Repository navigation
fix(deps): patch source-map-js to 1.2.2 - #1150
Conversation
|
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info
📝 Walkthrough
Merge Risk: ⚪ Minimal · up to
|
| Check name | Status | Explanation |
|---|---|---|
| Description Check |  |
Check skipped - CodeRabbit’s high-level summary is enabled. |
| Title check | |
The title clearly and concisely identifies the dependency fix and the target source-map-js version. |
| Docstring Coverage | |
No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0… |
| Linked Issues check | |
Check skipped because no linked issues were found for this pull request. |
| Out of Scope Changes check | |
Check skipped because no linked issues were found for this pull request. |
- Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts
Comment @coderabbitai help to get the list of available commands.
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 00de4046ba
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| # #243 GHSA-68fv-2mgg-jv7q / CVE-2026-93749 — source-map-js >=1.0.0 <1.2.2, | ||
| # patched 1.2.2 (published 2026-09-30). Reached through postcss and magicast, | ||
| # both of which declare ^1.x, so the pin is in range for every consumer. | ||
| 'source-map-js@<1.2.2': '1.2.2' |
There was a problem hiding this comment.
The advisory range documented immediately above starts at 1.0.0, but this selector also matches every 0.x release. If a current or future dependency requests a 0.x version, pnpm will rewrite it across a major-version boundary to 1.2.2 even though that release is not vulnerable, potentially breaking the consumer. Use source-map-js@>=1.0.0 <1.2.2 so the security override is limited to the stated affected range, as required by the repository's dependency-policy guidance.
AGENTS.md reference: AGENTS.md:L813-L813
Useful? React with 👍 / 👎.
freshtonic
left a comment
freshtonic
left a comment
There was a problem hiding this comment.
Review of 9c3217f. Commit 9c3217f fixes the earlier Codex point about the selector range. I found no blocking defect in this PR. There is one merge hazard with #1197. Read it before you merge either PR.
What I checked
- Advisory. GHSA-68fv-2mgg-jv7q names
>= 1.0.0, < 1.2.2, first patched1.2.2. The selector atpnpm-workspace.yaml:92now matches the advisory exactly. - Coverage. The PR lockfile has no
source-map-js@1.2.1entry. Both consumer snapshots (postcss,magicast) resolve1.2.2. - Changeset. Not needed.
source-map-jscomes in only throughpostcssandmagicast, and no published package depends on either one directly. pnpm overrides do not ship to consumers. - CI. 23 checks pass and 11 skip (path filters). No failures.
Merge hazard with #1197 (read before you merge either PR)
Git merges this PR and #1197 with no conflict, but the result is a broken lockfile. #1197 adds source-map-js@1.2.2 and also keeps 1.2.1 (its pnpm-lock.yaml:3592-3596 and 6436-6438). This PR renames 1.2.1 to 1.2.2 at the same places. I ran git merge-tree on the two heads. The merged pnpm-lock.yaml has the source-map-js@1.2.2: key twice under packages: and twice under snapshots:.
main has no up-to-date-branch requirement and no merge queue. So if one PR merges and then the other merges without a rebase, the duplicate keys land on main, and no check runs on the merged result first. After the first of the two merges, have Dependabot recreate #1197 (@dependabot recreate), or rebase it. Do not merge it as it is.
Suggested follow-up PR
- The PR description still shows the old selector
'source-map-js@<1.2.2', and says that "the ceiling [is] set at the pin".9c3217fchanged the selector to'source-map-js@>=1.0.0 <1.2.2'. Update the description so the squash message is correct.
freshtonic
left a comment
freshtonic
left a comment
There was a problem hiding this comment.
Approved. Merge order: rebase whichever of this PR and #1197 merges second. Git merges them with no conflict, but the result has the source-map-js@1.2.2: key twice in pnpm-lock.yaml.
2 participants
Summary
Fixes Dependabot alert #243: GHSA-68fv-2mgg-jv7q / CVE-2026-93749 in
source-map-js(affected>=1.0.0 <1.2.2, patched in1.2.2).source-map-jsis transitive only, reached throughpostcssandmagicast. Open group PR #1136 moves one path but leavessource-map-js@1.2.1inpnpm-lock.yaml. This PR removes every vulnerable copy.Changes
pnpm-workspace.yaml: adds a scoped override'source-map-js@<1.2.2': '1.2.2'. It follows the existing overrides convention, with the ceiling set at the pin so the selector can't be overtaken.pnpm-lock.yaml:source-map-js1.2.1 -> 1.2.2 (the override entry, the package entry and both consumer snapshots). No other packages change.1.2.2 was published 2026-09-30, so it's past the 7-day
minimumReleaseAge.Verification
pnpm install --frozen-lockfilesucceeds and makes no changes to the lockfile.pnpm why -r source-map-jsreports one version:1.2.2. No<1.2.2copy remains in the lockfile.e2e/tests/supply-chain.e2e.test.tspasses (28/28).SourceMapGenerator->SourceMapConsumerround trip, andpostcsssource-map generation.Summary by CodeRabbit