build(deps): bump source-map-js from 1.2.1 to 1.2.2 in the npm_and_yarn group across 1 directory

[dependabot]

Bumps the npm_and_yarn group with 1 update in the / directory: source-map-js.

Updates source-map-js from 1.2.1 to 1.2.2

Release notes

Sourced from source-map-js's releases.

v1.2.2

• Fix crash when executing in browser with CSP script-src that don't permit unsafe-eval (#29) @​xfournet

• Fix denial of service from malicious indexed source maps (CVE-2026-93749) (#79)

  Reported by @​waydeshi in #76. A fix was also proposed by @​aniebiet in #78.

Changelog

Sourced from source-map-js's changelog.

1.2.2

• Fix crash when executing in browser with CSP script-src that don't permit unsafe-eval (#29) @​xfournet

• Fix denial of service from malicious indexed source maps (CVE-2026-93749) (#79)

  Reported by @​waydeshi in #76. A fix was also proposed by @​aniebiet in #78.

Commits

• 0a1d334 1.2.2
• 4c6fa26 Update changelog
• cf76580 Fix denial of service from malicious indexed source maps (CVE-2026-93749) (#79)
• 7899a86 Fix crash when executing browser with CSP script-src that don't permit unsafe...
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions
  You can disable automated security fix PRs for this repo from the Security Alerts page.

[clawsweeper]

🦞👀
ClawSweeper picked this up.

Pull request received. I will update this pull request when review starts.

ClawSweeper review complete

ClawSweeper finished reviewing this revision. The review result is being finalized.

View the workflow run.

[clawsweeper]

Codex review: needs maintainer review before merge.

What this changes

This PR updates source-map-js from 1.2.1 to 1.2.2 throughout the pnpm lockfile.

Example: A source-map consumer receives an indexed map with offset.line set to 100000000.

• Before: Upstream reports that processing the map can exhaust memory.
• After: Version 1.2.2 rejects the excessive offset immediately.

Review scores

Measure	Result	What it means
Overall readiness	🦐 gold shrimp (3/6)	The patch is focused and passes existing gates; behavioral evidence is upstream and test-based.
Proof confidence	🦐 gold shrimp (3/6)	This Dependabot maintenance PR is outside the ordinary contributor proof gate; passing CI supports compatibility, while upstream demonstrations cover the library fixes rather than a SweetLink runtime scenario.
Patch quality	🐚 platinum hermit (4/6)	No actionable review findings were identified.

Product

Kind: Maintenance · Worth it: Yes · Fix scope: Complete
User problem: Development tooling retains a source-map library with upstream CSP failures and crafted-map denial-of-service paths.
Reason: The patch advances one existing transitive dependency to a verified corrective release without changing SweetLink configuration or public APIs.

Merge readiness

✅ Ready for maintainer review

Keep this PR open: it is a focused dependency update with verified upstream fixes, passing checks, and no actionable patch defects.

Priority: P2
Reviewed head: e6e2e5b9b355a1a15d8a775ea592a68fd8ea453e

Before merge

None.

Findings

None.

Tests

• Missing end-to-end proof: CI validates installation and tooling compatibility, but does not demonstrate the changed CSP or malicious-map paths through a SweetLink entry point.

Agent review details

How this fits together

The workspace lockfile supplies source-map-js to css-tree, magicast, and PostCSS for development tooling; these consumers generate or process source maps.

flowchart LR
  A[Workspace lockfile] --> B[source-map-js 1.2.2]
  C[Source maps] --> B
  B --> D[PostCSS and Vite]
  B --> E[css-tree and jsdom]
  B --> F[magicast]
  D --> G[Build and test tooling]
  E --> G
  F --> G

Loading

Technical review

Best possible solution:

Land the focused lockfile update through the repository's normal maintainer workflow.

Do we have a high-confidence way to reproduce the issue?

Upstream provides concrete failing inputs and before/after results, but this PR establishes no SweetLink-specific reproduction and none was run during this read-only review.

Is this the best way to solve the issue?

Updating the existing transitive resolution is the narrowest solution; all consumers move together without adding an override or parallel implementation.

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning medium; reviewed against 8d848a0b6275.

Provenance checked

• Transitive source-map-js resolution keeps the original intent (unknown: History associates the existing resolution with sync, browser-test, and dependency-refresh commits; GitHub commit messages provide no deliberate pinning rationale, and git show of the older sync commit failed because an old blob is unavailable.)

Testing

Proof path: unit tests only.

Security

None.

Evidence

What I checked:

• Verified introduced change: The pinned introduction diff changes only the package version, integrity, three consumer references, and package snapshot; all references agree on 1.2.2. (pnpm-lock.yaml:1470, e6e2e5b9b355)
• Still needed on main: Fetched main still resolves source-map-js 1.2.1; repository search found no competing update for this dependency. (pnpm-lock.yaml:1470, 8d848a0b6275)
• Validation on reviewed head: The successful CI job exercised frozen installation, lint, typecheck, tests, workspace/example builds, and built CLI/daemon help on the reviewed head; GitGuardian also passed. (.github/workflows/ci.yml:29, e6e2e5b9b355)
• Dependency contract and upstream fixes: The changed lockfile resolves this dependency for three tooling consumers, making its runtime contract relevant. The release includes the CSP fallback from Fix crash when executing in browser with CSP script-src that don't permit unsafe-eval 7rulnik/source-map-js#29 and indexed-map denial-of-service fixes from Fix denial of service from malicious indexed source maps (CVE-2026-93749) 7rulnik/source-map-js#79; production hunks and regression tests support those claims. (lib/source-map-consumer.js, 0a1d334fd1e5)
• Registry integrity and release-age policy: The new integrity matches npm metadata for source-map-js 1.2.2, which has no runtime dependencies or install lifecycle hooks; its September 30 release predates this PR by more than the workspace's 24-hour cooldown. (pnpm-lock.yaml:1471, e6e2e5b9b355)
• Feature history and local limit: Dependency history consistently routes to Peter Steinberger, including merged chore(deps): refresh dependencies #15 and build(deps): refresh tooling and prepare 0.2.4 #21. Some older blobs are unavailable locally, so the original reason for the historical 1.2.1 resolution remains unknown. (pnpm-lock.yaml:2618, 8d848a0b6275)

Labels

Label changes:

No label changes.

Label justifications:

• P2: This is a narrow tooling dependency update with upstream security value; no affected SweetLink production workflow has been established.
• rating: 🦐 gold shrimp: Overall readiness is 🦐 gold shrimp; proof is 🦐 gold shrimp and patch quality is 🐚 platinum hermit.
• status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR.

Rating scale

6/6 🦀 challenger crab · 5/6 🦞 diamond lobster · 4/6 🐚 platinum hermit · 3/6 🦐 gold shrimp · 2/6 🦪 silver shellfish · 1/6 🧂 unranked krab. Overall follows the weaker of proof and patch quality; ✨ marks media proof (a screenshot, video, or linked artifact) that directly shows the changed behavior.

Workflow

ClawSweeper edits this one comment on every review. Comment @clawsweeper re-review for a fresh review only. Repair and merge execution lanes are retired.

History

Review history (15 earlier review cycles; latest 8 shown)

• reviewed 2026-10-13T19:43:48.945Z sha e6e2e5b :: needs maintainer review before merge. :: none
• reviewed 2026-10-13T21:24:01.666Z sha e6e2e5b :: needs maintainer review before merge. :: none
• reviewed 2026-10-14T01:17:02.228Z sha e6e2e5b :: needs maintainer review before merge. :: none
• reviewed 2026-10-14T03:30:55.717Z sha e6e2e5b :: needs maintainer review before merge. :: none
• reviewed 2026-10-14T07:08:05.405Z sha e6e2e5b :: needs maintainer review before merge. :: none
• reviewed 2026-10-14T08:34:50.497Z sha e6e2e5b :: needs maintainer review before merge. :: none
• reviewed 2026-10-14T10:00:04.116Z sha e6e2e5b :: needs maintainer review before merge. :: none
• reviewed 2026-10-14T13:47:11.975Z sha e6e2e5b :: needs maintainer review before merge. :: none

Reviewed October 14, 2026, 11:30 AM ET / 15:30 UTC (Revision 16).