From 579c9e35f6a4d8e73840c822302ff4e4168ef558 Mon Sep 17 00:00:00 2001
From: Carlos Villela <cvillela@nvidia.com>
Date: Wed, 9 Sep 2026 18:29:06 -0700
Subject: [PATCH] fix(deps): upgrade smol-toml to 1.8.0

Signed-off-by: Carlos Villela <cvillela@nvidia.com>
---
 package-lock.json                     |  8 ++++----
 package.json                          |  2 +-
 src/lib/sandbox/config-format.test.ts | 27 +++++++++++++++++++++++++++
 3 files changed, 32 insertions(+), 5 deletions(-)

diff --git a/package-lock.json b/package-lock.json
index c25b9aab95a..4699f8ce04d 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -20,7 +20,7 @@
         "js-yaml": "^4.3.2",
         "p-retry": "^4.6.2",
         "qrcode-terminal": "^0.12.0",
-        "smol-toml": "1.7.0",
+        "smol-toml": "1.8.0",
         "typebox": "1.1.38",
         "undici": "8.10.0",
         "yaml": "2.8.3"
@@ -8256,9 +8256,9 @@
       }
     },
     "node_modules/smol-toml": {
-      "version": "1.7.0",
-      "resolved": "https://registry.npmjs.org/smol-toml/-/smol-toml-1.7.0.tgz",
-      "integrity": "sha512-aqVvWoyO21L23mb+drl4RmMXbf6N7FdHjAhTRA9ZBL7apWBgfWC16KjrASI+1p9GAroljyMHj6fK67i0UiTNvQ==",
+      "version": "1.8.0",
+      "resolved": "https://registry.npmjs.org/smol-toml/-/smol-toml-1.8.0.tgz",
+      "integrity": "sha512-kCZr2V3ch9i00x8zXRhjUNVcjG9ijES5dDudkXvUVCT5QlJNQWElSJdZqyPemffHoLNUYwOcou0Fy+ojN0uHSQ==",
       "license": "BSD-3-Clause",
       "engines": {
         "node": ">= 18"
diff --git a/package.json b/package.json
index 6296e476b8d..dd0aca05345 100644
--- a/package.json
+++ b/package.json
@@ -114,7 +114,7 @@
     "js-yaml": "^4.3.2",
     "p-retry": "^4.6.2",
     "qrcode-terminal": "^0.12.0",
-    "smol-toml": "1.7.0",
+    "smol-toml": "1.8.0",
     "typebox": "1.1.38",
     "undici": "8.10.0",
     "yaml": "2.8.3"
diff --git a/src/lib/sandbox/config-format.test.ts b/src/lib/sandbox/config-format.test.ts
index 11aa2ff1c91..5f1a80d4cd0 100644
--- a/src/lib/sandbox/config-format.test.ts
+++ b/src/lib/sandbox/config-format.test.ts
@@ -1,6 +1,7 @@
 // SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
 // SPDX-License-Identifier: Apache-2.0
 
+import { spawnSync } from "node:child_process";
 import { describe, expect, it } from "vitest";
 
 const { parseConfig, serializeConfig } =
@@ -39,6 +40,32 @@ describe("sandbox config formats", () => {
     });
   });
 
+  it.each(["values = [1 #", "value = { nested = 1 #"])(
+    "rejects an unfinished TOML structure ending in a comment: %s",
+    (source) => {
+      // Bound the child process because a parser regression can block the event loop.
+      const result = spawnSync(
+        process.execPath,
+        [
+          "--require",
+          require.resolve("tsx/cjs"),
+          "--eval",
+          `const assert = require("node:assert/strict");
+           const { parseConfig } = require(process.argv[1]);
+           assert.throws(() => parseConfig(process.argv[2], "toml"), {
+             message: "Invalid TOML configuration syntax.",
+           });`,
+          require.resolve("./config-format"),
+          source,
+        ],
+        { encoding: "utf8", timeout: 2000, killSignal: "SIGKILL" },
+      );
+
+      expect(result.error).toBeUndefined();
+      expect(result.status, result.stderr).toBe(0);
+    },
+  );
+
   it("rejects excessive TOML nesting with a generic source-safe error", () => {
     const secret = "credential-canary-must-not-escape";
     const acceptedPath = Array.from({ length: 63 }, (_, index) => `level${index}`).join(".");