Merge pull request #863 from kaoru0822-kitauji/fix/smol-toml-advisory

fix(deps): remediate smol-toml advisories

package-lock.json

@@ -31,7 +31,7 @@
         "playwright-core": "1.58.2",
         "plist": "5.0.0",
         "semver": "7.8.5",
-        "smol-toml": "1.7.0",
+        "smol-toml": "1.9.0",
         "write-file-atomic": "7.0.0",
         "ws": "8.21.0",
         "zod": "4.4.3"
@@ -3892,19 +3892,6 @@
         "node": "^20.19.0 || >=22.12.0"
       }
     },
-    "node_modules/knip/node_modules/smol-toml": {
-      "version": "1.9.0",
-      "resolved": "https://registry.npmjs.org/smol-toml/-/smol-toml-1.9.0.tgz",
-      "integrity": "sha512-hpd+HLON7HdZXqYchMM/+LaTTbdK0AU3NngIJ4KVyWbY9bfQqdL9cD+4yf6dUoU2Ap4VsU0JkQi6FxAI1B2mXQ==",
-      "dev": true,
-      "license": "BSD-3-Clause",
-      "engines": {
-        "node": ">= 18"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/cyyynthia"
-      }
-    },
     "node_modules/knip/node_modules/yaml": {
       "version": "2.9.1",
       "resolved": "https://registry.npmjs.org/yaml/-/yaml-2.9.1.tgz",
@@ -5196,9 +5183,9 @@
       }
     },
     "node_modules/smol-toml": {
-      "version": "1.7.0",
-      "resolved": "https://registry.npmjs.org/smol-toml/-/smol-toml-1.7.0.tgz",
-      "integrity": "sha512-aqVvWoyO21L23mb+drl4RmMXbf6N7FdHjAhTRA9ZBL7apWBgfWC16KjrASI+1p9GAroljyMHj6fK67i0UiTNvQ==",
+      "version": "1.9.0",
+      "resolved": "https://registry.npmjs.org/smol-toml/-/smol-toml-1.9.0.tgz",
+      "integrity": "sha512-hpd+HLON7HdZXqYchMM/+LaTTbdK0AU3NngIJ4KVyWbY9bfQqdL9cD+4yf6dUoU2Ap4VsU0JkQi6FxAI1B2mXQ==",
       "license": "BSD-3-Clause",
       "engines": {
         "node": ">= 18"

package.json

@@ -211,7 +211,7 @@
     "playwright-core": "1.58.2",
     "plist": "5.0.0",
     "semver": "7.8.5",
-    "smol-toml": "1.7.0",
+    "smol-toml": "1.9.0",
     "write-file-atomic": "7.0.0",
     "ws": "8.21.0",
     "zod": "4.4.3"

src/application/ClientConfigurationDocument.test.ts

@@ -92,14 +92,11 @@ describe.each([
 });
 
 describe("TOML client configuration BOM handling", () => {
-  it("retains the TOML parser's existing leading-BOM rejection", () => {
+  it.each(["", "\uFEFF"])("parses a document with prefix %j", (bom) => {
     const text = '[mcp_servers.rea]\ncommand = "rea"\n';
 
-    expect(parseClientConfiguration(text, "toml").servers).toEqual({
+    expect(parseClientConfiguration(`${bom}${text}`, "toml").servers).toEqual({
       rea: { command: "rea" },
     });
-    expect(() => parseClientConfiguration(`\uFEFF${text}`, "toml")).toThrow(
-      "Invalid TOML document",
-    );
   });
 });