dependency-version: 4.3.0 dependency-type: indirect dependency-group: security - dependency-name: smol-toml dependency-version: 1.9.0 dependency-type: indirect dependency-group: security - dependency-name: brace-expansion dependency-version: 5.0.12 dependency-type: indirect dependency-group: security - dependency-name: source-map-js dependency-version: 1.2.2 dependency-type: indirect dependency-group: security - dependency-name: brace-expansion dependency-version: 5.0.12 dependency-type: indirect dependency-group: security - dependency-name: devalue dependency-version: 5.9.4 dependency-type: indirect dependency-group: security - dependency-name: source-map-js dependency-version: 1.2.2 dependency-type: indirect dependency-group: security - dependency-name: http-cache-semantics dependency-version: 4.3.0 dependency-type: indirect dependency-group: security - dependency-name: smol-toml dependency-version: 1.9.0 dependency-type: indirect dependency-group: security - dependency-name: brace-expansion dependency-version: 5.0.12 dependency-type: indirect dependency-group: security - dependency-name: devalue dependency-version: 5.9.4 dependency-type: indirect dependency-group: security - dependency-name: source-map-js dependency-version: 1.2.2 dependency-type: indirect dependency-group: security - dependency-name: http-cache-semantics dependency-version: 4.3.0 dependency-type: indirect dependency-group: security - dependency-name: smol-toml dependency-version: 1.9.0 dependency-type: indirect dependency-group: security - dependency-name: brace-expansion dependency-version: 1.1.21 dependency-type: indirect dependency-group: security - dependency-name: source-map-js dependency-version: 1.2.2 dependency-type: indirect dependency-group: security - dependency-name: brace-expansion dependency-version: 5.0.12 dependency-type: indirect dependency-group: security - dependency-name: source-map-js dependency-version: 1.2.2 dependency-type: indirect dependency-group: security - dependency-name: brace-expansion dependency-version: 5.0.12 dependency-type: indirect dependency-group: security - dependency-name: devalue dependency-version: 5.9.4 dependency-type: indirect dependency-group: security - dependency-name: source-map-js dependency-version: 1.2.2 dependency-type: indirect dependency-group: security - dependency-name: http-cache-semantics dependency-version: 4.3.0 dependency-type: indirect dependency-group: security - dependency-name: smol-toml dependency-version: 1.9.0 dependency-type: indirect dependency-group: security - dependency-name: brace-expansion dependency-version: 5.0.12 dependency-type: indirect dependency-group: security - dependency-name: proxy-addr dependency-version: 2.0.8 dependency-type: indirect dependency-group: security ... Signed-off-by: dependabot[bot] <support@github.com>

github-actions · 2026-10-06T13:04:36Z

Template preview

Built each changed template, opened npm run preview, requested /, then compared Playwright screenshots to the committed catalog images (preview/<id>-thumbnail.png at 1440×900 and preview/<id>-homepage.png full page).

Template	Install	Lint	Build	Audit	Health	Thumbnail diff	Homepage diff
`api-reference`	✅	✅	✅	✅ 1 resolved	✅	2.3% ✅	1.6% ✅
`bakery-preorder`	✅	✅	✅	✅ 5 resolved	✅	1.0% ✅	1.0% ✅
`callout`	✅	✅	✅	✅	✅	1.2% ✅	1.1% ✅
`careers`	✅	✅	✅	✅	✅	0.8% ✅	1.1% ✅
`changelog`	✅	✅	✅	✅ 5 resolved	✅	5.8% ✅	9.7% ✅
`class-timetable`	✅	✅	✅	✅ 5 resolved	✅	1.9% ✅	1.6% ✅
`client-gallery`	✅	✅	✅	✅	✅	0.9% ✅	0.6% ✅
`compare`	✅	✅	✅	✅ 5 resolved	✅	2.9% ✅	2.1% ✅
`console`	✅	✅	✅	✅	✅	2.2% ✅	2.2% ✅
`consultancy`	✅	✅	✅	✅ 6 pre-existing, 6 resolved	✅	1.2% ✅	0.9% ✅

`api-reference`

Expected thumbnail	Actual	Diff

`bakery-preorder`

Expected thumbnail	Actual	Diff

`callout`

Expected thumbnail	Actual	Diff

`careers`

Expected thumbnail	Actual	Diff

`changelog`

Expected thumbnail	Actual	Diff

`class-timetable`

Expected thumbnail	Actual	Diff

`client-gallery`

Expected thumbnail	Actual	Diff

`compare`

Expected thumbnail	Actual	Diff

`console`

Expected thumbnail	Actual	Diff

`consultancy`

Expected thumbnail	Actual	Diff

Download screenshots and diffs from this run’s visual-<template> artifacts.

This check fails if install, lint, build, / health, or screenshot diff over the limit fails, or if the PR introduces a high/critical advisory in production dependencies that the base commit did not have (npm audit --omit=dev, head vs base). Pre-existing advisories are listed for information and belong to dependency-update PRs. Limits default to 25% (thumbnail) and 30% (homepage) to absorb Mac-vs-Linux font rasterization.

dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Oct 6, 2026

hostingerbot Bot approved these changes Oct 6, 2026

View reviewed changes

hostingerbot Bot enabled auto-merge (squash) October 6, 2026 13:05

hostingerbot Bot merged commit 68e46be into main Oct 6, 2026
14 checks passed

hostingerbot Bot deleted the dependabot/npm_and_yarn/templates/consultancy/security-1924aa74cc branch October 6, 2026 13:06

Navigation Menu

Repository navigation

chore(deps): bump the security group across 10 directories with 6 updates - #38

chore(deps): bump the security group across 10 directories with 6 updates#38
hostingerbot[bot] merged 1 commit into
mainfrom
dependabot/npm_and_yarn/templates/consultancy/security-1924aa74cc

dependabot Bot commented on behalf of github Oct 6, 2026

Uh oh!

github-actions Bot commented Oct 6, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

dependabot Bot commented on behalf of github Oct 6, 2026

v5.9.4

Patch Changes

v5.9.3

Patch Changes

5.9.4

Patch Changes

5.9.3

Patch Changes

v1.2.2

1.2.2

v5.9.4

Patch Changes

v5.9.3

Patch Changes

5.9.4

Patch Changes

5.9.3

Patch Changes

v1.2.2

1.2.2

v1.9.0

Performance improvements

Full Temporal support

Better Temporal support in stringify

Handling of unsafe keys

Miscellaneous updates

v1.2.2

1.2.2

v5.9.4

Patch Changes

v5.9.3

Patch Changes

5.9.4

Patch Changes

5.9.3

Patch Changes

v1.2.2

1.2.2

v1.9.0

Performance improvements

Full Temporal support

Better Temporal support in stringify

Handling of unsafe keys

Miscellaneous updates

v5.9.4

Patch Changes

v5.9.3

Patch Changes

5.9.4

Patch Changes

5.9.3

Patch Changes

v1.2.2

1.2.2

v1.9.0

Performance improvements

Full Temporal support

Better Temporal support in stringify

Handling of unsafe keys

Miscellaneous updates

v1.2.2

Uh oh!

github-actions Bot commented Oct 6, 2026

Template preview

api-reference

bakery-preorder

callout

careers

changelog

class-timetable

client-gallery

compare

console

consultancy

Uh oh!

Uh oh!

Reviewers

Assignees

`api-reference`

`bakery-preorder`

`callout`

`careers`

`changelog`

`class-timetable`

`client-gallery`

`compare`

`console`

`consultancy`