mirror of
https://github.com/rcourtman/Pulse.git
synced 2026-10-27 05:57:27 +00:00
2a3d37ffb0
Dependabot alert 160 (high): source-map-js before 1.2.2 allows an event-loop denial of service through crafted indexed source maps. The alert's manifest is the Cloud portal frontend lockfile, which still pinned 1.2.1 through postcss (which accepts ^1.2.1). frontend-modern already resolves 1.2.2 behind an override, so only this lockfile was behind. The package is development scope, build tooling only. Lockfile only, three lines. The entry was edited by hand rather than by running npm because npm 10.8 on the build box drops the libc fields newer npm writes, which would have rewritten 45 unrelated lines. The new integrity hash is the one frontend-modern's lockfile already records for 1.2.2. Contract-Neutral: Dependency lockfile bump for Dependabot alert 160 (source-map-js, development scope); no public-contract delta