fix(deps): patch source-map-js to 1.2.2

[tobyhede]

Summary

Fixes Dependabot alert #243: GHSA-68fv-2mgg-jv7q / CVE-2026-93749 in source-map-js (affected >=1.0.0 <1.2.2, patched in 1.2.2).

source-map-js is transitive only, reached through postcss and magicast. Open group PR #1136 moves one path but leaves source-map-js@1.2.1 in pnpm-lock.yaml. This PR removes every vulnerable copy.

Changes

• pnpm-workspace.yaml: adds a scoped override 'source-map-js@<1.2.2': '1.2.2'. It follows the existing overrides convention, with the ceiling set at the pin so the selector can't be overtaken.
• pnpm-lock.yaml: source-map-js 1.2.1 -> 1.2.2 (the override entry, the package entry and both consumer snapshots). No other packages change.

1.2.2 was published 2026-09-30, so it's past the 7-day minimumReleaseAge.

Verification

• pnpm install --frozen-lockfile succeeds and makes no changes to the lockfile.
• pnpm why -r source-map-js reports one version: 1.2.2. No <1.2.2 copy remains in the lockfile.
• e2e/tests/supply-chain.e2e.test.ts passes (28/28).
• Smoke tests pass: a SourceMapGenerator -> SourceMapConsumer round trip, and postcss source-map generation.

Summary by CodeRabbit

• Chores
  • Updated version resolution for an underlying package so compatible versions are used consistently throughout the application. This maintenance update does not change any user-facing features or behavior. No changes to the application’s public functionality are included.

[changeset-bot]

⚠️ No Changeset found

Latest commit: 9c3217f

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-12T01:08:04.808441Z	00de404	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

• Configuration used: Organization UI
• Review profile: CHILL
• Plan: Essentials
• Run ID: 39a44e5e-cf48-4ee9-b061-28b5aeaed05b

📥 Commits

Reviewing files that changed from the base of the PR and between 00de404 and 9c3217f.

⛔ Files ignored due to path filters (1)

• pnpm-lock.yaml is excluded by !**/pnpm-lock.yaml

📒 Files selected for processing (1)

• pnpm-workspace.yaml

Included review availability: This review used your included allowance. 4 included reviews remain after this review. Your included PR review attempts over the past 7 days set your current allowance at 5 reviews per hour.

📝 Walkthrough

The pnpm workspace configuration adds an override that resolves source-map-js versions from 1.0.0 up to, but not including, 1.2.2 to 1.2.2.

Changes: Dependency version override

Layer / File(s)	Summary
Pin source-map-js versions pnpm-workspace.yaml	The pnpm override maps source-map-js versions from 1.0.0 up to, but not including, 1.2.2 to 1.2.2.

Priority: ➖ Normal

Estimated code review effort: 1 (Trivial) | ~3 minutes

Change: Bug fix

Suggested reviewers: auxesis

Merge Risk: ⚪ Minimal · up to 9c321

The dependency override and lockfile resolve the reported transitive paths to the patched version. No actionable merge-blocking risk is evident in the reviewed change.

Pre-merge checks · 5

Passed checks (5 passed)

Check name	Status	Explanation
Description Check		Check skipped - CodeRabbit’s high-level summary is enabled.
Title check		The title clearly and concisely identifies the dependency fix and the target source-map-js version.
Docstring Coverage		No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

_{Comment @coderabbitai help to get the list of available commands.}

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 00de4046ba

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Scope the override to the actual vulnerable range

The advisory range documented immediately above starts at 1.0.0, but this selector also matches every 0.x release. If a current or future dependency requests a 0.x version, pnpm will rewrite it across a major-version boundary to 1.2.2 even though that release is not vulnerable, potentially breaking the consumer. Use source-map-js@>=1.0.0 <1.2.2 so the security override is limited to the stated affected range, as required by the repository's dependency-policy guidance.

AGENTS.md reference: AGENTS.md:L813-L813

Useful? React with 👍 / 👎.