[GHSA-m34p-749j-x6m6] js-toml has silent type confusion via falsy-primitive duplicate-key bypass

[krotname]

Updates

• References

Comments
Add upstream release and fix commit references for the existing patched version 1.1.2.

The v1.1.2 release notes explicitly state that the release fixes GHSA-m34p-749j-x6m6. The referenced commit switches the duplicate-key existence checks from truthy tests to the in operator, causing falsy-primitive duplicate keys to raise parse errors as required.

No advisory metadata, affected range, patched version, severity, or description changes are proposed.

[github]

Hi there @sunnyadn! A community member has suggested an improvement to your security advisory. If approved, this change will affect the global advisory listed at github.com/advisories. It will not affect the version listed in your project repository.

This change will be reviewed by our Security Curation Team. If you have thoughts or feedback, please share them in a comment here! If this PR has already been closed, you can start a new community contribution for this advisory

[sunnyadn]

Confirmed — these references are accurate. Both the fix commit (e0504fa, "treat falsy-primitive duplicate keys as parse errors") and the v1.1.2 release tag correctly point to the patch for GHSA-m34p-749j-x6m6. Thanks @krotname for the improvement; this LGTM.