build(deps): refresh eligible dependencies and source-map security fix

[dependabot]

Update the remaining source-map-js 1.2.1 resolution to 1.2.2, including the upstream indexed source-map denial-of-service fix (CVE-2026-93749). Fold in the currently eligible compatible updates to pi-tui, LogTape, arkregex, and Vite.

Resolved with pnpm's strict release-age policy. Keep Node.js 24, TypeScript 6 for TypeDoc compatibility, and Vitest 4. The Unreleased changelog credits @dependabot.

Validation: frozen install, build, lint, typecheck, complete Linux CI test suite, coverage, release-guard tests, API documentation generation, and built CLI smoke tests on AWS Crabbox. The Go example passes govulncheck ./... using Go 1.27.2. Independent Codex autoreview is clean through P2. All seven checks passed at final PR head 28ecc426b81b4528b1701d731312c3aeab642ac3; post-merge main CI and coverage also passed. Dependabot alert #32 is confirmed fixed.

Original dependency update by @dependabot.

[clawsweeper]

🦞👀
ClawSweeper picked this up.

Pull request received. I will update this pull request when review starts.

ClawSweeper review complete

ClawSweeper finished reviewing this revision. The review result is being finalized.

View the workflow run.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-07T10:02:12.113590Z	754b565	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[clawsweeper]

Codex review: needs maintainer review before merge.

What this changes

Updates four direct dependencies and the remaining source-map-js resolution, with an Unreleased changelog entry.

Example: A frozen dependency installation prepares Vitest coverage tooling.

• Before: Magicast resolves source-map-js 1.2.1.
• After: Magicast resolves source-map-js 1.2.2, which includes the indexed source-map denial-of-service repair.

Review scores

Measure	Result	What it means
Overall readiness	🦐 gold shrimp (3/6)	A useful, focused patch with passing head checks and no identified defect; direct evidence of the changed runtime behavior remains limited.
Proof confidence	🦐 gold shrimp (3/6)	Bot-authored dependency maintenance is outside the contributor proof gate; passing checks and declared CLI smoke tests support compatibility but do not directly exercise the repaired source-map input or interactive panel behavior.
Patch quality	🐚 platinum hermit (4/6)	No actionable review findings were identified.

Product

Kind: Maintenance · Worth it: Yes · Fix scope: Complete
User problem: Development coverage tooling retains an older source-map library, while panel, logging, and glob libraries have eligible updates.
Reason: The upstream security repair and compatible refresh have clear maintenance value, preserve the documented runtime floors, and continue the owner’s merged dependency direction.

Merge readiness

✅ Ready for maintainer review

Keep open: this PR completes a useful security update and dependency refresh that current main does not contain; no actionable patch defect was found, and all seven checks pass on the reviewed head.

Priority: P2
Reviewed head: 28ecc426b81b4528b1701d731312c3aeab642ac3

Before merge

None.

Findings

None.

Tests

• Missing end-to-end proof: Supplied checks and CLI smoke claims do not demonstrate an interactive panel run or the malicious indexed-source-map scenario.

Agent review details

How this fits together

The manifest and lockfile supply libraries for Poltergeist’s terminal panel, logging, file-pattern matching, and development tooling.

flowchart TD
  A[Dependency installation] --> B[Manifest and lockfile]
  B --> C[Panel logging and glob libraries]
  C --> D[Poltergeist CLI]
  B --> E[Vitest coverage tooling]
  E --> F[Magicast]
  F --> G[Source map processing]

Loading

Technical review

Best possible solution:

Land the compatible dependency refresh with the single repaired source-map resolution and existing runtime requirements preserved.

Do we have a high-confidence way to reproduce the issue?

No Poltergeist failure is reported or reproduced; upstream source and regression tests establish the security repair supplied by source-map-js 1.2.2.

Is this the best way to solve the issue?

The existing dependency owners and published versions provide the repair without application changes, and inspected consumer contracts reveal no required adaptation.

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning medium; reviewed against b7d441c4118a.

Provenance checked

• Runtime and development dependency versions keeps the original intent (build(deps): refresh eligible runtime and tooling dependencies #269: Refresh compatible dependencies while preserving Node.js 24, TypeScript 6, Vitest 4, the UUID override, and release-age eligibility.)
• Magicast source-map-js lockfile resolution keeps the original intent (0e1fb9b: The commit adopted pnpm and recorded its dependency graph; no associated PR was returned.)

Testing

Proof path: unit tests only.

Security

None.

Evidence

What I checked:

• Complete introduced diff: The pinned diff changes only CHANGELOG.md, package.json, and pnpm-lock.yaml. Manifest versions and lockfile references agree; Node.js 24, TypeScript 6, Vitest 4, scripts, dependency sources, and the UUID override remain unchanged. (package.json:90, 28ecc426b81b)
• Still necessary on main and in the release: Main still resolves Magicast to source-map-js 1.2.1, as does v2.1.8. The merged refresh at build(deps): refresh eligible runtime and tooling dependencies #269 deliberately held then-ineligible releases and left this source-map resolution behind. (pnpm-lock.yaml:2032, b7d441c4118a)
• Dependency consumption boundary: Application imports consume pi-tui, LogTape, and arkregex. Vitest coverage consumes Magicast, whose source-map-js resolution is changed; these concrete consumers justify inspecting the upstream contracts. (pnpm-lock.yaml:1757, 28ecc426b81b)
• Upstream security repair: The complete 7rulnik/source-map-js@v1.2.1...v1.2.2 comparison repairs malicious indexed-map offsets, repeated nested source traversal, excessive line-gap allocation, and CSP compatibility, with regression tests and no added dependency or install hook. (lib/source-map-consumer.js, 0a1d334fd1e5)
• Terminal compatibility: earendil-works/pi@v1.0.4...v1.1.0 adds required Terminal.setProgramStatus and implements it in ProcessTerminal. Poltergeist uses ProcessTerminal rather than a custom Terminal implementation; its protected diagnostic paths are unaffected by the upstream production changes. (packages/tui/src/terminal.ts, abe508e1b899)
• Logging contract: dahlia/logtape@2.3.11...2.4.0 documents additive logging capabilities and preserves existing defaults; Poltergeist does not enable the new source-location, queue-limit, or sink-inheritance options. (CHANGES.md, 52c5dc71b4c0)

Likely related people:

• dependabot[bot]: Raw commit ff2bc8c adds package.json:93 relative to its recorded parents. This identifies author metadata, not feature responsibility or a PR merger. (role: source-line author; confidence: medium; commits: ff2bc8ca7e90; files: package.json)

Review metrics

Metric	Value	Why it matters
Change scope	4 direct dependency updates; 1 remaining source-map resolution repaired; 0 application-source changes	The manifest and lockfile churn is justified by the dependency refresh without growing Poltergeist’s implementation.

Labels

Label changes:

No label changes.

Label justifications:

• P2: A bounded dependency maintenance update includes an upstream denial-of-service repair, with no demonstrated urgent production failure.
• rating: 🦐 gold shrimp: Overall readiness is 🦐 gold shrimp; proof is 🦐 gold shrimp and patch quality is 🐚 platinum hermit.
• status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR.

Rating scale

6/6 🦀 challenger crab · 5/6 🦞 diamond lobster · 4/6 🐚 platinum hermit · 3/6 🦐 gold shrimp · 2/6 🦪 silver shellfish · 1/6 🧂 unranked krab. Overall follows the weaker of proof and patch quality; ✨ marks media proof (a screenshot, video, or linked artifact) that directly shows the changed behavior.

Workflow

ClawSweeper edits this one comment on every review. Comment @clawsweeper re-review for a fresh review only; repair and merge need explicit maintainer commands such as @clawsweeper autofix or @clawsweeper automerge.

History

Review history (14 earlier review cycles; latest 8 shown)

• reviewed 2026-10-08T15:31:13.484Z sha e526654 :: needs maintainer review before merge. :: none
• reviewed 2026-10-08T18:55:34.532Z sha e526654 :: needs maintainer review before merge. :: none
• reviewed 2026-10-08T23:47:33.221Z sha e526654 :: needs maintainer review before merge. :: none
• reviewed 2026-10-09T02:45:33.761Z sha e526654 :: needs maintainer review before merge. :: none
• reviewed 2026-10-09T04:56:59.773Z sha e526654 :: needs maintainer review before merge. :: none
• reviewed 2026-10-09T06:46:51.470Z sha e526654 :: needs maintainer review before merge. :: none
• reviewed 2026-10-09T11:01:31.556Z sha e526654 :: needs maintainer review before merge. :: none
• reviewed 2026-10-09T14:53:39.032Z sha e526654 :: needs maintainer review before merge. :: none

Reviewed October 10, 2026, 6:58 AM ET / 10:58 UTC (Revision 15).