🚨 Update dependency toml to v5 (main)

[renovate]

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
toml	^3.0.0 → ^5.0.0

---

Release Notes

BinaryMuse/toml-node (toml)

v5.0.0

Compare Source

=====================

• Breaking: Integers outside JavaScript's safe range (beyond ±Number.MAX_SAFE_INTEGER) now throw a parse error instead of silently returning a rounded value (#​28). Opt in to lossless handling of the full 64-bit range with toml.parse(input, { bigint: true }), which returns all integer values as BigInt.
• Breaking: Integers outside TOML's 64-bit signed integer range now throw a parse error in either mode, as required by the spec. Previously they were silently rounded.

v4.3.0

Compare Source

=====================

• Add opt-in Temporal support via toml.parse(input, { useTemporal: true }), mapping offset date-times to Temporal.ZonedDateTime and local date-times/dates/times to Temporal.PlainDateTime/PlainDate/PlainTime. An implementation can be supplied via the temporal option on runtimes without a Temporal global. (#​69)

v4.2.0

Compare Source

=====================

• Address security advisory GHSA-82x6-q7mm-w9cf (CVE pending), in which deeply nested arrays or inline tables could overflow the call stack and crash the process with an uncatchable RangeError. Nesting is now bounded (default 500 levels), and input past the limit throws a normal parse error. The limit is configurable via toml.parse(input, { maxDepth }).

v4.1.2

Compare Source

=====================

• Address CVE-2026-63376, in which a specially crafted TOML string could pollute Object.prototype process-wide.

v4.1.1

Compare Source

=====================

• Increase performance ~5x (#​68)

v4.1.0

Compare Source

=====================

• Add spec v1.1.0 support (#​67)

v4.0.1

Compare Source

=====================

• Minor packaging changes

v4.0.0

Compare Source

=====================

• Modernize tooling and support TOML v1.0.0 spec (#​66)

---

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • Between 12:00 AM and 03:59 AM (* 0-3 * * *)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Advanced

Run ID: 58f20851-e71a-4472-ac0e-c507f3b42c21

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

_{Comment @coderabbitai help to get the list of available commands.}

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 3:06 AM UTC · Completed 3:15 AM UTC

Commit: cd01138 · View workflow run →

Runtime: claude · Model: opus → claude-opus-4-7 · Effort: high · Cost: $4.20

[github-actions]

🚀 Preview is available at https://4d5c8179.enterprise-contract.pages.dev

[fullsend-ai-review]

Looks good to me

Previous run

Looks good to me

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 1:44 PM UTC · Completed 1:54 PM UTC

Commit: cd01138 · View workflow run →

Runtime: claude · Model: opus → claude-opus-4-7 · Effort: high · Cost: $3.80

[github-actions]

🚀 Preview is available at https://144070b0.enterprise-contract.pages.dev

[robnester-rh]

LGTM

[fullsend-ai-review]

Risk Assessment: moderate (2/5)

Details

Major version bump of devDependency toml (v3 -> v5) touching only antora/package.json and antora/package-lock.json (16 lines, XS). No protected paths, no CI workflow changes, no security-sensitive source touched, bot author (renovate). Git history for both files is quiet. Elevated from low to moderate to reflect documented breaking changes in the upstream v5/v4.2/v4.1.2 release notes (integer overflow now throws; default maxDepth=500; prototype-pollution CVE fix) — consumers of toml could break at runtime even though the diff itself is tiny.

[fullsend-ai-retro]

🤖 Finished Retro · ✅ Success · Started 2:09 PM UTC · Completed 2:14 PM UTC

Commit: cd01138 · View workflow run →

Runtime: claude · Model: opus → claude-opus-4-7 · Effort: high · Cost: $2.85

[fullsend-ai-retro]

PR #565 was a Renovate major bump of the toml npm devDependency (v3 → v5), touching only antora/package.json and antora/package-lock.json (XS diff). The sole consumer is antora/supplemental-ui/helpers/parseHugoMenu.js, which parses a tiny in-repo menu.toml at build time — trusted input, no large integers, shallow nesting — so the change is genuinely low-risk in this repo. The review agent approved on both commits; human reviewers (robnester-rh, joejstuart) also approved and the PR merged cleanly. No proposals filed — every angle worth acting on is already tracked by an open upstream issue.

Evidence added to existing open issues (in preference to filing duplicates, per retro-analysis guidance):

• fullsend-ai/fullsend#3015 (Renovate major-bump breaking-change screening) and fullsend-ai/fullsend#2469 (structured dependency summary vs generic LGTM): the two review runs on this PR demonstrate the exact non-determinism these issues describe. Run 1 (workflow 34557083888, head 1885bfb) fully delegated to sub-agents; the trace shows the risk-assessment sub-agent hit the "Early exit criteria for mechanical dep bumps" clause in its prompt and short-circuited, yielding a bare "Looks good to me" with no risk field and no mention of toml v4/v5's breaking changes (integer-overflow now throws, default maxDepth=500, prototype-pollution CVE fix in v4.1.2) — even though the Renovate PR body containing the release notes was already in-context. Run 2 (workflow 34851038191, head cd7e2d4) took the top-level-reasoning path instead, cited all three breaking changes verbatim, and correctly elevated risk to moderate 2/5. Same PR, same signal, opposite outputs — the failure mode is the sub-agent "HARD LIMIT: ≤5 tool calls. Read ONLY the diff and linked issue. Do NOT read project docs, surrounding files, git history, or directory listings" combined with the mechanical-bump early exit, which suppresses release-notes analysis whenever the orchestrator delegates. Concrete fix hook for these issues: the risk-assessment sub-agent should be required to parse Renovate/Dependabot Release Notes sections in the PR body before applying any early-exit, and the trivial-scope HARD LIMIT for dep bumps should permit reading the PR body and one call site.

• fullsend-ai/agents#902 (surface security advisories in dependency reviews): the v4.1.2 changelog entry linked in the Renovate body references CVE-2026-63376 (prototype-pollution) and advisory GHSA-82x6-q7mm-w9cf; run 1 never surfaced either, run 2 mentioned them only inside the risk-assessment details block. A structured advisories field on the review verdict would have made this uniformly visible.

• fullsend-ai/fullsend#4698 (PR-level risk score in review pipeline): this PR is a clean example of the score doing useful work — the moderate 2/5 with breaking-change reasoning is exactly the artifact humans want to see on a Renovate major, and its absence on run 1 is the failure the issue proposes to fix.

No new issues warranted; the systemic gap this PR illustrates is already well-tracked.