chore(deps): bump smol-toml and markdownlint-cli

[dependabot]

Bumps smol-toml to 1.7.2 and updates ancestor dependency markdownlint-cli. These dependencies need to be updated together.

Updates smol-toml from 1.5.2 to 1.7.2

Release notes

Sourced from smol-toml's releases.

v1.7.2

What's Changed

• refactor: improve performance of the parser by @​cyyynthia
• chore: revert sourcemap publishing by @​cyyynthia

Full Changelog: squirrelchat/smol-toml@v1.7.1...v1.7.2

v1.7.1

This release includes flagging internal functions as @internal to strip them from the emitted type declarations.

⚠️ Includes a fix for GHSA-7w5x-hrqm-74c2

Full Changelog: squirrelchat/smol-toml@v1.7.0...v1.7.1

v1.7.0

This version slightly changes the behaviour of stringify: integers beyond the safe range are always emitted as float numbers.

String decode logic has been rewritten, it is a bit faster now and uses a single-pass approach instead of a dual-pass approach as it did previously. The code should be a bit smaller too, though I didn't actually measure that.

The package is now published with source-maps, declaration-maps, and a copy of the original TypeScript source files. This will improve your DX if you're like me and like Ctrl+Click'ing things a lot. ;)

What's Changed

• improve performance of the string decode logic by @​cyyynthia
• fix(stringify): emit integer-valued numbers beyond the safe-integer range as floats by @​spokodev in squirrelchat/smol-toml#56
• publish source-maps, declaration-maps, and original source files by @​cyyynthia
• miscellaneous repository maintenance tasks by @​cyyynthia

New Contributors

• @​spokodev made their first contribution in squirrelchat/smol-toml#56

Full Changelog: squirrelchat/smol-toml@v1.6.1...v1.7.0

v1.6.1

This release addresses a minor security vulnerability where an attacker-controlled TOML document can exploit an unrestricted recustion and cause a stack overflow error with a document that contains thousands of sucessive commented lines. Security advisory: GHSA-v3rj-xjv7-4jmq

v1.6.0

As of this version, smol-toml now supports the newly released TOML 1.1.0 specification!

Highlights

Multiline inline tables

TOML 1.1.0 now allows inline tables to have newlines, as well as trailing commas.

database = {
  driver = "postgresql",
  server = {
    host = "127.0.0.1",
    port = 3307,
  },
}
</tr></table> 

... (truncated)

Commits

• 19239d0 chore: bump version
• 5f55c3a chore: revert sourcemap publishing
• 5c26f1b chore: update benchmarks
• 92832d2 refactor: better logic orchestration in structs
• 2fb9ab8 refactor: ctx object instead of pointer arg + tuple returns
• e6017c4 ci: use staged publish
• 3e978a9 chore: bump versions
• 30f5c36 chore: add some @internal annotations
• f0e0399 chore(README.md): npmx, use star import
• a62f06f revert: keep using vite 7
• Additional commits viewable in compare view

Updates markdownlint-cli from 0.47.0 to 0.49.1

Release notes

Sourced from markdownlint-cli's releases.

v0.49.1

• Update markdownlint dependency to 0.41.1
  • Improve MD029
  • Fix module resolution under webpack
  • Update dependencies
• Update all dependencies via Dependabot

v0.49.0

• Update markdownlint dependency to 0.41.0
  • Improve MD022/MD028/MD035/MD042/MD051/MD060
  • Remove handling of inline directive syntax (frequent false positives)
  • Remove support for end-of-life Node version 20
• Update all dependencies via Dependabot

v0.48.0

• Update all dependencies via Dependabot

Commits

• 5b5dddc Bump version 0.49.1
• 4e83bdd Bump run-con from 1.3.2 to 1.3.3
• 4f2127b Bump actions/setup-node from 6 to 7
• cc62492 Manually address new violations reported by xo.
• 678b7ee Bump xo from 3.0.2 to 4.0.0
• 06602e9 Bump ignore from 7.0.5 to 7.0.6
• eac32dd Bump markdownlint from 0.41.0 to 0.41.1
• 2864eb0 Bump js-yaml from 5.2.0 to 5.2.1
• 2748661 Bump markdown-it from 14.2.0 to 14.3.0
• 0144ebe Manually address new violations reported by xo.
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.

---

Summary by cubic

Bumps smol-toml to 1.7.2 and markdownlint-cli to 0.49.1. smol-toml adds TOML 1.1.0 support, a faster parser, and fixes two security advisories; markdownlint-cli improves several lint rules and removes inline directive handling that caused false positives.

Migration

• markdownlint-cli 0.49.1 requires Node 22+, but the project's package.json still declares "node": ">=18".
• smol-toml stringify now always emits integers beyond the safe range as float numbers.

^{Written for commit 161e68a. Summary will update on new commits.}

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Advanced

Run ID: ac41e9d4-001a-435d-b69d-e342b892afee

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

_{Comment @coderabbitai help to get the list of available commands.}

[neocody]

@codex review

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-09-11T00:47:19.476688Z	161e68a	Manual request

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 161e68a21a

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Keep markdownlint within the supported Node range

When contributors install development dependencies on Node 20—which remains supported by engines and is used by the checked .github/workflows/ci.yml lint job—this upgrade is incompatible because markdownlint-cli@0.49.1 and markdownlint@0.41.1 require Node 22 or newer. Reproducing with Node 20.20.2 and npm ci --ignore-scripts --engine-strict exits with EBADENGINE, while non-strict installs leave the lint job invoking an unsupported CLI. Retain a Node-20-compatible release or update the package engine and CI runtimes together.

Useful? React with 👍 / 👎.

[neocody]

Verdict: no blocking findings, but this PR touches a sensitive area - a human-approved session must merge it.

Automated Claude Code review (Opus, high effort, fresh context, PR head checked out with repo tools) posted by pr-shepherd because this PR looked stuck: open >1h with green CI and no recent reviewer activity.

Non-blocking findings:

• MINOR | package.json:95 | engines.node: ">=18" is now inconsistent with the dev toolchain, which requires Node >=22 (markdownlint-cli 0.49.1, markdownlint 0.41.1) and >=22.12.0 (commander 15.0.0), while CI still builds on Node 18.x/20.x. | A contributor (or CI job) with engine-strict=true in .npmrc on Node 18 or 20 gets npm error code EBADENGINE ... commander@15.0.0 Required: {"node":">=22.12.0"} and the install aborts — reproduced locally against Node 20.20.2; the stale comment at .github/workflows/ci.yml:123 also now understates the gap, since --ignore-engines is needed for Node 20 too, not just Node 18.

escalated: needs a human-approved session (reason: body mentions 'migration')