fix(deps): upgrade smol-toml to 1.8.0

[cv]

Outcome

Upgrade smol-toml to 1.8.0 so malformed TOML arrays and inline tables ending in a comment produce the existing generic configuration error instead of hanging the CLI.

Reason

The reviewed npm audit job blocks 1.7.0 for GHSA-7w5x-hrqm-74c2. Existing parser tests did not cover an unfinished structure with a comment at end of input.

Changes

• Update the direct smol-toml pin and its lockfile version, registry URL, and integrity hash to 1.8.0.
• Add two process-bounded regression cases through parseConfig for unfinished arrays and inline tables with a trailing comment.
• Review 1.7.0 → 1.7.1 → 1.7.2 → 1.8.0: the comment-loop fix, internal parser refactoring, and Temporal serialization require no changes to NemoClaw's public parse/stringify consumers. The package retains its CommonJS and ESM exports, Node >=18 requirement, BSD-3-Clause license, and no runtime dependencies.

Verification

• Reproduced both malformed-input hangs with 1.7.0: both child processes reached the timeout; the eight existing config-format tests passed.
• npm run build:cli — passed in a container with Node 22.23.1 and npm 10.9.8.
• npx vitest run --project cli src/lib/sandbox/config-format.test.ts src/lib/inference/vllm-storage.test.ts src/lib/onboard/docker-driver-gateway-config-toml.test.ts src/lib/onboard/docker-driver-gateway-config-auth-contract.test.ts src/lib/state/state-file-key-merge-behavior.test.ts src/lib/state/state-file-key-merge-file-safety.test.ts src/lib/onboard/created-sandbox-finalization.test.ts — 123 tests passed across seven files with 1.8.0.
• npm --prefix nemoclaw run build — passed.
• npm run typecheck:cli, npx tsc -p jsconfig.json, and focused Oxlint — passed.
• npm audit --omit=dev --audit-level=high --registry=https://registry.npmjs.org/ — zero vulnerabilities.
• NODE_OPTIONS=--max-old-space-size=5120 npm run validate:pr — passed all applicable pre-commit, commit-message, and pre-push checks in an isolated container; no tracked files changed.
• Reviewed the complete diff: no secrets, API keys, credentials, unrelated dependency changes, or new runtime mechanisms.

Review notes

Self-review covers NVIDIA/NemoClaw commit 579c9e3 and all three changed files, including the sensitive path src/lib/sandbox/config-format.test.ts. The regression exercises the production parser and bounds each child process to prevent a reintroduced hang from blocking the test worker. Validation used the unchanged checks from canonical main 270275f2a2b31a70fa72692d2ec304b5dffe8ee3 in a container with no host credentials. No independent pre-publication review exists. This draft awaits independent review.

---

Signed-off-by: Carlos Villela cvillela@nvidia.com

Summary by CodeRabbit

• Tests
  • Added regression coverage for malformed TOML arrays and inline tables ending with comments.
  • Confirmed these inputs produce the expected syntax errors without blocking process termination or event handling.

[copy-pr-bot]

Auto-sync is disabled for draft pull requests in this repository. Workflows must be run manually.

Contributors can view more details about this message here.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: c577710e-d29e-42dc-a27d-3874747836ac

📥 Commits

Reviewing files that changed from the base of the PR and between 270275f and 579c9e3.

⛔ Files ignored due to path filters (1)

• package-lock.json is excluded by !**/package-lock.json

📒 Files selected for processing (2)

• package.json
• src/lib/sandbox/config-format.test.ts

Included review availability: Your plan provides up to 12 included reviews per hour; 10 remain after this review.

---

📝 Walkthrough

Walkthrough

The TOML parser dependency is updated from version 1.7.0 to 1.8.0. Regression tests run unfinished TOML arrays and inline tables in a bounded child process and verify syntax errors without event-loop blocking.

Changes

TOML parser regression

Layer / File(s)	Summary
Bounded parser regression tests package.json, src/lib/sandbox/config-format.test.ts	The project updates smol-toml to version 1.8.0. Parameterized tests execute unfinished TOML structures with trailing comments in a child process, enforce a two-second timeout, and verify clean termination with the expected syntax error.

Estimated code review effort: 2 (Simple) | ~10 minutes

Suggested reviewers: ericksoa

Merge Risk: ⚪ Minimal · up to 579c9

The parser upgrade prevents malformed TOML arrays and inline tables ending in comments from hanging the CLI, returning syntax errors instead. The affected behavior is covered by bounded regression cases, with no remaining merge-blocking risk.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely identifies the main change: upgrading the smol-toml dependency to version 1.8.0. It matches the dependency update and the security-related regression fix.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 1…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch codex/upgrade-smol-toml

---

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

🌿 Preview your docs: https://nvidia-preview-pr-11362.docs.buildwithfern.com/nemoclaw

[github-code-quality]

Code Coverage Overview

Languages: TypeScript

TypeScript / code-coverage/plugin

The overall line coverage in commit 579c9e3 in the codex/upgrade-smol-t... branch remains at 96%, unchanged from commit 270275f in the main branch.

TypeScript / code-coverage/cli

The overall line coverage in commit 579c9e3 in the codex/upgrade-smol-t... branch remains at 83%, unchanged from commit 270275f in the main branch.

---

_{Updated September 10, 2026 02:28 UTC}

[github-actions]

PR Review Advisor finished for commit 579c9e3. Include the Advisor findings in the complete PR feedback collection. Verify and group valid findings before repair.

All previous runs