Update smol-toml (#29521)
The playground's locked `smol-toml` 1.4.1 has security advisories.
Update it to 1.9.1, which is outside the affected ranges and allowed by
the playgrounds' declared dependency ranges.
Version 1.9.1 was [published on October 9,
2026](https://github.com/squirrelchat/smol-toml/releases/tag/v1.9.1).
The first release that fixes all three advisories was 1.9.0. Each
advisory had a fixed version available when Ruff's Dependabot alert was
created. Dates below are in 2026 and UTC:
| Advisory | Published in smol-toml repository | Published and reviewed
by GitHub | Ruff alert created | First fixed version |
| --- | --- | --- | --- | --- |
|
[GHSA-v3rj-xjv7-4jmq](https://github.com/advisories/GHSA-v3rj-xjv7-4jmq)
| March 23 | March 25 | [March
25](https://github.com/astral-sh/ruff/security/dependabot/126) |
[1.6.1](https://github.com/squirrelchat/smol-toml/releases/tag/v1.6.1)
(March 23) |
|
[GHSA-7w5x-hrqm-74c2](https://github.com/advisories/GHSA-7w5x-hrqm-74c2)
| August 9 | September 9 | [September
9](https://github.com/astral-sh/ruff/security/dependabot/238) |
[1.7.1](https://github.com/squirrelchat/smol-toml/releases/tag/v1.7.1)
(July 26) |
|
[GHSA-r4xh-jqrq-34v2](https://github.com/advisories/GHSA-r4xh-jqrq-34v2)
| September 22 | October 5 | [October
6](https://github.com/astral-sh/ruff/security/dependabot/270) |
[1.9.0](https://github.com/squirrelchat/smol-toml/releases/tag/v1.9.0)
(September 22) |
Ruff's Renovate configuration enables vulnerability alerts, but Codex
could not confirm why Renovate did not open a security-update PR for
these alerts. An [open Renovate
discussion](https://github.com/renovatebot/renovate/discussions/45331)
reports that Renovate can fail to read the locked version of an npm
workspace dependency when it is hoisted to the workspace root. Both
playground packages declare `smol-toml` in
`playground/ruff/package.json` and `playground/ty/package.json`, but the
lockfile records it at the workspace root under `node_modules/smol-toml`
in `playground/package-lock.json`. If the same problem prevents Renovate
from matching a GitHub alert to the locked version, it might not open a
security-update PR. Codex has not confirmed whether this happened in
Ruff; the linked discussion concerns OSV-based alerts rather than
GitHub's Dependabot alerts.
Split from #29518.
