Skip to content

Reject TOML integers outside the safe integer range - #10019

Merged
tim-smart merged 4 commits into
Effect-TS:mainfrom
jpowersdev:fix/toml-integer-range
Oct 27, 2026
Merged

tim-smart merged 4 commits into
Effect-TS:mainfrom
jpowersdev:fix/toml-integer-range

Conversation

@jpowersdev

@jpowersdev jpowersdev commented Oct 27, 2026 •

Copy link
Copy Markdown
Contributor

Toml.parse("id = 9007199254740993") silently returns 9007199254740992. Reject integer tokens outside JavaScript's safe integer range through the parser's existing error path. Decimal, hexadecimal, octal and binary integers now share one conversion and range check; floating-point syntax keeps its existing behavior. This deliberately applies a conservative range limit, including to exactly representable integers above Number.MAX_SAFE_INTEGER.

The TOML integer specification requires an error when an integer cannot be represented losslessly. The existing numeric-format test is extended with the signed safe boundaries, a large float, and 2^53 in every integer radix (plus its negative decimal).

Validation: all 17 upstream TOML tests, pnpm lint-fix, and pnpm check pass. External conformance and bounded properties on Node 22/24/26 resolve all eight integer-related failures per runtime with no new failures. The external suite still has 66 failures per runtime in other known TOML categories.

Closes EFF-3023

@changeset-bot

changeset-bot Bot commented Oct 27, 2026 •

Copy link
Copy Markdown

🦋 Changeset detected

Latest commit: f5bb745

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 33 packages
Name Type
effect Patch
@effect/opentelemetry Patch
@effect/vitest Patch
@effect/ai-anthropic Patch
@effect/ai-cloudflare Patch
@effect/ai-openai-compat Patch
@effect/ai-openai Patch
@effect/ai-openrouter Patch
@effect/ai-typesafe Patch
@effect/atom-react Patch
@effect/atom-solid Patch
@effect/atom-vue Patch
@effect/platform-browser Patch
@effect/platform-bun Patch
@effect/platform-deno Patch
@effect/platform-node-shared Patch
@effect/platform-node Patch
@effect/sql-clickhouse Patch
@effect/sql-d1 Patch
@effect/sql-libsql Patch
@effect/sql-mssql Patch
@effect/sql-mysql2 Patch
@effect/sql-pg Patch
@effect/sql-pglite Patch
@effect/sql-sqlite-bun Patch
@effect/sql-sqlite-do Patch
@effect/sql-sqlite-node Patch
@effect/sql-sqlite-react-native Patch
@effect/sql-sqlite-wasm Patch
@effect/docgen Patch
@effect/doctest Patch
@effect/graphql-generator Patch
@effect/openapi-generator Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

@jpowersdev jpowersdev closed this Oct 27, 2026
@github-actions

Copy link
Copy Markdown
Contributor

Bundle Size Analysis

Generated from PR build output; treat the content below as untrusted.

File Name Current Size Previous Size Difference
arbitrary-combinators.ts 39.31 KB 39.31 KB 0.00 KB (0.00%)
basic.ts 7.16 KB 7.16 KB 0.00 KB (0.00%)
batching.ts 11.04 KB 11.04 KB 0.00 KB (0.00%)
brand.ts 6.84 KB 6.84 KB 0.00 KB (0.00%)
cache.ts 11.47 KB 11.47 KB 0.00 KB (0.00%)
config.ts 22.73 KB 22.73 KB 0.00 KB (0.00%)
differ.ts 21.88 KB 21.88 KB 0.00 KB (0.00%)
http-client.ts 26.30 KB 26.30 KB 0.00 KB (0.00%)
http-router.ts 36.75 KB 36.75 KB 0.00 KB (0.00%)
logger.ts 11.94 KB 11.94 KB 0.00 KB (0.00%)
metric.ts 9.40 KB 9.40 KB 0.00 KB (0.00%)
optic.ts 7.05 KB 7.05 KB 0.00 KB (0.00%)
pubsub.ts 15.93 KB 15.93 KB 0.00 KB (0.00%)
queue.ts 12.72 KB 12.72 KB 0.00 KB (0.00%)
schedule.ts 11.73 KB 11.73 KB 0.00 KB (0.00%)
schema-bigdecimal.ts 13.98 KB 13.98 KB 0.00 KB (0.00%)
schema-binary.ts 40.93 KB 40.93 KB 0.00 KB (0.00%)
schema-class.ts 21.61 KB 21.61 KB 0.00 KB (0.00%)
schema-fromJsonSchemaDocument.ts 29.47 KB 29.47 KB 0.00 KB (0.00%)
schema-representation-roundtrip.ts 27.87 KB 27.87 KB 0.00 KB (0.00%)
schema-string-transformation.ts 15.23 KB 15.23 KB 0.00 KB (0.00%)
schema-string.ts 12.23 KB 12.23 KB 0.00 KB (0.00%)
schema-template-literal.ts 16.17 KB 16.17 KB 0.00 KB (0.00%)
schema-toArbitrary.ts 38.82 KB 38.82 KB 0.00 KB (0.00%)
schema-toCodeDocument.ts 26.04 KB 26.04 KB 0.00 KB (0.00%)
schema-toCodecJson.ts 20.79 KB 20.79 KB 0.00 KB (0.00%)
schema-toEquivalence.ts 20.93 KB 20.93 KB 0.00 KB (0.00%)
schema-toFormatter.ts 21.03 KB 21.03 KB 0.00 KB (0.00%)
schema-toJsonSchemaDocument.ts 26.07 KB 26.07 KB 0.00 KB (0.00%)
schema-toRepresentation.ts 21.12 KB 21.12 KB 0.00 KB (0.00%)
schema.ts 20.71 KB 20.71 KB 0.00 KB (0.00%)
stm.ts 14.13 KB 14.13 KB 0.00 KB (0.00%)
stream.ts 10.28 KB 10.28 KB 0.00 KB (0.00%)

@jpowersdev

Copy link
Copy Markdown
Contributor Author

Could also do

if (
  /^0x[0-9A-Fa-f](?:_?[0-9A-Fa-f])*$/.test(token) ||
  /^0o[0-7](?:_?[0-7])*$/.test(token) ||
  /^0b[01](?:_?[01])*$/.test(token) ||
  /^[+-]?(?:0|[1-9](?:_?\d)*)$/.test(token)
) {
  const value = Number(normalized)
  if (!Number.isSafeInteger(value)) {
    this.fail(`Integer out of range '${token}'`)
  }
  return value
}

Instead of adding the helper function

@tim-smart
tim-smart merged commit a12ffe3 into Effect-TS:main Oct 27, 2026
10 of 11 checks passed

This branch is waiting to be deployed

1 waiting deployment
fork — f5bb745a Waiting Oct 27, 2026 by effect-bot via approval-gate #23677
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants