fix(deps): upgrade toml to 4.2.0

[snyk-io]

Snyk has created this PR to fix 2 vulnerabilities in the npm dependencies of this project.

Snyk changed the following file(s):

• packages/snyk-fix/package.json

Vulnerabilities that will be fixed with an upgrade:

	Issue	Score
	Prototype Pollution SNYK-JS-TOML-19639693	715
	Uncontrolled Recursion SNYK-JS-TOML-19639695	710

Breaking Change Risk

Notice: This assessment is enhanced by AI.

---

Important

• Check the changes in this PR to ensure they won't cause issues with your project.
• Max score is 1000. Note that the real score may have changed since the PR was raised.
• This PR was automatically created by Snyk using the credentials of a real user.

---

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report
📜 Customise PR templates
🛠 Adjust project settings
📚 Read about Snyk's upgrade logic

---

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Prototype Pollution
🦉 Uncontrolled Recursion

---

Note

Medium Risk
Major-version parser upgrade on the Poetry fix path; behavior should be validated against existing Poetry/pyproject.toml fixtures even though usage is limited to parse().

Overview
Bumps the toml dependency in @snyk/fix from 3.0.0 to 4.2.0 to address two high-severity issues (prototype pollution and uncontrolled recursion).

The library is only used in the Poetry fix path (generate-upgrades.ts) via toml.parse() on pyproject.toml contents. No application code changes are included—only the version pin in package.json.

^{Reviewed by Cursor Bugbot for commit fbf0cb5. Bugbot is set up for automated code reviews on this repo. Configure here.}

[snyk-io]

This major version upgrade of the toml parser introduces significant changes, including a critical security fix and new behavior for handling large integers.

Key Breaking Changes:

• Integer Handling: By default, the parser will now throw an error when encountering integers that cannot be safely represented by JavaScript's number type (i.e., those outside the Number.MAX_SAFE_INTEGER range). Previously, these might have been parsed with a loss of precision. To handle these large numbers, you must now explicitly use the { bigint: true } option in toml.parse().

• Security Fix (Denial of Service): Version 4.2.0 fixes CVE-2026-77465. Versions prior to 4.2.0 were vulnerable to a crash via uncontrolled recursion when parsing deeply nested arrays or tables. The fix introduces a nesting depth limit. While this prevents a security vulnerability, it means that TOML files with extreme nesting that may have parsed before will now throw an error.

Recommendation:

• Review Integer Usage: If your application processes TOML files that may contain integer IDs or values larger than 2⁵³ − 1, you must update your toml.parse() calls to include the bigint: true option to prevent runtime errors.
• Acknowledge Security Fix: This upgrade is essential to patch a high-severity Denial of Service vulnerability. The new nesting depth limit is unlikely to affect most legitimate use cases.

Notice 🤖: This content was augmented using artificial intelligence. AI-generated content may contain errors and should be reviewed for accuracy before use.

[snyk-io]

✅ Snyk checks have passed. No issues have been found so far.

Status	Scan Engine	Critical	High	Medium	Low	Total (0)
✅	Open Source Security	0	0	0	0	0 issues
✅	Licenses	0	0	0	0	0 issues
✅	Code Security	0	0	0	0	0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.