[dependabot]

Decision Conclusion

Upgrade the locked source-map-js dependency from 1.2.1 to 1.2.2 to fix CVE-2026-93749, and exercise the actual decoder and PostCSS consumer. The original lock upgrade is Dependabot's proposal; this follow-up adds bounded behavior verification and fresh host source evidence.

Current Problem

The installed 1.2.1 dependency, consumed by Tailwind and Vite/PostCSS, accepts malicious indexed source-map offsets and expands nested source lookups exponentially. The same bounded probe fails two cases on 1.2.1, including a child-process timeout, while patched 1.2.2 passes all three behavior tests. The upstream fix is 7rulnik/source-map-js#79.

Business SSOT

No business SSOT change. docs/architecture.md and docs/decisions.md remain unchanged; this is the existing Cloud build-tool dependency owner.

Development SSOT

W27.development-governance owns the lock file and focused tool tests. #764 admitted the exact host-owned lock companion on canonical main; worker protected-file rejection remains unchanged.

Baseline

Base SHA: aeb8856
Baseline refresh: integrated the merged canonical prerequisite; no historical receipt was rewritten.

Ownership

DDD owner: cloud
Phase: W27.development-governance

Write Set

• package-lock.json
• tests/tools/source-map-dependency.test.ts
• docs/evidence/source-checks/

Receipt Pipeline

• receipt: source-check; result: passed; path: docs/evidence/source-checks/w27-source-map-security-20261011-dependency-behavior-1.json

Acceptance Criteria

• The installed locked graph resolves source-map-js 1.2.2 for both current Tailwind and PostCSS consumers.
• Malformed and excessive nested offsets are refused, deep maps complete in a bounded process, and valid PostCSS maps preserve source positions and contents.
• The actual isolated host executes the declared dependency gate with zero failures, skips or TODOs and exports the corresponding source-check.

Verification

• Old dependency reproduction, using the same test source with the pre-upgrade 1.2.1 installation: 3 executed, 2 failed, 1 passed; the deep-map child is terminated at its 2-second bound. This is a local synthetic adversarial test, not a production probe.
• Patched local behavior: 3 executed, 0 failed, 0 skipped, 0 TODO. Vite local build passes; npm ls binds the 1.2.2 instance to Tailwind and PostCSS.
• Sealed host run w27-source-map-security-20261011 on the declared exact base, current runner 6855bc77cb4288515ba2ea1ef588d3ab23bb293945d8f54bec3d82f901ec1064: dependency-behavior 3/0/0, exit 0; stage receipt 3f453c1a889a577be43a4562bec6293d162c1fa9defac57acf91ddce54373aa4; captured output 65ab4917ef3130819db4e606f3d7687b728dcab1967b283eb3df2bf81a3f9325. The host-exported source-check binds the complete actual write set.

Limitations

Source and local build only. No installed App, Candidate, instance/provider deployment, production browser or business acceptance is claimed. The CSP fix listed by upstream is not a separately exercised production-browser claim here. Current-revision CI and an exact technical review still gate merge.

Terminal State

Terminal state: source-complete

Merge Danger

Merge danger: low. A compatible patch release in the existing locked graph, focused dependency behavior tests and host-exported source evidence; no product contract, service, wallet, secret or provider state changes.

Original Dependabot proposal, preserved unchanged

Bumps source-map-js from 1.2.1 to 1.2.2.

Release notes

Sourced from source-map-js's releases.

v1.2.2

• Fix crash when executing in browser with CSP script-src that don't permit unsafe-eval (#29) @​xfournet

• Fix denial of service from malicious indexed source maps (CVE-2026-93749) (#79)

  Reported by @​waydeshi in #76. A fix was also proposed by @​aniebiet in #78.

Changelog

Sourced from source-map-js's changelog.

1.2.2

• Fix crash when executing in browser with CSP script-src that don't permit unsafe-eval (#29) @​xfournet

• Fix denial of service from malicious indexed source maps (CVE-2026-93749) (#79)

  Reported by @​waydeshi in #76. A fix was also proposed by @​aniebiet in #78.

Commits

• 0a1d334 1.2.2
• 4c6fa26 Update changelog
• cf76580 Fix denial of service from malicious indexed source maps (CVE-2026-93749) (#79)
• 7899a86 Fix crash when executing browser with CSP script-src that don't permit unsafe...
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.

[gaofeng21cn]

Technical review of head 003242f against base aeb8856: no actionable findings. The lock selects the upstream compatible 1.2.2 patch for the actual Tailwind/PostCSS graph; npm installation verifies the recorded integrity. The added behavior probe exercises the real decoder and PostCSS consumer: malformed and excessive cumulative section offsets are rejected, a 40-level indexed map completes in a child bounded to 2 seconds, and valid CSS preserves positions/source contents. The same local probe fails two cases on 1.2.1, including the bounded child timeout; patched local and sealed-host executions pass all three cases. Local Vite build also passes.

The actual host receipt for w27-source-map-security-20261011 binds current phase, runner, locked manifest inputs, complete changed-content hashes and 3 executed / 0 failed / 0 skipped / exit 0 (stage hash 3f453c1a889a577be43a4562bec6293d162c1fa9defac57acf91ddce54373aa4). The required host lock admission is canonical via #764. Dependabot's original proposal is preserved unchanged in the body; the new tests and host evidence are this follow-up's contribution.

All three current checks are successful in https://github.com/gaofeng21cn/one-person-lab-cloud/actions/runs/38099903140. After exact head/base, body and review readback, gaofeng21cn merged this PR at 2e64461; canonical main was read back at that merge. Acceptance covers source dependency behavior and a local build with synthetic adversarial input. Installed App, Candidate, production browser, deployment and business acceptance are unproved; upstream's CSP fix is not presented as separately exercised production evidence.

Operation: github-ci-cloud-followup-20261011-pr763-review