Repository navigation
fix(deps): bump source-map-js to 1.2.2 for GHSA-68fv-2mgg-jv7q - #70
Merged
Merged
Conversation
source-map-js below 1.2.2 lets a crafted indexed source map stall the event loop through its section offsets (high). It is the only finding left in npm audit --omit=dev, because @tailwindcss/vite is declared in dependencies and pulls it in through @tailwindcss/node. - Every consumer (@tailwindcss/node, postcss, css-tree, magicast) asks for ^1.2.1, so npm update moves the single deduped copy to 1.2.2 and no parent changes. The lock diff is that one entry, three lines - It runs only at build and test time; the browser bundle is byte-identical to main (same asset hashes) - npm audit --omit=dev: 1 high -> 0. Full audit: 16 -> 15, the rest are dev-only paths under shadcn and are out of scope here - Gates: lint clean (same 7 warnings as main), build passes, 199 tests pass Tags: #deps #security Co-Authored-By: htjulia <htjulia1@gmail.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
source-map-jsbelow 1.2.2 has a high-severity advisory, GHSA-68fv-2mgg-jv7q: a crafted indexed source map can stall the event loop through its section offsets. It was the only finding left innpm audit --omit=dev. That's because@tailwindcss/viteis declared independenciesand pulls it in through@tailwindcss/node. Raised during the #69 review as a separate change.What
source-map-js1.2.1 -> 1.2.2, lockfile only.package.jsonis unchanged.^1.2.1:@tailwindcss/node,postcss,css-treeandmagicast. Sonpm update source-map-jsmoves the single deduped copy and no parent package changes. The lock diff is that one entry, three lines.Impact
source-map-jsruns only at build and test time. The browser bundle is byte-identical tomain, with the same asset hashes (index-B6lxbKS-.js,index-_pgovk26.css).Verification
npm audit --omit=dev: 1 high -> 0npm audit(all): 16 -> 15. The rest come through dev-only paths undershadcnand are out of scope here.npm run lint: exit 0, the same 7 warnings asmainnpm run build: passesnpm test: 17 files, 199 tests pass