build(deps): override smol-toml to 1.7.1

[jpyzio123]

Summary

• override the vulnerable transitive smol-toml@1.6.1 used by Nx with patched 1.7.1
• scope the override to Nx instead of applying it repository-wide
• resolve the High-severity Dependabot alert tracked in AC-4477

Nx currently hard-pins smol-toml@1.6.1. The latest compatible Nx 22 release, as well as Nx 23.2.1, still uses that vulnerable version, so a parent-package bump cannot resolve the alert yet.

Dependabot alert: https://github.com/livechat/design-system/security/dependabot/507

Validation

• npm explain smol-toml resolves 1.7.1 through the scoped override
• npm audit reports 0 High and 0 Critical vulnerabilities
• npm test
• npm run build
• commit hooks and TypeScript type-check

[Copilot]

🟢 Approval recommended

The override is correctly scoped to nx and the lockfile reflects smol-toml@1.7.1 as the resolved installed version.

Pull request overview

This PR mitigates a high-severity vulnerability by using an npm overrides rule to replace Nx’s transitive dependency on smol-toml@1.6.1 with the patched smol-toml@1.7.1, while keeping the override scoped to Nx rather than applying it globally across the workspace.

Changes:

• Add a scoped npm override so only nx resolves smol-toml to 1.7.1.
• Update package-lock.json to reflect smol-toml@1.7.1 as the installed version.

File summaries

File	Description
package.json	Adds a scoped overrides.nx.smol-toml = 1.7.1 rule to address the vulnerability without a repo-wide override.
package-lock.json	Updates the resolved node_modules/smol-toml entry to 1.7.1 (including updated integrity metadata).

Review details

• Files reviewed: 1/2 changed files
• Comments generated: 0
• Review effort level: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.