build(deps): bump smol-toml, @nx/jest, @nx/js and nx by dependabot[bot] · Pull Request #1664 · data-driven-forms/react-forms

dependabot · 2026-10-19T07:21:03Z

Bumps smol-toml to 1.9.0 and updates ancestor dependencies smol-toml, @nx/jest, @nx/js and nx. These dependencies need to be updated together.

Updates smol-toml from 1.6.1 to 1.9.0

Release notes

Sourced from smol-toml's releases.

v1.9.0

Huge update!!! This is most likely the largest update the library received since its release, with lots of new features and improvements.

Performance improvements

Significant parts of the internal parse logic have been rewritten, improving performance by 1.5x-2x. The library was already comfortably ahead of the others, but it is now faster than ever, sitting at 4x faster parse performance than the closest maintained implementation.

Problematic code paths have also been replaced by safer implementations, solving potential DoS vectors. See GHSA-r4xh-jqrq-34v2.

Note: the objects returned by the library now have a null prototype. This is a transparent change for 99.9% of users, and is one of the most significant contributors to the major performance gains in this version.

Full Temporal support

Version 1.8.0 brought support for Temporal in stringify; now the library is also able to emit Temporal objects instead of its own ad-hoc TomlDate object. It is not enabled by default, but it will become the default in v2. Enable by setting useLegacyDate: false in the parser's options.

Better Temporal support in stringify

Temporal support has been improved since it released: Temporal objects that cannot be represented (such as Temporal.PlainMonthDay) now throw an error (instead of silently emitting a bogus object).

A new option has been added to stringify to disallow Temporal objects that cannot be fully represented in TOML. This includes ZonedDateTime objects with a IANA timezone attached instead of a plain offset, and dates with a specific calendar value set. Enable by setting strictTemporal: true in the options.

Handling of unsafe keys

Since its release the library has been protected against prototype pollution attacks, setting properties like __proto__ using safe mechanisms that do not trigger prototype pollution. However, while the returned objects are safe on their own, they may become problematic if used carelessly.

Inspired by secure-json-parse, the library now offers a way to either drop unsafe properties from the returned object, or to throw an error and reject documents altogether. By default, these potentially unsafe keys are preserved and returned.

Miscellaneous updates

Unicode BOM is now gracefully accepted and ignored.

Table array headers are now properly checked again. Reported in #65.

Closed certain gaps where invalid whitespace would be accepted. Reported in #61.

Bogus local date and local time values with a UTC offset are no longer accepted.

Certain error messages are more accurate and handle errors at line boundaries better.

The default export of the lib is now formally deprecated; use a import * instead. Proposed in #50.

On Node 20+, strings that contain lone surrogates are now normalised to well-formed strings.

On Node 20+, keys that contain lone surrogates are now rejected.

Full Changelog: squirrelchat/smol-toml@v1.8.0...v1.9.0

v1.8.0

What's Changed

feat: stringify temporal objects by @Gouvernathor and @cyyynthia

Full Changelog: squirrelchat/smol-toml@v1.7.2...v1.8.0

v1.7.2

What's Changed

refactor: improve performance of the parser by @cyyynthia

chore: revert sourcemap publishing by @cyyynthia

... (truncated)

Commits

6f9739a fix: gate [is|to]WellFormed (Node 18 compat)
a73ca32 fix: no Temporal with toml-test when Node < 26
7727890 chore: version bump
641903d chore: rewrite README.md
2df14c5 fix(types): make it work if Temporal doesn't exist
3eaa44e chore: update benchmark harness
cd3ba60 feat: safety option for dangerous properties
6746a7f perf: refactor TomlDate to avoid regex path
16fa64f chore: move benchmarks and test harness under 0BSD
bbd14b1 fix: correct sign for single-char numbers
Additional commits viewable in compare view

Updates @nx/jest from 22.7.12 to 23.3.0

Release notes

Sourced from @nx/jest's releases.

23.3.0 (2026-10-07)

🚀 Features

angular: support ngrx v22 (#36950)

angular-rspack: scaffold and run SSR apps on the @angular/ssr application engine (#36298)

core: emit a runbook and per-step instructions for orchestrated migrate runs (#36766)

core: report the cache location alongside usage (#36959)

core: share one workspace walk across processes through the files archive (#36980)

core: hash a continuous dependency's inputs into the task it serves (#37017)

core: guarantee terminal output files and add an agent-friendly summary output style (#36703)

core: add includeIgnored filesets and let the workspace context own the daemon's watch (#37025)

core: cache plugin capabilities so reading them costs at most one load (#36999)

core: spawn one agent session for orchestrated migrate runs and land its installs and commits (#36918)

core: add sandbox target configuration for observed-IO opt-out (#36853)

core: hash tasks from Nx Cloud I/O snapshots (#37036)

core: replace the sandbox target property with ultracache (#37165)

core: opt in to selecting affected tasks instead of projects (#36825)

core: record unresolved migrations and cap retries in orchestrated migrate runs (#36986)

core: report an active orchestrated migrate run instead of resuming it (#36988)

core: report abandoned, revisited and resumed orchestrated migrate runs and their dispense ordinals (#36989)

core: turn ultracache on with NX_CLOUD_USE_ULTRACACHE (#37242)

core: explain why each task is affected with --explain (#36885)

core: run a final agent validation pass at the end of an orchestrated migrate run (#37069)

js: cache TypeScript reference expansion during createNodes (#37003, #37002)

linter: add a batched @nx/oxlint:lint executor (#36827)

nx-cloud: add nx cloud demo link to cloud prompts (#36956)

nx-cloud: remove the never option from the nx cloud prompt (#37079)

repo: add a .NET example for @nx/dotnet (#36701)

testing: support cypress v16 (#36953)

vitest: support vitest 5 (#37142)

🩹 Fixes

angular: correct declaration maps and exports of buildable libraries (#36373, #36357)

angular-rspack: keep incremental rebuild state warm when skipTypeChecking is enabled (#36972, #36970)

angular-rspack: keep class field closures per instance in minified builds (#37066, #37050)

angular-rspack: update piscina to address critical vulnerability (#37252)

bundling: write the esbuild bundle to an overridden outputPath (#37101, #37091)

bundling: clear typescript update timer when a rollup build closes its watch program (#37196)

core: separate daemon runtime env from graph identity (#36565, #36564)

core: validate the migrations path before extracting package migrations (#36887)

core: release per-run process listeners and task history results (#36866)

core: read the pnpm 12 min-release-age policy instead of deferring to an install (#36915, #36914)

core: carry minimumReleaseAge into pruned pnpm deploy output (#36900, #36899)

core: report how a plugin worker was lost instead of always calling it an exit (#36894)

core: keep the cache in the workspace on CI (#36922)

core: restore the wasm walker imports dropped by a stray cfg attribute (#36924)

core: avoid mutating target options when resolving configurations (#36934)

core: carry pnpm's package-manager document into the pruned lockfile (#36947)

... (truncated)

Commits

1361436 fix(core): make glob escapes work the same on every platform (#37215)
e9164e1 fix(testing): resolve coverageDirectory like jest and emit forward-slash outp...
e90cfdf fix(misc): record pnpm 11 build script decisions in generators (#36814)
f61bd09 fix(core): single-inference convert-to-inferred engine with centralized confi...
968f568 chore(linter): move the eslint import rules to oxlint (#36733)
3da0623 feat(core): add built-in support for oxfmt formatter alongside prettier (#35089)
bc454cf feat(linter): add the @nx/oxlint plugin (#36491)
ee0bc60 fix(misc): move plugin internal imports to devkit/internal (#36430)
1ad2f96 docs(nx-dev): render migration docs from the documentation key (#36377)
b13ce9e fix(testing): add @swc/core when configuring jest with the swc compiler (#36409)
Additional commits viewable in compare view

Updates @nx/js from 22.7.12 to 23.3.0

Release notes

Sourced from @nx/js's releases.

23.3.0 (2026-10-07)

🚀 Features

angular: support ngrx v22 (#36950)

angular-rspack: scaffold and run SSR apps on the @angular/ssr application engine (#36298)

core: emit a runbook and per-step instructions for orchestrated migrate runs (#36766)

core: report the cache location alongside usage (#36959)

core: share one workspace walk across processes through the files archive (#36980)

core: hash a continuous dependency's inputs into the task it serves (#37017)

core: guarantee terminal output files and add an agent-friendly summary output style (#36703)

core: add includeIgnored filesets and let the workspace context own the daemon's watch (#37025)

core: cache plugin capabilities so reading them costs at most one load (#36999)

core: spawn one agent session for orchestrated migrate runs and land its installs and commits (#36918)

core: add sandbox target configuration for observed-IO opt-out (#36853)

core: hash tasks from Nx Cloud I/O snapshots (#37036)

core: replace the sandbox target property with ultracache (#37165)

core: opt in to selecting affected tasks instead of projects (#36825)

core: record unresolved migrations and cap retries in orchestrated migrate runs (#36986)

core: report an active orchestrated migrate run instead of resuming it (#36988)

core: report abandoned, revisited and resumed orchestrated migrate runs and their dispense ordinals (#36989)

core: turn ultracache on with NX_CLOUD_USE_ULTRACACHE (#37242)

core: explain why each task is affected with --explain (#36885)

core: run a final agent validation pass at the end of an orchestrated migrate run (#37069)

js: cache TypeScript reference expansion during createNodes (#37003, #37002)

linter: add a batched @nx/oxlint:lint executor (#36827)

nx-cloud: add nx cloud demo link to cloud prompts (#36956)

nx-cloud: remove the never option from the nx cloud prompt (#37079)

repo: add a .NET example for @nx/dotnet (#36701)

testing: support cypress v16 (#36953)

vitest: support vitest 5 (#37142)

🩹 Fixes

angular: correct declaration maps and exports of buildable libraries (#36373, #36357)

angular-rspack: keep incremental rebuild state warm when skipTypeChecking is enabled (#36972, #36970)

angular-rspack: keep class field closures per instance in minified builds (#37066, #37050)

angular-rspack: update piscina to address critical vulnerability (#37252)

bundling: write the esbuild bundle to an overridden outputPath (#37101, #37091)

bundling: clear typescript update timer when a rollup build closes its watch program (#37196)

core: separate daemon runtime env from graph identity (#36565, #36564)

core: validate the migrations path before extracting package migrations (#36887)

core: release per-run process listeners and task history results (#36866)

core: read the pnpm 12 min-release-age policy instead of deferring to an install (#36915, #36914)

core: carry minimumReleaseAge into pruned pnpm deploy output (#36900, #36899)

core: report how a plugin worker was lost instead of always calling it an exit (#36894)

core: keep the cache in the workspace on CI (#36922)

core: restore the wasm walker imports dropped by a stray cfg attribute (#36924)

core: avoid mutating target options when resolving configurations (#36934)

core: carry pnpm's package-manager document into the pruned lockfile (#36947)

... (truncated)

Commits

1d08795 fix(release): preserve private dev-only workspace dependencies (#37193)
c047e8e chore(js): run js unit tests with vitest (#37171)
8f54a68 fix(js): keep internal tsconfig project references on Windows (#37058)
69b4876 fix(js): export NodeExecutorOptions from @nx/js/executors (#37143)
e90cfdf fix(misc): record pnpm 11 build script decisions in generators (#36814)
8889d69 fix(release): optimize publish metadata query for JS projects (#37013)
3a3686f fix(js): handle empty npm view output in release-publish executor (#36397)
1b96d56 feat(js): cache TypeScript reference expansion during createNodes (#37003)
66aa402 fix(js): resolve tsconfig to absolute path so ${configDir} paths type-check w...
30e1972 fix(nextjs): respect the src option when setting sourceRoot in the applicatio...
Additional commits viewable in compare view

Updates nx from 23.2.1 to 23.3.0

Release notes

Sourced from nx's releases.

23.3.0 (2026-10-07)

🚀 Features

angular: support ngrx v22 (#36950)

angular-rspack: scaffold and run SSR apps on the @angular/ssr application engine (#36298)

core: emit a runbook and per-step instructions for orchestrated migrate runs (#36766)

core: report the cache location alongside usage (#36959)

core: share one workspace walk across processes through the files archive (#36980)

core: hash a continuous dependency's inputs into the task it serves (#37017)

core: guarantee terminal output files and add an agent-friendly summary output style (#36703)

core: add includeIgnored filesets and let the workspace context own the daemon's watch (#37025)

core: cache plugin capabilities so reading them costs at most one load (#36999)

core: spawn one agent session for orchestrated migrate runs and land its installs and commits (#36918)

core: add sandbox target configuration for observed-IO opt-out (#36853)

core: hash tasks from Nx Cloud I/O snapshots (#37036)

core: replace the sandbox target property with ultracache (#37165)

core: opt in to selecting affected tasks instead of projects (#36825)

core: record unresolved migrations and cap retries in orchestrated migrate runs (#36986)

core: report an active orchestrated migrate run instead of resuming it (#36988)

core: report abandoned, revisited and resumed orchestrated migrate runs and their dispense ordinals (#36989)

core: turn ultracache on with NX_CLOUD_USE_ULTRACACHE (#37242)

core: explain why each task is affected with --explain (#36885)

core: run a final agent validation pass at the end of an orchestrated migrate run (#37069)

js: cache TypeScript reference expansion during createNodes (#37003, #37002)

linter: add a batched @nx/oxlint:lint executor (#36827)

nx-cloud: add nx cloud demo link to cloud prompts (#36956)

nx-cloud: remove the never option from the nx cloud prompt (#37079)

repo: add a .NET example for @nx/dotnet (#36701)

testing: support cypress v16 (#36953)

vitest: support vitest 5 (#37142)

🩹 Fixes

angular: correct declaration maps and exports of buildable libraries (#36373, #36357)

angular-rspack: keep incremental rebuild state warm when skipTypeChecking is enabled (#36972, #36970)

angular-rspack: keep class field closures per instance in minified builds (#37066, #37050)

angular-rspack: update piscina to address critical vulnerability (#37252)

bundling: write the esbuild bundle to an overridden outputPath (#37101, #37091)

bundling: clear typescript update timer when a rollup build closes its watch program (#37196)

core: separate daemon runtime env from graph identity (#36565, #36564)

core: validate the migrations path before extracting package migrations (#36887)

core: release per-run process listeners and task history results (#36866)

core: read the pnpm 12 min-release-age policy instead of deferring to an install (#36915, #36914)

core: carry minimumReleaseAge into pruned pnpm deploy output (#36900, #36899)

core: report how a plugin worker was lost instead of always calling it an exit (#36894)

core: keep the cache in the workspace on CI (#36922)

core: restore the wasm walker imports dropped by a stray cfg attribute (#36924)

core: avoid mutating target options when resolving configurations (#36934)

core: carry pnpm's package-manager document into the pruned lockfile (#36947)

... (truncated)

Commits

2b305ee fix(core): accept --final-validation with a migrate CLI pinned below 23.2.0 (...
d133deb fix(core): size the default cache bound from its own filesystem (#37269)
cd1ea02 fix(core): reuse the stored ultracache configurations without an age limit (#...
e09f772 fix(core): stop merging declared negations into ultracache file groups (#37304)
a0dc568 chore(core): update smol-toml to 1.9.0 for GHSA-r4xh-jqrq-34v2 (#37293)
a26644b fix(core): answer daemon output tracking from the workspace context (#37217)
3ec060f fix(core): keep ultracache exclusions with the globs they trim (#37285)
af0b4fb feat(core): run a final agent validation pass at the end of an orchestrated m...
ead0427 fix(core): skip batch cache lookups for deferred tasks until their deps run (...
da9d339 feat(core): explain why each task is affected with --explain (#36885)
Additional commits viewable in compare view

vercel · 2026-10-19T07:21:05Z

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
react-forms	Ready	Preview	Oct 21, 2026 7:50am UTC

Bumps [smol-toml](https://github.com/squirrelchat/smol-toml) to 1.9.0 and updates ancestor dependencies [smol-toml](https://github.com/squirrelchat/smol-toml), [@nx/jest](https://github.com/nrwl/nx/tree/HEAD/packages/jest), [@nx/js](https://github.com/nrwl/nx/tree/HEAD/packages/js) and [nx](https://github.com/nrwl/nx/tree/HEAD/packages/nx). These dependencies need to be updated together. Updates `smol-toml` from 1.6.1 to 1.9.0 - [Release notes](https://github.com/squirrelchat/smol-toml/releases) - [Commits](squirrelchat/smol-toml@v1.6.1...v1.9.0) Updates `@nx/jest` from 22.7.12 to 23.3.0 - [Release notes](https://github.com/nrwl/nx/releases) - [Commits](https://github.com/nrwl/nx/commits/23.3.0/packages/jest) Updates `@nx/js` from 22.7.12 to 23.3.0 - [Release notes](https://github.com/nrwl/nx/releases) - [Commits](https://github.com/nrwl/nx/commits/23.3.0/packages/js) Updates `nx` from 23.2.1 to 23.3.0 - [Release notes](https://github.com/nrwl/nx/releases) - [Commits](https://github.com/nrwl/nx/commits/23.3.0/packages/nx) --- updated-dependencies: - dependency-name: "@nx/jest" dependency-version: 23.3.0 dependency-type: direct:development - dependency-name: "@nx/js" dependency-version: 23.3.0 dependency-type: direct:development - dependency-name: nx dependency-version: 23.3.0 dependency-type: direct:development - dependency-name: smol-toml dependency-version: 1.9.0 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot Bot added dependencies Dependency PR javascript Pull requests that update javascript code labels Oct 19, 2026

dependabot Bot mentioned this pull request Oct 19, 2026

build(deps-dev): bump nx from 23.1.1 to 23.2.1 #1650

Closed

dependabot Bot force-pushed the dependabot/npm_and_yarn/multi-6a30d1ef1d branch from 9529c78 to f2444ea Compare October 19, 2026 07:25

vercel Bot deployed to Preview October 19, 2026 08:15

View deployment

dependabot Bot force-pushed the dependabot/npm_and_yarn/multi-6a30d1ef1d branch from f2444ea to 95f106d Compare October 19, 2026 09:08

vercel Bot deployed to Preview October 19, 2026 09:25

View deployment

dependabot Bot force-pushed the dependabot/npm_and_yarn/multi-6a30d1ef1d branch 2 times, most recently from 50447e3 to 0e11fa9 Compare October 19, 2026 09:44

vercel Bot deployed to Preview October 19, 2026 09:55

View deployment

dependabot Bot force-pushed the dependabot/npm_and_yarn/multi-6a30d1ef1d branch 2 times, most recently from 094830a to 9cf5950 Compare October 19, 2026 10:30

vercel Bot deployed to Preview October 19, 2026 10:41

View deployment

dependabot Bot force-pushed the dependabot/npm_and_yarn/multi-6a30d1ef1d branch from 9cf5950 to 1069967 Compare October 21, 2026 07:23

dependabot Bot force-pushed the dependabot/npm_and_yarn/multi-6a30d1ef1d branch from 1069967 to e14e790 Compare October 21, 2026 07:27

Hyperkid123 approved these changes Oct 21, 2026

View reviewed changes

Hyperkid123 merged commit d84c63a into master Oct 21, 2026
2 of 3 checks passed

Hyperkid123 deleted the dependabot/npm_and_yarn/multi-6a30d1ef1d branch October 21, 2026 07:37

vercel Bot deployed to Preview October 21, 2026 07:50

View deployment

Navigation Menu

Repository navigation

build(deps): bump smol-toml, @nx/jest, @nx/js and nx - #1664

build(deps): bump smol-toml, @nx/jest, @nx/js and nx#1664
Hyperkid123 merged 1 commit into
masterfrom
dependabot/npm_and_yarn/multi-6a30d1ef1d

dependabot Bot commented on behalf of github Oct 19, 2026 •

edited

Loading

Uh oh!

vercel Bot commented Oct 19, 2026 •

edited

Loading

Uh oh!

Uh oh!

This branch was successfully deployed

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

dependabot Bot commented on behalf of github Oct 19, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

v1.9.0

Performance improvements

Full Temporal support

Better Temporal support in stringify

Handling of unsafe keys

Miscellaneous updates

v1.8.0

What's Changed

v1.7.2

What's Changed

23.3.0 (2026-10-07)

🚀 Features

🩹 Fixes

23.3.0 (2026-10-07)

🚀 Features

🩹 Fixes

23.3.0 (2026-10-07)

🚀 Features

🩹 Fixes

Uh oh!

vercel Bot commented Oct 19, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

This branch was successfully deployed

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

dependabot Bot commented on behalf of github Oct 19, 2026 •

edited

Loading

vercel Bot commented Oct 19, 2026 •

edited

Loading