fix(deps): override smol-toml to resolve audit vulnerability

[AndyTWF]

Summary

• Adds a pnpm override for smol-toml@<1.6.1 → 1.6.1 to fix a moderate DoS vulnerability (GHSA-v3rj-xjv7-4jmq)
• The vulnerable transitive dependency came through @vercel/node → @vercel/build-utils → @vercel/python-analysis → smol-toml
• pnpm audit now reports no known vulnerabilities

🤖 Generated with Claude Code

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
cli-web-cli	Ready	Preview, Comment	Apr 9, 2026 0:38am

[claude-code-ably-assistant]

Walkthrough

This PR fixes a moderate DoS vulnerability (GHSA-v3rj-xjv7-4jmq) in the transitive dependency smol-toml (versions below 1.6.1), which was pulled in via @vercel/node → @vercel/build-utils → @vercel/python-analysis. A pnpm.overrides entry forces resolution to the patched version (>=1.6.1), and pnpm audit now reports no known vulnerabilities.

Changes

Area	Files	Summary
Config	package.json	Adds pnpm.overrides entry to pin smol-toml to >=1.6.1
Config	pnpm-lock.yaml	Lockfile updated to reflect the forced resolution

Review Notes

• No breaking changes — this is a pure dependency override with no code changes.
• No new direct dependencies — the override only constrains an existing transitive dependency.
• No tests needed — the change is limited to dependency resolution; no runtime behavior is affected.
• Security context: smol-toml <1.6.1 is vulnerable to a ReDoS (Regular Expression DoS) attack. The patched version 1.6.1 is a drop-in fix with no API changes.
• Scope of @vercel/node: Verify that @vercel/node is only a dev/build dependency (not bundled into the published npm package), so end-users of @ably/cli are not transitively exposed.

---

Generated by Claude Code

[claude-code-ably-assistant]

Review Summary

This is a clean, targeted security fix. No source code, commands, tests, or utilities changed — only package.json and pnpm-lock.yaml.

What changed:

• Added a pnpm override "smol-toml@<1.6.1": "1.6.1" to force the patched version for any transitive dependency requesting a vulnerable range
• Lockfile consistently updated: smol-toml@1.5.2 removed, all references point to 1.6.1
• The vulnerable path (@vercel/node → @vercel/build-utils → @vercel/python-analysis → smol-toml) is correctly resolved

No issues found. The fix is correct, minimal, and consistent with the existing override pattern already used in this repo (see the esbuild, ajv, js-yaml entries above it). Ready to merge.