build(deps): bump source-map-js from 1.2.1 to 1.2.2

[dependabot]

Bumps source-map-js from 1.2.1 to 1.2.2.

Release notes

Sourced from source-map-js's releases.

v1.2.2

• Fix crash when executing in browser with CSP script-src that don't permit unsafe-eval (#29) @​xfournet

• Fix denial of service from malicious indexed source maps (CVE-2026-93749) (#79)

  Reported by @​waydeshi in #76. A fix was also proposed by @​aniebiet in #78.

Changelog

Sourced from source-map-js's changelog.

1.2.2

• Fix crash when executing in browser with CSP script-src that don't permit unsafe-eval (#29) @​xfournet

• Fix denial of service from malicious indexed source maps (CVE-2026-93749) (#79)

  Reported by @​waydeshi in #76. A fix was also proposed by @​aniebiet in #78.

Commits

• 0a1d334 1.2.2
• 4c6fa26 Update changelog
• cf76580 Fix denial of service from malicious indexed source maps (CVE-2026-93749) (#79)
• 7899a86 Fix crash when executing browser with CSP script-src that don't permit unsafe...
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.

[clawsweeper]

🦞👀
ClawSweeper picked this up.

Pull request received. I will update this pull request when review starts.

ClawSweeper review complete

ClawSweeper finished reviewing this revision. The review result is being finalized.

View the workflow run.

[clawsweeper]

Codex review: needs maintainer review before merge.

What this changes

This PR updates PostCSS’s locked source-map-js dependency to 1.2.2 and removes the unused 1.2.1 entries.

Review scores

Measure	Result	What it means
Overall readiness	🦐 gold shrimp (3/6)	The patch is narrow and source-verified, with no actionable defect found; integration validation remains incomplete while the existing checks run.
Proof confidence	🌊 off-meta tidepool	Not applicable: This routine Dependabot lockfile update is outside the contributor runtime-proof gate; upstream tests support the dependency fixes but do not prove Oracle runtime exposure or exercise this PR through a shipped entry point.
Patch quality	🐚 platinum hermit (4/6)	No actionable review findings were identified.

Product

Kind: Maintenance · Worth it: Yes · Fix scope: Complete
User problem: Development tooling retains a source-map library version with an upstream denial-of-service vulnerability.
Reason: The update eliminates the remaining old resolution without adding options, changing Oracle behavior, or introducing a parallel dependency owner.

Merge readiness

✅ Ready for maintainer review

Keep this PR open: it removes the remaining source-map-js 1.2.1 resolution in favor of an upstream security fix, with no concrete patch defect found; repository policy also disables automatic closing.

Priority: P2
Reviewed head: cd316e6cc5f29415b2de2298e2aa81a9c0243ecd

Before merge

None.

Findings

None.

Agent review details

How this fits together

The changed dependency sits beneath development tooling: Vitest uses Vite, which depends on PostCSS and its source-map processing library.

flowchart LR
  A[Development tests] --> B[Vitest]
  B --> C[Vite]
  C --> D[PostCSS]
  D --> E[source-map-js]
  E --> F[Source mappings]

Loading

Technical review

Best possible solution:

Land the focused lockfile update once the existing validation checks pass.

Do we have a high-confidence way to reproduce the issue?

This is dependency maintenance rather than a reproduced Oracle bug; upstream source verifies the vulnerable processing paths and their fixes.

Is this the best way to solve the issue?

Updating the remaining transitive resolution is the narrowest repair and reuses a package version already present on main.

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning medium; reviewed against 7676f562682d.

Provenance checked

• PostCSS source-map-js lockfile resolution keeps the original intent (2e17bf7: Supplied provenance attributes the old entries to the pnpm/Vitest migration, whose commit message was verified through REST. Local historical blob reads failed, and the commit-to-PR lookup returned no associated PR; a more detailed original rationale is unavailable.)

Testing

Proof path: none.

Security

None.

Evidence

What I checked:

• Verified introduced patch: The pinned diff changes only PostCSS’s source-map-js resolution from 1.2.1 to 1.2.2 and deletes the obsolete package and snapshot entries. The 1.2.2 integrity entry already exists on main. (pnpm-lock.yaml:3982, cd316e6cc5f2)
• Dependency boundary: Main still resolves PostCSS to source-map-js 1.2.1, while magicast already resolves 1.2.2. The Vitest → Vite → PostCSS dependency chain establishes actual tooling consumption of the changed dependency; it does not establish exposure in Oracle’s ChatGPT browser mode. (pnpm-lock.yaml:3986, 7676f562682d)
• Verified upstream fixes: The release comparison implements bounded indexed-map offsets, avoids repeated nested sources lookups, improves large line-gap serialization, and stops padding beyond generated code. The merged fix at Fix denial of service from malicious indexed source maps (CVE-2026-93749) 7rulnik/source-map-js#79 addresses the report at Security Advisory: Event-loop denial of service in SourceNode via unvalidated section offset line 7rulnik/source-map-js#76 and credits an earlier proposal at Fix CVE-2026-93749: validate section offsets in indexed source maps 7rulnik/source-map-js#78. The separate CSP fix is Fix crash when executing in browser with CSP script-src that don't permit unsafe-eval 7rulnik/source-map-js#29. (lib/source-map-consumer.js, 0a1d334fd1e5)
• Registry metadata and dependency policy: npm’s published 1.2.2 integrity matches the existing lockfile entry; package metadata adds no runtime dependencies or install lifecycle hooks. No AGENTS.md exists in the upstream release tree. (package.json, 0a1d334fd1e5)
• Feature history and inspection limit: History identifies the original pnpm/Vitest migration and repeated subsequent tooling maintenance. ci: complete Vitest 5 migration on Node 24 and 26 #494 documents the owner-authored Vitest migration and Node 24/26 validation contract. Some historical blobs are unavailable for local show/blame; commit metadata and the relevant CI patch were independently verified through REST. (.github/workflows/ci.yml:22, 82ca71d441b9)
• Current head and checks: GitHub confirms the reviewed head and reports it mergeable. GitGuardian passed; eight workflow jobs remain queued or running, with no recorded failure. No review approval or changed-path runtime evidence was supplied. (.github/workflows/ci.yml, cd316e6cc5f2)

Labels

Label changes:

• add P2: A focused dependency security update with a verified development-tooling path, without evidence of an urgent Oracle runtime failure.
• add rating: 🦐 gold shrimp: Overall readiness is 🦐 gold shrimp; proof is 🌊 off-meta tidepool and patch quality is 🐚 platinum hermit.
• add status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR.

Label justifications:

• P2: A focused dependency security update with a verified development-tooling path, without evidence of an urgent Oracle runtime failure.
• rating: 🦐 gold shrimp: Overall readiness is 🦐 gold shrimp; proof is 🌊 off-meta tidepool and patch quality is 🐚 platinum hermit.
• status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR.

Rating scale

6/6 🦀 challenger crab · 5/6 🦞 diamond lobster · 4/6 🐚 platinum hermit · 3/6 🦐 gold shrimp · 2/6 🦪 silver shellfish · 1/6 🧂 unranked krab. Overall follows the weaker of proof and patch quality; ✨ marks media proof (a screenshot, video, or linked artifact) that directly shows the changed behavior.

Workflow

ClawSweeper edits this one comment on every review. Comment @clawsweeper re-review for a fresh review only; repair and merge need explicit maintainer commands such as @clawsweeper autofix or @clawsweeper automerge.

Reviewed October 10, 2026, 12:20 AM ET / 04:20 UTC.