Repository navigation
chore: bump source-map-js from 1.2.1 to 1.2.2 - #55
Merged
Merged
Conversation
dependabot
Bot
added
dependencies
decofe
marked this pull request as draft
October 15, 2026 06:23
decofe
changed the title
sds
added a commit
that referenced
this pull request
Oct 21, 2026
Vite 8.2.2 bundles vulnerable editor-launching code that can allow command execution on Windows or WSL under the conditions described in the upstream advisories. Pin Vite to the patched 8.2.4 release and update its lockfile entry; the installed bundle contains launch-editor 2.14.2, and all Vitest consumers resolve to the same patched Vite copy. Addresses the three advisories reported by [Dependabot alerts 5–10](https://github.com/tempoxyz/plugins/security/dependabot): [GHSA-698v-4r3x-3vcv](GHSA-698v-4r3x-3vcv), [GHSA-587h-7wmj-h5pm](GHSA-587h-7wmj-h5pm), and [GHSA-r825-w8mm-5pxw](GHSA-r825-w8mm-5pxw). Vite is development tooling in this repository. This change does not establish deployment or downstream adoption. Validation: - Clean `npm ci --ignore-scripts` succeeds. - `npm test` passes: type checking, JSON formatting, generated manifests, Gemini build, and 48 tests. - `claude plugin validate --strict .` and `gh skill publish --dry-run` pass. - Live MCP tests with the sandbox HTTP proxy enabled: Tempo Docs passes; Mercator fails because its initialize endpoint returns HTTP 200 while the existing test expects 401. Direct connections time out in this sandbox. Live MCP validation is therefore incomplete. This keeps the existing Vite 8.2 release line. The broader Vite update is also proposed in [PR #66](#66). The separate source-map-js alert is outside this change and has [PR #55](#55). Prompted by: @sds Co-authored-by: Shane da Silva <shane@tempo.xyz>
dependabot
Bot
changed the title
dependabot
Bot
force-pushed
the
dependabot/npm_and_yarn/source-map-js-1.2.2
branch
from
October 21, 2026 21:24
c3044b5 to
e8d6a2c
Compare
Bumps [source-map-js](https://github.com/7rulnik/source-map-js) from 1.2.1 to 1.2.2. - [Release notes](https://github.com/7rulnik/source-map-js/releases) - [Changelog](https://github.com/7rulnik/source-map-js/blob/main/CHANGELOG.md) - [Commits](7rulnik/source-map-js@v1.2.1...v1.2.2) --- updated-dependencies: - dependency-name: source-map-js dependency-version: 1.2.2 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
force-pushed
the
dependabot/npm_and_yarn/source-map-js-1.2.2
branch
from
October 21, 2026 21:35
e8d6a2c to
a541982
Compare
sds
marked this pull request as ready for review
October 22, 2026 00:12
![claude[bot]](https://avatars.githubusercontent.com/in/1236702?s=60&v=4){kind=small}
There was a problem hiding this comment.
LGTM. This is a routine lockfile bump of a dev-only transitive dependency.
What was reviewed:
- package-lock.json: source-map-js moves from 1.2.1 to 1.2.2. The version, the resolved tarball URL (official registry.npmjs.org) and the replaced sha512 integrity all change together, and the entry is still
dev: true. - The only dependent's range (
^1.2.1, line 1749) accepts 1.2.2, so nothing else in the tree has to change. - I couldn't check the new integrity hash against the registry from here. npm checks it against the tarball at install time.
Extended reasoning...
The only change is one package-lock.json entry for source-map-js, a dev-only transitive dependency, moving from 1.2.1 to 1.2.2. The version, resolved URL and integrity hash changed together, and the URL points at the official npm registry. No application source, config or package.json is touched, and no runtime code or security-sensitive code path is involved. The repo has no CODEOWNERS or ANTOWNERS file, the timeline shows no outstanding reviewer objections, and the bug hunt ran until it stopped finding anything.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Bumps source-map-js from 1.2.1 to 1.2.2.
Release notes
Sourced from source-map-js's releases.
Changelog
Sourced from source-map-js's changelog.
Commits
0a1d3341.2.24c6fa26Update changelogcf76580Fix denial of service from malicious indexed source maps (CVE-2026-93749) (#79)7899a86Fix crash when executing browser with CSP script-src that don't permit unsafe...