🚨 Update dependency toml to v5 (main)

[renovate]

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
toml	^3.0.0 → ^5.0.0

---

Release Notes

BinaryMuse/toml-node (toml)

v5.0.0

Compare Source

=====================

• Breaking: Integers outside JavaScript's safe range (beyond ±Number.MAX_SAFE_INTEGER) now throw a parse error instead of silently returning a rounded value (#​28). Opt in to lossless handling of the full 64-bit range with toml.parse(input, { bigint: true }), which returns all integer values as BigInt.
• Breaking: Integers outside TOML's 64-bit signed integer range now throw a parse error in either mode, as required by the spec. Previously they were silently rounded.

v4.3.0

Compare Source

=====================

• Add opt-in Temporal support via toml.parse(input, { useTemporal: true }), mapping offset date-times to Temporal.ZonedDateTime and local date-times/dates/times to Temporal.PlainDateTime/PlainDate/PlainTime. An implementation can be supplied via the temporal option on runtimes without a Temporal global. (#​69)

v4.2.0

Compare Source

=====================

• Address security advisory GHSA-82x6-q7mm-w9cf (CVE pending), in which deeply nested arrays or inline tables could overflow the call stack and crash the process with an uncatchable RangeError. Nesting is now bounded (default 500 levels), and input past the limit throws a normal parse error. The limit is configurable via toml.parse(input, { maxDepth }).

v4.1.2

Compare Source

=====================

• Address CVE-2026-63376, in which a specially crafted TOML string could pollute Object.prototype process-wide.

v4.1.1

Compare Source

=====================

• Increase performance ~5x (#​68)

v4.1.0

Compare Source

=====================

• Add spec v1.1.0 support (#​67)

v4.0.1

Compare Source

=====================

• Minor packaging changes

v4.0.0

Compare Source

=====================

• Modernize tooling and support TOML v1.0.0 spec (#​66)

---

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • Between 12:00 AM and 03:59 AM (* 0-3 * * *)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Advanced

Run ID: e9bed106-b9ec-44de-8e3a-e41e5b6b7010

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

_{Comment @coderabbitai help to get the list of available commands.}

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 3:06 AM UTC · Completed 3:15 AM UTC

Commit: cd01138 · View workflow run →

Runtime: claude · Model: opus → claude-opus-4-7 · Effort: high · Cost: $4.20

[github-actions]

🚀 Preview is available at https://4d5c8179.enterprise-contract.pages.dev

[fullsend-ai-review]

Looks good to me