chore(deps-dev): bump smol-toml from 1.8.0 to 1.9.0

[clay-good]

Status: LGTM once CI is green. This replaces dependabot #2040, which can't pass CI as it is.

Problem: #2040 changes only pnpm-lock.yaml. flake.nix pins a pnpmDeps hash, so any lockfile change fails the required Nix Flake Validation check. Dependabot closes its own PR if anyone pushes to its branch, so this PR carries the same lockfile plus the hash fix.

What it does

File	Change
pnpm-lock.yaml	Same as #2040: smol-toml 1.8.0 → 1.9.0. No other packages change.
flake.nix	pnpmDeps.hash → sha256-NIMHf7t+FnBgsswDtB1k4E/zX1ks1r3708ggE2ps9E8=. #2040's Nix job computed this hash and confirmed a build with it (✓ Build verification successful).

package.json is unchanged because 1.9.0 already fits ^1.7.1.

Proof

• In chore(deps-dev): bump smol-toml from 1.8.0 to 1.9.0 in the development-dependencies group #2040's CI run, every check except Nix passed on linux, macOS and Windows.
• pnpm@10.34.5 install --frozen-lockfile accepts the lockfile.
• Locally, the three test files that parse TOML with smol-toml (adapters, init, update) pass: 1,618 tests.

Notes

• smol-toml is used only in tests and never ships in the CLI. 1.9.0 returns null-prototype objects and fixes a DoS vector (GHSA-r4xh-jqrq-34v2). The existing assertions are unaffected.
• Merging this lets Dependabot close chore(deps-dev): bump smol-toml from 1.8.0 to 1.9.0 in the development-dependencies group #2040. If it doesn't, close chore(deps-dev): bump smol-toml from 1.8.0 to 1.9.0 in the development-dependencies group #2040 by hand as superseded.

🤖 Generated with Claude Code

Summary by CodeRabbit

• Chores
  • Updated internal package build metadata. This change does not alter the app’s features or behavior for end users. No user-facing changes are included in this release.

[coderabbitai]

Navigate logical layers of code changes, visualize relationships, and explore their blast radius.

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

• Configuration used: Repository: Fission-AI/OpenSpec/.coderabbit.yaml
• Review profile: CHILL
• Plan: Advanced
• Run ID: 45f27e99-740e-4130-8edd-97f94b3377be

📥 Commits

Reviewing files that changed from the base of the PR and between 2500d6d and a1ac6ec.

⛔ Files ignored due to path filters (1)

• pnpm-lock.yaml is excluded by !**/pnpm-lock.yaml

📒 Files selected for processing (1)

• flake.nix

Included review availability: This review used your included allowance. Your plan provides up to 10 included reviews per hour; 9 remain after this review.

---

📝 Walkthrough

Walkthrough

The openspec derivation’s fetchPnpmDeps hash changed. The package version, source, pnpm version, and fetcher version remain unchanged.

Changes

openspec dependency hash

Layer / File(s)	Summary
Update dependency hash flake.nix	The openspec derivation now uses a different fetchPnpmDeps hash.

Priority: ⬇️ Low

Estimated code review effort: 1 (Trivial) | ~3 minutes

Change: Other

Merge Risk: ⚪ Minimal · up to a1ac6

The change only updates OpenSpec’s dependency-fetch hash. No failure is established, though the hash still needs Nix validation.

🚥 Pre-merge checks | ✅ 3 | ❓ 2

❌ Failed checks (2 inconclusive)

Check name	Status	Explanation	Resolution
Linked Issues check	❓ Inconclusive	Issue #2040 requires updating development dependency smol-toml from 1.8.0 to 1.9.0. The reviewed summary confirms a pnpmDeps hash change in flake.nix, but pnpm-lock.yaml is excluded by `!**/pn…	Provide reviewable evidence of the smol-toml version in pnpm-lock.yaml.
Out of Scope Changes check	❓ Inconclusive	The visible flake.nix hash change supports the lockfile update requested by issue #2040. The PR description says no other packages changed, but pnpm-lock.yaml is excluded by !**/pnpm-lock.yaml, …	Provide reviewable evidence of the lockfile changes so their scope can be assessed.

✅ Passed checks (3 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly identifies the development dependency update from smol-toml 1.8.0 to 1.9.0, which is the primary objective of the pull request.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…

Full details: Linked Issues check

Explanation

Issue #2040 requires updating development dependency smol-toml from 1.8.0 to 1.9.0. The reviewed summary confirms a pnpmDeps hash change in flake.nix, but pnpm-lock.yaml is excluded by !**/pnpm-lock.yaml. The PR description claims the lockfile contains the requested update, but the excluded file cannot verify that requirement.

Full details: Out of Scope Changes check

Explanation

The visible flake.nix hash change supports the lockfile update requested by issue #2040. The PR description says no other packages changed, but pnpm-lock.yaml is excluded by !**/pnpm-lock.yaml, so the full set and scope of its changes cannot be established.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

• Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[openspec-cloud]

No PR-relevant drift confirmed.

AI-generated · A citation proves the line exists, not that it makes the case — verify before acting.
Checked the 1 requirement selected for this PR at a1ac6ec (255 total).
This is not a full-repository clean result; see the check for coverage and any broader findings.
View results · Click Refresh, then Scan again in the check. Or comment /openspec-cloud.

[alfred-openspec]

Approved. The lockfile changes only smol-toml 1.8.0 to 1.9.0, package.json already permits it, and the pnpmDeps hash is updated accordingly. Nix validation, dependency review, tests, lint, and cross-platform CI all pass.