fix: force source-map-js to 1.2.2 (Dependabot alert #1, high) #43
+13
−5
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
source-map-js 1.2.1 has a high severity advisory. 1.2.2 is the patched release. Both of its dependents, postcss (via vite) and css-tree (via jsdom), allow ^1.2.1 so 1.2.2 satisfies them. It is a transitive dependency, so pnpm.overrides is the right lever rather than adding a direct dependency the packages here do not import. That forces every resolution in the tree to the patched version and keeps it correct if another parent appears later. Verified after a clean install that the tree resolves to 1.2.2 only. Reported by rachelks. Co-Authored-By: opencode <noreply@opencode.ai>
rachelks
approved these changes
Oct 10, 2026
erikhfj
added a commit
that referenced
this pull request
Oct 12, 2026
rachelks: GraphQL returns HTTP 200 even when the payload carries errors,
so a status check proves nothing. She is right and it was demonstrable
immediately: querying searchAlbums against the API currently running on
the VM returns 200 with
{"errors":[{"message":"Unknown argument \"input\" on field
\"Query.searchAlbums\".","extensions":{"code":"GRAPHQL_VALIDATION_FAILED"}}]}
and the old check reported 200 and moved on.
The smoke suite now POSTs, splits the status line off the body, and
rejects the response if it is not 200 or if the body contains an "errors"
key. Verified against the live API: __typename passes, searchAlbums is
correctly rejected.
Branch also rebased onto main so it carries the source-map-js fix from
#43.
Reported by rachelks.
Co-Authored-By: opencode <noreply@opencode.ai>
erikhfj
added a commit
that referenced
this pull request
Oct 15, 2026
rachelks: GraphQL returns HTTP 200 even when the payload carries errors,
so a status check proves nothing. She is right and it was demonstrable
immediately: querying searchAlbums against the API currently running on
the VM returns 200 with
{"errors":[{"message":"Unknown argument \"input\" on field
\"Query.searchAlbums\".","extensions":{"code":"GRAPHQL_VALIDATION_FAILED"}}]}
and the old check reported 200 and moved on.
The smoke suite now POSTs, splits the status line off the body, and
rejects the response if it is not 200 or if the body contains an "errors"
key. Verified against the live API: __typename passes, searchAlbums is
correctly rejected.
Branch also rebased onto main so it carries the source-map-js fix from
#43.
Reported by rachelks.
Co-Authored-By: opencode <noreply@opencode.ai>
erikhfj
added a commit
that referenced
this pull request
Oct 15, 2026
…checks Four points from rachelks on #45. 1. The searchAlbums smoke query omitted `sort`, which is `AlbumSort!` in AlbumSearchInput, so the query failed validation and the check could never pass. Now sends `sort: TITLE_ASC`. 2. The skip guards for crate-api.service and server/ now fail instead of exiting 0. #42 has merged so both are expected, and a deploy job that goes green without deploying anything is the wrong failure mode. 3. The body check parses the JSON rather than grepping for the word "errors". Grep would also fire on an album called "Errors", and it did not verify `data` was present at all. Now rejects a response with errors, with no data, or that is not JSON. Added a totalCount assertion as well, so the check is on the data and not only on its presence. 4. The python validators live in shell variables on one line. A multi-line `python3 -c` heredoc cannot be used inside a YAML block scalar: the block ends at the first unindented line and the workflow stops parsing. Learned by breaking it. Also rebased onto main now that #42 and #43 have merged. Validated the two python expressions against five payloads: a good response, GraphQL errors, null data, a valid totalCount, and two bad ones. Each rejected case prints what was wrong. Co-Authored-By: opencode <noreply@opencode.ai>
erikhfj
added a commit
that referenced
this pull request
Oct 15, 2026
README was still describing M1, and one line was simply wrong: it said `client/` renders mock data. The mock-data search interface never landed, the client is still the skeleton and #9 wires it straight to GraphQL. - Current milestone moved to M2 - New "Where the code is" table, implemented vs. planned - Local setup for `server/` too: DATABASE_URL, migrate, optional seed - Server commands in the command table - Infrastructure names `crate-api.service` and what CI deploys - M1 row now lists what M1 actually delivered, not mock data that did not land - Sort modes corrected to four, checked against `AlbumSort` in the schema AI usage log gets the eight erikhfj rows missing since 1 October: the #10 identity contract, the #8 VM runbook and the git clone, the #13 facet trade-off, the #43 source-map-js override, the #44 deploy gap, the displayName correction, the #45 review fixes, and this pass. The displayName row is the kind the log intro calls out as most important: the tool drafted a claim that a person had to correct. Per #48 each member documents their own usage, so only erikhfj rows were added. robertky's row from #46 was out of date order at the end of the table and is now with the rest of 9 October, and his relative order within the day is unchanged. Co-Authored-By: opencode <noreply@opencode.ai>
erikhfj
added a commit
that referenced
this pull request
Oct 15, 2026
rachelks: GraphQL returns HTTP 200 even when the payload carries errors,
so a status check proves nothing. She is right and it was demonstrable
immediately: querying searchAlbums against the API currently running on
the VM returns 200 with
{"errors":[{"message":"Unknown argument \"input\" on field
\"Query.searchAlbums\".","extensions":{"code":"GRAPHQL_VALIDATION_FAILED"}}]}
and the old check reported 200 and moved on.
The smoke suite now POSTs, splits the status line off the body, and
rejects the response if it is not 200 or if the body contains an "errors"
key. Verified against the live API: __typename passes, searchAlbums is
correctly rejected.
Branch also rebased onto main so it carries the source-map-js fix from
#43.
Reported by rachelks.
Co-Authored-By: opencode <noreply@opencode.ai>
erikhfj
added a commit
that referenced
this pull request
Oct 15, 2026
…checks Four points from rachelks on #45. 1. The searchAlbums smoke query omitted `sort`, which is `AlbumSort!` in AlbumSearchInput, so the query failed validation and the check could never pass. Now sends `sort: TITLE_ASC`. 2. The skip guards for crate-api.service and server/ now fail instead of exiting 0. #42 has merged so both are expected, and a deploy job that goes green without deploying anything is the wrong failure mode. 3. The body check parses the JSON rather than grepping for the word "errors". Grep would also fire on an album called "Errors", and it did not verify `data` was present at all. Now rejects a response with errors, with no data, or that is not JSON. Added a totalCount assertion as well, so the check is on the data and not only on its presence. 4. The python validators live in shell variables on one line. A multi-line `python3 -c` heredoc cannot be used inside a YAML block scalar: the block ends at the first unindented line and the workflow stops parsing. Learned by breaking it. Also rebased onto main now that #42 and #43 have merged. Validated the two python expressions against five payloads: a good response, GraphQL errors, null data, a valid totalCount, and two bad ones. Each rejected case prints what was wrong. Co-Authored-By: opencode <noreply@opencode.ai>
Sign in
to join this conversation on GitHub.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
What this does
Fixes Dependabot alert #1.
source-map-js1.2.1 has a high severity advisory; 1.2.2 is the patched release.Why
pnpm.overridesand not a direct dependencyIt is a transitive dependency:
Both parents declare
^1.2.1, so 1.2.2 satisfies them. Addingsource-map-jsas a direct dependency of@t19/clientwould work but would be a lie: nothing in this repo imports it.pnpm.overridesforces every resolution in the tree to the patched version and stays correct if another parent appears later.What was tested
Clean install, then checked the resolved tree:
One version in the tree, 1.2.2. No 1.2.1 left behind.
Also
pnpm format:check,pnpm lint,pnpm typecheckandpnpm testall pass.Scope
Dev-only.
viteandjsdomare development dependencies, so this does not reach the deployed bundle. Still worth fixing before the submission.Reported by rachelks.
Closes the Dependabot alert once merged.