chore: upgrade smol-toml to 1.8.0 to address CVE-2026-85730 (#1644)

* chore: upgrade smol-toml to 1.8.0

Raises the existing qualified `smol-toml@npm:^1.6.0` resolution floor from
`^1.6.1` to `^1.7.1` and refreshes yarn.lock, which now resolves 1.8.0.
smol-toml reaches the tree only through @react-grab/cli, which pins it
behind a resolution, so the floor is what has to move.

Addresses CVE-2026-85730.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

* Update changelog

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: claude[bot] <41898282+claude[bot]@users.noreply.github.com>
Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
Co-authored-by: Brendan Kellam <brendan@sourcebot.dev>

Author: 4 people

CHANGELOG.md

@@ -8,6 +8,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 ## [Unreleased]
 
 ### Fixed
+- Upgraded `smol-toml` to `1.8.0`. [#1644](https://github.com/sourcebot-dev/sourcebot/pull/1644)
 - Upgraded `hono` to `4.13.7`. [#1643](https://github.com/sourcebot-dev/sourcebot/pull/1643)
 - Upgraded `nodemailer` to `9.1.1`. [#1642](https://github.com/sourcebot-dev/sourcebot/pull/1642)
 

package.json

@@ -60,7 +60,7 @@
         "yaml@npm:^2.3.4": "^2.8.3",
         "yaml@npm:^2.8.0": "^2.8.3",
         "ajv@npm:^6.12.4": "^6.14.0",
-        "smol-toml@npm:^1.6.0": "^1.6.1",
+        "smol-toml@npm:^1.6.0": "^1.7.1",
         "teeny-request@npm:^10.0.0": "^10.1.2",
         "uuid": "^14.0.0",
         "fast-uri@npm:^3.0.1": "^3.1.2",

yarn.lock

@@ -21569,10 +21569,10 @@ __metadata:
   languageName: node
   linkType: hard
 
-"smol-toml@npm:^1.6.1":
-  version: 1.6.1
-  resolution: "smol-toml@npm:1.6.1"
-  checksum: 10c0/511a78722f99c7616fdb46af708de3d7e81434b5a3d58061166da73f28bfc6cae4f0cd04683f60515b9c490cd10152fce72287c960b337419c0299cc1f0f2a22
+"smol-toml@npm:^1.7.1":
+  version: 1.8.0
+  resolution: "smol-toml@npm:1.8.0"
+  checksum: 10c0/4e01dbfb7c7af142176b037ebedaccccafb8229cc873feaa47c184ee31073d86e30b4b1b0fe9a5a6d083ed3ce21615eda9e81d1f5d779ad8b2e2e9459b900aea
   languageName: node
   linkType: hard