From 1aec8f2db61e619025406fa15ef54f9a7d7969e6 Mon Sep 17 00:00:00 2001
From: aelmanaa <aelmanaa@users.noreply.github.com>
Date: Fri, 30 Oct 2026 22:53:00 +0000
Subject: [PATCH] ts: bump toml to ^5.0.1

---
 CHANGELOG.md                    | 1 +
 ts/packages/anchor/package.json | 2 +-
 ts/yarn.lock                    | 8 ++++----
 3 files changed, 6 insertions(+), 5 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index df96ec110c..4e209ed514 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -21,6 +21,7 @@ The minor version will be incremented upon a breaking change and the patch versi
 
 ### Fixes
 
+- ts: Bump `toml` to `^5.0.1` to address security advisories in `toml` <= 5.0.0 ([#5236](https://github.com/otter-sec/anchor/issues/5236)).
 - cli: Accept an explicit program id or workspace program when parsing `program extend` ([#5220](https://github.com/otter-sec/anchor/pull/5220)).
 - Block mutable aliasing between accounts marked `zero` and `init` ([#4871](https://github.com/otter-sec/anchor/pull/4871)).
 - lang: Support fully qualified account types in `Context` ([#4836](https://github.com/otter-sec/anchor/pull/4836)).
diff --git a/ts/packages/anchor/package.json b/ts/packages/anchor/package.json
index 8b31068c32..0a1ea20da3 100644
--- a/ts/packages/anchor/package.json
+++ b/ts/packages/anchor/package.json
@@ -44,7 +44,7 @@
     "eventemitter3": "^4.0.7",
     "pako": "^2.0.3",
     "superstruct": "^0.15.4",
-    "toml": "^3.0.0"
+    "toml": "^5.0.1"
   },
   "devDependencies": {
     "@commitlint/cli": "^11.0.0",
diff --git a/ts/yarn.lock b/ts/yarn.lock
index cf977d0cf1..f0ce49fe88 100644
--- a/ts/yarn.lock
+++ b/ts/yarn.lock
@@ -5156,10 +5156,10 @@ to-regex-range@^5.0.1:
   dependencies:
     is-number "^7.0.0"
 
-toml@^3.0.0:
-  version "3.0.0"
-  resolved "https://registry.yarnpkg.com/toml/-/toml-3.0.0.tgz#342160f1af1904ec9d204d03a5d61222d762c5ee"
-  integrity sha512-y/mWCZinnvxjTKYhJ+pYxwD0mRLVvOtdS2Awbgxln6iEnt4rk0yBxeSBHkGJcPucRiG0e55mwWp+g/05rsrd6w==
+toml@^5.0.1:
+  version "5.0.1"
+  resolved "https://registry.yarnpkg.com/toml/-/toml-5.0.1.tgz#67ca011810a2dd8741c2cede1027ee2084b73d67"
+  integrity sha512-EqYNA/YvUNndrA2B3O2ojzLQoTQrBxeZ9UIjQwk8t10oe6n7dwclBwd9IdZQTOKwe6vWX+AXtl6IntXRbepdxQ==
 
 tough-cookie@^4.0.0:
   version "4.1.4"