mirror of
https://github.com/rcourtman/Pulse.git
synced 2026-10-26 05:29:45 +00:00
rcourtman
cedba95712
Clears Dependabot alert 160 (high): `source-map-js` before 1.2.2 allows an event-loop denial of service through crafted indexed source maps. The alert's manifest is `internal/cloudcp/portal/frontend/package-lock.json`, which still pinned 1.2.1 through `postcss` (it accepts `^1.2.1`). `frontend-modern` already resolves 1.2.2 behind an override, so this was the only lockfile behind. The package is development scope: build tooling for the portal frontend, not shipped code. - Lockfile only: three lines, the `version`, `resolved` and `integrity` of the `node_modules/source-map-js` entry. The package set is unchanged. - The entry was edited by hand instead of regenerated, because npm 10.8 on the build box drops the `libc` fields newer npm writes and would have rewritten 45 unrelated lines. The new integrity hash is the one `frontend-modern`'s lockfile already records for 1.2.2. - The canonical completion guard asked for a `cloud-paid` contract and proof change because the lockfile sits under the portal path. This is a contract-neutral dependency bump, so the commit uses the guard's documented contract-neutral override with that reason. The sensitivity, governance, status, registry and contract audits still ran.