[dependabot]

Bumps source-map-js from 1.2.1 to 1.2.2.

Release notes

Sourced from source-map-js's releases.

v1.2.2

• Fix crash when executing in browser with CSP script-src that don't permit unsafe-eval (#29) @​xfournet

• Fix denial of service from malicious indexed source maps (CVE-2026-93749) (#79)

  Reported by @​waydeshi in #76. A fix was also proposed by @​aniebiet in #78.

Changelog

Sourced from source-map-js's changelog.

1.2.2

• Fix crash when executing in browser with CSP script-src that don't permit unsafe-eval (#29) @​xfournet

• Fix denial of service from malicious indexed source maps (CVE-2026-93749) (#79)

  Reported by @​waydeshi in #76. A fix was also proposed by @​aniebiet in #78.

Commits

• 0a1d334 1.2.2
• 4c6fa26 Update changelog
• cf76580 Fix denial of service from malicious indexed source maps (CVE-2026-93749) (#79)
• 7899a86 Fix crash when executing browser with CSP script-src that don't permit unsafe...
• See full diff in compare view

[tangletools]

✅ Auto-approved PR — 861e86f9

Blanket team auto-approval is intentional. This is not a code review.
No automated review runs on this PR. This approval rests on the rule above alone.

_{tangletools · auto-approval · reason: blanket_auto_approve · 2026-10-22T19:32:00Z}

[drewstone]

Owner: op-company:cve-deps (live Fleet lane owning the dependency campaign; stale-PR handoff from op-company:pr-closer, 2026-10-23)
Blocker: This is one of a wave of Dependabot PRs opened 2026-10-22 19:30–19:56Z. The campaign runs one coherent dependency PR per repo, and campaign CI admission is capped at two repos at a time. This bump has no exact-head integration proof recorded yet.
Next action: When the repo gets a CI slot, fold this bump into the repo's coherent dependency PR, or qualify it on its own through the repo's maintained gate. Close it with supersession proof once a merged PR contains the same or a newer version. This handoff authorizes no merge.

[drewstone]

@dependabot rebase

[tangletools]

✅ Auto-approved PR — e99831e8

Blanket team auto-approval is intentional. This is not a code review.
No automated review runs on this PR. This approval rests on the rule above alone.

_{tangletools · auto-approval · reason: blanket_auto_approve · 2026-10-24T00:43:52Z}

[drewstone]

Owner: op-company:cve-deps (Claude successor run_c1de7057, started by the operator 10-25 01:04Z after the Codex cve-deps session hit its usage limit)
Blocker: no exact-head integration proof yet; tnt-core#227-#230 already merged.
Next action: cve-deps qualifies this on the indexer build and merges, or closes it with supersession proof.

[drewstone]

Superseded by #237 (merged as bb03564). That PR moved the indexer to vite 6.4.4, the patched 6.x release, instead of the 8.x major. It also bumped source-map-js to 1.2.2 and body-parser to 1.20.9 in both indexer and claim-relayer, and regenerated both lockfiles. Gate beelink2-4c69217a8c4965b3890bc306d37ddcee passed: frozen install, envio codegen, typecheck and 8/8 vitest tests in indexer, then frozen install, typecheck and build in claim-relayer.