From bda20d6f15db573bf8546c53e301b5bae909bad6 Mon Sep 17 00:00:00 2001 From: Erik Hjelm Fjeldheim Date: Sat, 10 Oct 2026 13:06:17 -0600 Subject: [PATCH] fix: force source-map-js to 1.2.2 (Dependabot alert #1, high) source-map-js 1.2.1 has a high severity advisory. 1.2.2 is the patched release. Both of its dependents, postcss (via vite) and css-tree (via jsdom), allow ^1.2.1 so 1.2.2 satisfies them. It is a transitive dependency, so pnpm.overrides is the right lever rather than adding a direct dependency the packages here do not import. That forces every resolution in the tree to the patched version and keeps it correct if another parent appears later. Verified after a clean install that the tree resolves to 1.2.2 only. Reported by rachelks. Co-Authored-By: opencode --- package.json | 5 +++++ pnpm-lock.yaml | 13 ++++++++----- 2 files changed, 13 insertions(+), 5 deletions(-) diff --git a/package.json b/package.json index 2ade98e..afc3b86 100644 --- a/package.json +++ b/package.json @@ -29,5 +29,10 @@ "prettier": "^3.9.6", "typescript": "~5.9.3", "typescript-eslint": "^8.69.0" + }, + "pnpm": { + "overrides": { + "source-map-js": ">=1.2.2" + } } } diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml index 01561b1..0f9b827 100644 --- a/pnpm-lock.yaml +++ b/pnpm-lock.yaml @@ -4,6 +4,9 @@ settings: autoInstallPeers: true excludeLinksFromLockfile: false +overrides: + source-map-js: '>=1.2.2' + importers: .: @@ -1536,8 +1539,8 @@ packages: siginfo@2.0.0: resolution: {integrity: sha512-ybx0WO1/8bSBLEWXZvEd7gMW3Sn3JFlW3TvX1nREbDLRNQNaeNN8WK0meBwPdAaOI7TtRRRJn/Es1zhrrCHu7g==} - source-map-js@1.2.1: - resolution: {integrity: sha512-UXWMKhLOwVKb728IUtQPXxfYU+usdybtUrK/8uGE8CQMvrhOpwvzDBwj0QhSL7MQc7vIsISBG8VQ8+IDQxpfQA==} + source-map-js@1.2.2: + resolution: {integrity: sha512-KGj/8Y43x35aZVDtt+J4mK1hoLGHULMYfSkODJNQjNDC3oW1PqPoxMwo0pLUsWM/UEGzON/NxeHywEfNXNP3Vw==} engines: {node: '>=0.10.0'} stackback@0.0.2: @@ -2455,7 +2458,7 @@ snapshots: css-tree@3.2.1: dependencies: mdn-data: 2.27.1 - source-map-js: 1.2.1 + source-map-js: 1.2.2 css.escape@1.5.1: {} @@ -3225,7 +3228,7 @@ snapshots: dependencies: nanoid: 3.3.19 picocolors: 1.1.1 - source-map-js: 1.2.1 + source-map-js: 1.2.2 prelude-ls@1.2.1: {} @@ -3385,7 +3388,7 @@ snapshots: siginfo@2.0.0: {} - source-map-js@1.2.1: {} + source-map-js@1.2.2: {} stackback@0.0.2: {}