From 00de4046ba79bce22249b2a50956efed85fc2903 Mon Sep 17 00:00:00 2001 From: Toby Hede Date: Mon, 12 Oct 2026 12:06:01 +1100 Subject: [PATCH 1/2] fix(deps): patch source-map-js to 1.2.2 --- pnpm-lock.yaml | 11 ++++++----- pnpm-workspace.yaml | 4 ++++ 2 files changed, 10 insertions(+), 5 deletions(-) diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml index 092fe353f..8a36d236f 100644 --- a/pnpm-lock.yaml +++ b/pnpm-lock.yaml @@ -37,6 +37,7 @@ overrides: lodash@<4.18.0: ^4.18.0 js-cookie@<3.0.7: ^3.0.7 postcss@<8.5.26: ^8.5.26 + source-map-js@<1.2.2: 1.2.2 vite@>=7.0.0 <7.3.5: ~7.3.5 esbuild@>=0.27.3 <0.28.1: ^0.28.1 brace-expansion@<5.0.12: 5.0.12 @@ -3252,8 +3253,8 @@ packages: resolution: {integrity: sha512-g9Q1haeby36OSStwb4ntCGGGaKsaVSjQ68fBxoQcutl5fS1vuY18H3wSt3jFyFtrkx+Kz0V1G85A4MyAdDMi2Q==} engines: {node: '>=8'} - source-map-js@1.2.1: - resolution: {integrity: sha512-UXWMKhLOwVKb728IUtQPXxfYU+usdybtUrK/8uGE8CQMvrhOpwvzDBwj0QhSL7MQc7vIsISBG8VQ8+IDQxpfQA==} + source-map-js@1.2.2: + resolution: {integrity: sha512-KGj/8Y43x35aZVDtt+J4mK1hoLGHULMYfSkODJNQjNDC3oW1PqPoxMwo0pLUsWM/UEGzON/NxeHywEfNXNP3Vw==} engines: {node: '>=0.10.0'} source-map-support@0.5.21: @@ -5348,7 +5349,7 @@ snapshots: dependencies: '@babel/parser': 7.29.8 '@babel/types': 7.29.8 - source-map-js: 1.2.1 + source-map-js: 1.2.2 make-dir@4.0.0: dependencies: @@ -5596,7 +5597,7 @@ snapshots: dependencies: nanoid: 3.3.18 picocolors: 1.1.1 - source-map-js: 1.2.1 + source-map-js: 1.2.2 postgres-array@2.0.0: {} @@ -5842,7 +5843,7 @@ snapshots: slash@3.0.0: {} - source-map-js@1.2.1: {} + source-map-js@1.2.2: {} source-map-support@0.5.21: dependencies: diff --git a/pnpm-workspace.yaml b/pnpm-workspace.yaml index cdb68f87e..195e57e6e 100644 --- a/pnpm-workspace.yaml +++ b/pnpm-workspace.yaml @@ -86,6 +86,10 @@ overrides: # installed with the entry still sitting here looking like a fix. Keep the # ceiling AHEAD of the patched floor, not at it. 'postcss@<8.5.26': '^8.5.26' + # #243 GHSA-68fv-2mgg-jv7q / CVE-2026-93749 — source-map-js >=1.0.0 <1.2.2, + # patched 1.2.2 (published 2026-09-30). Reached through postcss and magicast, + # both of which declare ^1.x, so the pin is in range for every consumer. + 'source-map-js@<1.2.2': '1.2.2' # #145 GHSA-fx2h-pf6j-xcff, #146 GHSA-v6wh-96g9-6wx3 — vite dev server (Windows) 'vite@>=7.0.0 <7.3.5': '~7.3.5' # #142 GHSA-g7r4-m6w7-qqqr — esbuild dev server. 0.28.1 is the FIRST patched From 9c3217fb339c8b97c2a5269944178ae95d389aba Mon Sep 17 00:00:00 2001 From: Toby Hede Date: Tue, 13 Oct 2026 16:22:17 +1100 Subject: [PATCH 2/2] fix(deps): limit source-map-js override to the advisory range --- pnpm-lock.yaml | 2 +- pnpm-workspace.yaml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml index 8a36d236f..9938b5d74 100644 --- a/pnpm-lock.yaml +++ b/pnpm-lock.yaml @@ -37,7 +37,7 @@ overrides: lodash@<4.18.0: ^4.18.0 js-cookie@<3.0.7: ^3.0.7 postcss@<8.5.26: ^8.5.26 - source-map-js@<1.2.2: 1.2.2 + source-map-js@>=1.0.0 <1.2.2: 1.2.2 vite@>=7.0.0 <7.3.5: ~7.3.5 esbuild@>=0.27.3 <0.28.1: ^0.28.1 brace-expansion@<5.0.12: 5.0.12 diff --git a/pnpm-workspace.yaml b/pnpm-workspace.yaml index 195e57e6e..8044a3816 100644 --- a/pnpm-workspace.yaml +++ b/pnpm-workspace.yaml @@ -89,7 +89,7 @@ overrides: # #243 GHSA-68fv-2mgg-jv7q / CVE-2026-93749 — source-map-js >=1.0.0 <1.2.2, # patched 1.2.2 (published 2026-09-30). Reached through postcss and magicast, # both of which declare ^1.x, so the pin is in range for every consumer. - 'source-map-js@<1.2.2': '1.2.2' + 'source-map-js@>=1.0.0 <1.2.2': '1.2.2' # #145 GHSA-fx2h-pf6j-xcff, #146 GHSA-v6wh-96g9-6wx3 — vite dev server (Windows) 'vite@>=7.0.0 <7.3.5': '~7.3.5' # #142 GHSA-g7r4-m6w7-qqqr — esbuild dev server. 0.28.1 is the FIRST patched