fix: Use toml-eslint-parser instead of @iarna/toml (#25594)

Co-authored-by: Michael Kriese <michael.kriese@visualon.de>

lib/modules/manager/cargo/extract.ts

@@ -1,7 +1,7 @@
-import { parse } from '@iarna/toml';
 import { logger } from '../../../logger';
 import type { SkipReason } from '../../../types';
 import { findLocalSiblingOrParent, readLocalFile } from '../../../util/fs';
+import { parse as parseToml } from '../../../util/toml';
 import { CrateDatasource } from '../../datasource/crate';
 import type {
   ExtractConfig,
@@ -133,7 +133,7 @@ async function readCargoConfig(): Promise<CargoConfig | null> {
     const payload = await readLocalFile(path, 'utf8');
     if (payload) {
       try {
-        return parse(payload) as CargoConfig;
+        return parseToml(payload) as CargoConfig;
       } catch (err) {
         logger.debug({ err }, `Error parsing ${path}`);
       }
@@ -214,7 +214,7 @@ export async function extractPackageFile(
 
   let cargoManifest: CargoManifest;
   try {
-    cargoManifest = parse(content);
+    cargoManifest = parseToml(content) as CargoManifest;
   } catch (err) {
     logger.debug({ err, packageFile }, 'Error parsing Cargo.toml file');
     return null;

lib/modules/manager/gradle/extract/catalog.ts

@@ -1,9 +1,9 @@
-import { parse } from '@iarna/toml';
 import is from '@sindresorhus/is';
 import deepmerge from 'deepmerge';
 import type { SkipReason } from '../../../../types';
 import { hasKey } from '../../../../util/object';
 import { escapeRegExp, regEx } from '../../../../util/regex';
+import { parse as parseToml } from '../../../../util/toml';
 import type { PackageDependency } from '../../types';
 import type {
   GradleCatalog,
@@ -246,7 +246,7 @@ export function parseCatalog(
   packageFile: string,
   content: string
 ): PackageDependency<GradleManagerData>[] {
-  const tomlContent = parse(content) as GradleCatalog;
+  const tomlContent = parseToml(content) as GradleCatalog;
   const versions = tomlContent.versions ?? {};
   const libs = tomlContent.libraries ?? {};
   const libStartIndex = content.indexOf('libraries');

lib/modules/manager/pep621/utils.ts

@@ -1,7 +1,7 @@
-import toml from '@iarna/toml';
 import is from '@sindresorhus/is';
 import { logger } from '../../../logger';
 import { regEx } from '../../../util/regex';
+import { parse as parseToml } from '../../../util/toml';
 import { PypiDatasource } from '../../datasource/pypi';
 import type { PackageDependency } from '../types';
 import { PyProject, PyProjectSchema } from './schema';
@@ -113,7 +113,7 @@ export function parsePyProject(
   content: string
 ): PyProject | null {
   try {
-    const jsonMap = toml.parse(content);
+    const jsonMap = parseToml(content);
     return PyProjectSchema.parse(jsonMap);
   } catch (err) {
     logger.debug(

lib/modules/manager/pipenv/extract.ts

@@ -1,10 +1,10 @@
-import toml from '@iarna/toml';
 import { RANGE_PATTERN } from '@renovatebot/pep440';
 import is from '@sindresorhus/is';
 import { logger } from '../../../logger';
 import type { SkipReason } from '../../../types';
 import { localPathExists } from '../../../util/fs';
 import { regEx } from '../../../util/regex';
+import { parse as parseToml } from '../../../util/toml';
 import { PypiDatasource } from '../../datasource/pypi';
 import type { PackageDependency, PackageFileContent } from '../types';
 import type { PipFile } from './types';
@@ -110,7 +110,7 @@ export async function extractPackageFile(
   let pipfile: PipFile;
   try {
     // TODO: fix type (#9610)
-    pipfile = toml.parse(content) as any;
+    pipfile = parseToml(content) as any;
   } catch (err) {
     logger.debug({ err, packageFile }, 'Error parsing Pipfile');
     return null;

lib/modules/manager/poetry/artifacts.ts

@@ -1,4 +1,3 @@
-import { parse } from '@iarna/toml';
 import is from '@sindresorhus/is';
 import { quote } from 'shlex';
 import { TEMPORARY_ERROR } from '../../../constants/error-messages';
@@ -17,6 +16,7 @@ import { getGitEnvironmentVariables } from '../../../util/git/auth';
 import { find } from '../../../util/host-rules';
 import { regEx } from '../../../util/regex';
 import { Result } from '../../../util/result';
+import { parse as parseToml } from '../../../util/toml';
 import { PypiDatasource } from '../../datasource/pypi';
 import type { UpdateArtifact, UpdateArtifactsResult } from '../types';
 import { Lockfile, PoetrySchemaToml } from './schema';
@@ -88,7 +88,7 @@ export function getPoetryRequirement(
 function getPoetrySources(content: string, fileName: string): PoetrySource[] {
   let pyprojectFile: PoetryFile;
   try {
-    pyprojectFile = parse(content);
+    pyprojectFile = parseToml(content) as PoetryFile;
   } catch (err) {
     logger.debug({ err }, 'Error parsing pyproject.toml file');
     return [];

lib/util/schema-utils.ts

@@ -1,9 +1,9 @@
-import { JsonMap, parse } from '@iarna/toml';
 import { load, loadAll } from 'js-yaml';
 import JSON5 from 'json5';
 import { DateTime } from 'luxon';
 import type { JsonArray, JsonValue } from 'type-fest';
 import { z } from 'zod';
+import { parse as parseToml } from './toml';
 
 interface ErrorContext<T> {
   error: z.ZodError;
@@ -244,9 +244,9 @@ export const MultidocYaml = z.string().transform((str, ctx): JsonArray => {
   }
 });
 
-export const Toml = z.string().transform((str, ctx): JsonMap => {
+export const Toml = z.string().transform((str, ctx) => {
   try {
-    return parse(str);
+    return parseToml(str);
   } catch (e) {
     ctx.addIssue({ code: 'custom', message: 'Invalid TOML' });
     return z.NEVER;

lib/util/toml.spec.ts

@@ -0,0 +1,31 @@
+import { codeBlock } from 'common-tags';
+import { parse as parseToml } from './toml';
+
+describe('util/toml', () => {
+  it('works', () => {
+    const input = codeBlock`
+      [tool.poetry]
+      ## Hello world
+      include = [
+        "README.md",
+        { path = "tests", format = "sdist" }
+      ]
+    `;
+
+    expect(parseToml(input)).toStrictEqual({
+      tool: {
+        poetry: {
+          include: ['README.md', { path: 'tests', format: 'sdist' }],
+        },
+      },
+    });
+  });
+
+  it('handles invalid toml', () => {
+    const input = codeBlock`
+      !@#$%^&*()
+    `;
+
+    expect(() => parseToml(input)).toThrow(SyntaxError);
+  });
+});

lib/util/toml.ts

@@ -0,0 +1,6 @@
+import { getStaticTOMLValue, parseTOML } from 'toml-eslint-parser';
+
+export function parse(input: string): unknown {
+  const ast = parseTOML(input);
+  return getStaticTOMLValue(ast);
+}

package.json

@@ -151,7 +151,6 @@
     "@aws-sdk/credential-providers": "3.363.0",
     "@breejs/later": "4.1.0",
     "@cdktf/hcl2json": "0.19.0",
-    "@iarna/toml": "3.0.0",
     "@opentelemetry/api": "1.6.0",
     "@opentelemetry/context-async-hooks": "1.17.0",
     "@opentelemetry/exporter-trace-otlp-http": "0.43.0",
@@ -241,6 +240,7 @@
     "simple-git": "3.20.0",
     "slugify": "1.6.6",
     "source-map-support": "0.5.21",
+    "toml-eslint-parser": "0.6.0",
     "traverse": "0.6.7",
     "tslib": "2.6.2",
     "upath": "2.0.1",

pnpm-lock.yaml

@@ -32,9 +32,6 @@ importers:
       '@cdktf/hcl2json':
         specifier: 0.19.0
         version: 0.19.0
-      '@iarna/toml':
-        specifier: 3.0.0
-        version: 3.0.0
       '@opentelemetry/api':
         specifier: 1.6.0
         version: 1.6.0
@@ -302,6 +299,9 @@ importers:
       source-map-support:
         specifier: 0.5.21
         version: 0.5.21
+      toml-eslint-parser:
+        specifier: 0.6.0
+        version: 0.6.0
       traverse:
         specifier: 0.6.7
         version: 0.6.7
@@ -2007,10 +2007,6 @@ packages:
     engines: {node: ^14.18.0 || >=16.0.0}
     dev: true
 
-  /@iarna/toml@3.0.0:
-    resolution: {integrity: sha512-td6ZUkz2oS3VeleBcN+m//Q6HlCFCPrnI0FZhrt/h4XqLEdOyYp2u21nd8MdsR+WJy5r9PTDaHTDDfhf4H4l6Q==}
-    dev: false
-
   /@isaacs/cliui@8.0.2:
     resolution: {integrity: sha512-O8jcjabXaleOG9DQ0+ARXWZBTfnP4WNAqzuiJK7ll44AmxGKv/J2M4TPjxjY3znBCfvBXFzucm1twdyFybFqEA==}
     engines: {node: '>=12'}
@@ -6041,7 +6037,6 @@ packages:
   /eslint-visitor-keys@3.4.3:
     resolution: {integrity: sha512-wpc+LXeiyiisxPlEkUzU6svyS1frIO3Mgxj1fdy7Pm8Ygzguax2N3Fa/D/ag1WqbOprdI+uY6wMUl8/a2G+iag==}
     engines: {node: ^12.22.0 || ^14.17.0 || >=16.0.0}
-    dev: true
 
   /eslint@8.52.0:
     resolution: {integrity: sha512-zh/JHnaixqHZsolRB/w9/02akBk9EPrOs9JwcTP2ek7yL5bVvXuRariiaAjjoJ5DvuwQ1WAE/HsMz+w17YgBCg==}
@@ -10580,6 +10575,13 @@ packages:
     dependencies:
       is-number: 7.0.0
 
+  /toml-eslint-parser@0.6.0:
+    resolution: {integrity: sha512-aTmQa0RFb+2URe8IZOfo/oxt3b5rlXlpG9xE+6FmeI8immCGLnZYvKVxbnCYJx4bIKIaEwl0BnCDhwO70yeWSA==}
+    engines: {node: ^12.22.0 || ^14.17.0 || >=16.0.0}
+    dependencies:
+      eslint-visitor-keys: 3.4.3
+    dev: false
+
   /tr46@0.0.3:
     resolution: {integrity: sha512-N3WMsuqV66lT30CrXNbEjx4GEwlow3v6rr4mCcv6prnfwhS01rkgyFdjPNBYd9br7LpXV1+Emh01fHnq2Gdgrw==}
     dev: false