From 9abdddedc2c3414927a9feabc933e35e1de0f109 Mon Sep 17 00:00:00 2001 From: htjulia Date: Tue, 6 Oct 2026 11:33:59 +0900 Subject: [PATCH] fix(deps): bump source-map-js to 1.2.2 for GHSA-68fv-2mgg-jv7q source-map-js below 1.2.2 lets a crafted indexed source map stall the event loop through its section offsets (high). It is the only finding left in npm audit --omit=dev, because @tailwindcss/vite is declared in dependencies and pulls it in through @tailwindcss/node. - Every consumer (@tailwindcss/node, postcss, css-tree, magicast) asks for ^1.2.1, so npm update moves the single deduped copy to 1.2.2 and no parent changes. The lock diff is that one entry, three lines - It runs only at build and test time; the browser bundle is byte-identical to main (same asset hashes) - npm audit --omit=dev: 1 high -> 0. Full audit: 16 -> 15, the rest are dev-only paths under shadcn and are out of scope here - Gates: lint clean (same 7 warnings as main), build passes, 199 tests pass Tags: #deps #security Co-Authored-By: htjulia --- package-lock.json | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/package-lock.json b/package-lock.json index 1da3f8d..d48e77f 100644 --- a/package-lock.json +++ b/package-lock.json @@ -6600,9 +6600,9 @@ } }, "node_modules/source-map-js": { - "version": "1.2.1", - "resolved": "https://registry.npmjs.org/source-map-js/-/source-map-js-1.2.1.tgz", - "integrity": "sha512-UXWMKhLOwVKb728IUtQPXxfYU+usdybtUrK/8uGE8CQMvrhOpwvzDBwj0QhSL7MQc7vIsISBG8VQ8+IDQxpfQA==", + "version": "1.2.2", + "resolved": "https://registry.npmjs.org/source-map-js/-/source-map-js-1.2.2.tgz", + "integrity": "sha512-KGj/8Y43x35aZVDtt+J4mK1hoLGHULMYfSkODJNQjNDC3oW1PqPoxMwo0pLUsWM/UEGzON/NxeHywEfNXNP3Vw==", "license": "BSD-3-Clause", "engines": { "node": ">=0.10.0"