Repository navigation
fix(deps): bump source-map-js to 1.2.2 (high GHSA-68fv-2mgg-jv7q) - #884
Closed
caffeine-ci-bot[bot] wants to merge 1 commit into
Closed
caffeine-ci-bot[bot] wants to merge 1 commit into
caffeine-ci-bot[bot] wants to merge 1 commit into
Conversation
![caffeine-ci-generic-rw[bot]](https://github.githubassets.com/images/gravatars/gravatar-user-420.png){kind=avatar}
caffeine-ci-bot
Bot
requested review from
a team and
automation-sa-sre
as code owners
October 12, 2026 10:16
Contributor
Cursor AI review👍 APPROVE — looks safe to merge
VerdictDecision: APPROVE Generated for commit c176ad8 |
automation-sa-sre
approved these changes
Oct 12, 2026
automation-sa-sre
left a comment
automation-sa-sre
left a comment
Collaborator
There was a problem hiding this comment.
Automated approval: the AI review verdict for c176ad8 is APPROVE. See the "Cursor AI review" comment for details.
Kamirus
added a commit
that referenced
this pull request
Oct 14, 2026
Closes 76 of the 87 open Dependabot alerts, across root, `blog/`, `cli/`, `cli-releases/frontend/`, `docs/` and `frontend/`, including 7 critical and 28 high. Two of the fixes ship in the CLI: `smol-toml` and `undici`. Replaces the per-alert bot PRs [#871](#871), [#872](#872), [#874](#874), [#880](#880), [#882](#882), [#883](#883), [#884](#884), [#885](#885) and [#886](#886), and the Dependabot groups [#857](#857) and [#867](#867): - The bot PRs each fix one alert in one directory, but share lockfiles and `overrides` blocks, so every merge conflicts the rest. Together they cover 9 alerts. - [#874](#874) and [#886](#886) also commit `tsc` output (`docs/src/pages/index-old.js`, `docs/src/components/HomepageFeatures/index.js`) next to the `.tsx` sources, which gives Docusaurus two pages for `/index-old`. - The Dependabot groups fail `npm ci`: [#867](#867) with `ERESOLVE` (it pulls `eslint-plugin-svelte` 3.23, which needs a newer `eslint` than the root's 8.57), and [#857](#857) with a lockfile out of sync with `package.json`. ## How Every consumer stays inside its declared semver range, and no override is added. A pin moves only where it was the vulnerable version itself: | Pin | Before | After | |---|---|---| | `fast-uri` override, `blog/` and `docs/` | 3.1.6 | 3.1.8 | | `js-yaml` override, `frontend/` | 4.3.1 | 4.3.2 | | `dompurify`, `frontend/` | 3.4.12 | 3.4.17 | | `markdown-it`, `frontend/` and `cli-releases/frontend/` | 14.2.0 | 14.3.2 | | `smol-toml`, `cli/` | 1.7.1 | 1.9.1 | `qs` needed one indirect step: `express` 4.22.2 and `body-parser` 1.20.6 pin it to `~6.15.1`, below the 6.16.0 fix, so they move to 4.22.3 and 1.20.8, which take `~6.16.0`. In `frontend/`, `npm update` pruned the optional-peer entry `svelte-check/node_modules/picomatch`, so I restored it to keep the diff scoped, as in [#856](#856). `npm ci` installs the same tree either way. ## CLI impact `smol-toml` 1.9 rewrites the parser, which closes GHSA-r4xh-jqrq-34v2 (quadratic parse time). It returns null-prototype objects and rejects a few forms of invalid TOML that 1.7 accepted. `readConfig` only spreads and iterates the parsed tables, so the prototype change doesn't reach it. I parsed and re-stringified 1,387 TOML files from this repo, `motoko-core`, `skills-internal` and `app` with both versions: the output is identical. The only difference is the error message for one template file with a `{{DEPENDENCIES}}` placeholder, which both versions reject. `undici` moves from 7.29.0 to 7.30.0 under `jsdom`'s `^7.21.0`. Both are in `cli/CHANGELOG.md` under `## Next`. ## What is still open 11 alerts have no fix that the dependents accept: - `braces` (3, high) and `sprintf-js` (3, medium): no patched release exists. - `postcss-selector-parser` GHSA-rj75-hqrm-r3gf (5, medium): fixed only in 7.1.6. The 7.x copies move to 7.1.6, but `eslint-plugin-svelte` (`^6.1.0`) and `cssnano`'s plugins (`^6.0.16`) require 6.x. Those copies move to 6.1.4, which closes GHSA-w9m9-85wc-3x92. Forcing 7.x onto them would cross a major version for a build-time parser that only reads our own CSS. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Collaborator
|
Superseded by #892, which fixes this alert along with the rest of the open ones in every lockfile. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Automated fix from the
security-autofixpipeline incaffeinelabs/infra.Dependabot alert #752 —
source-map-js→1.2.2(high,GHSA-68fv-2mgg-jv7q).A coding agent (Cursor) upgraded the vulnerable dependency to the fixed
version, regenerated the lockfile, and made the minimal code changes needed to
keep the build coherent. The diff is intended to be small and obviously
correct.
Review like any PR:
lockfile change is consistent.
won't reopen it while this
bot/depbot-autofix/752PR exists, and thealert stays in the daily/weekly digest until it's resolved.
🤖 Generated by the security-autofix workflow via Cursor.