fix(deps): update dependency toml to v5

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
toml	^3.0.0 → ^5.0.0

---

Release Notes

BinaryMuse/toml-node (toml)

v5.0.0

Compare Source

=====================

• Breaking: Integers outside JavaScript's safe range (beyond ±Number.MAX_SAFE_INTEGER) now throw a parse error instead of silently returning a rounded value (#​28). Opt in to lossless handling of the full 64-bit range with toml.parse(input, { bigint: true }), which returns all integer values as BigInt.
• Breaking: Integers outside TOML's 64-bit signed integer range now throw a parse error in either mode, as required by the spec. Previously they were silently rounded.

v4.3.0

Compare Source

=====================

• Add opt-in Temporal support via toml.parse(input, { useTemporal: true }), mapping offset date-times to Temporal.ZonedDateTime and local date-times/dates/times to Temporal.PlainDateTime/PlainDate/PlainTime. An implementation can be supplied via the temporal option on runtimes without a Temporal global. (#​69)

v4.2.0

Compare Source

=====================

• Address security advisory GHSA-82x6-q7mm-w9cf (CVE pending), in which deeply nested arrays or inline tables could overflow the call stack and crash the process with an uncatchable RangeError. Nesting is now bounded (default 500 levels), and input past the limit throws a normal parse error. The limit is configurable via toml.parse(input, { maxDepth }).

v4.1.2

Compare Source

=====================

• Address CVE-2026-63376, in which a specially crafted TOML string could pollute Object.prototype process-wide.

v4.1.1

Compare Source

=====================

• Increase performance ~5x (#​68)

v4.1.0

Compare Source

=====================

• Add spec v1.1.0 support (#​67)

v4.0.1

Compare Source

=====================

• Minor packaging changes

v4.0.0

Compare Source

=====================

• Modernize tooling and support TOML v1.0.0 spec (#​66)

---

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • Between 12:00 AM and 03:59 AM, only on Monday (* 0-3 * * 1)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[github-actions]

📊 Benchmark results

Comparing with 0d36749

• Dependency count: 1,158 ⬆️ 0.09% increase vs. 0d36749
• Package size: 404 MB ⬆️ 0.04% increase vs. 0d36749
• Number of ts-expect-error directives: 358 (no change)