fix(deps): bump source-map-js to 1.2.2 (GHSA-68fv-2mgg-jv7q)

[danibsheehan]

Summary

• verify / audit (app) now fails on main because a high-severity advisory was published for source-map-js ≤ 1.2.1 (GHSA-68fv-2mgg-jv7q, event-loop denial of service via indexed source-map section offsets). It reached recent green runs only because the advisory landed afterwards.
• Bumps the lockfile entry to 1.2.2. It is a dev-only transitive dependency (postcss/Vite, jsdom/css-tree, vitest coverage), every parent already allows it via ^1.2.1, and it isn't shipped in the built app. Lockfile-only; no package.json or other package changes.

How to verify

npm ci && npm audit --audit-level=high → 0 vulnerabilities. npm run lint, format:check, typecheck, test:coverage and build all pass.

🤖 Generated with Claude Code

[github-actions]

app

File	Coverage	Lines	Branches
All files	77%	83%	71%	✅
src/App.tsx	0%	0%	100%	❌
src/components/AppLayout.tsx	0%	0%	0%	❌
src/components/DatabaseCanvas.tsx	0%	0%	0%	❌
src/components/DatabaseEmbedNodeView.tsx	49%	53%	45%	✅
src/components/DatabaseTableView.tsx	97%	100%	94%	✅
src/components/Editor.tsx	87%	95%	78%	✅
src/components/EditorTextFormatBubble.tsx	25%	28%	23%	✅
src/components/PageBlockGutter.tsx	30%	35%	24%	✅
src/components/PageChrome.tsx	96%	100%	93%	✅
src/components/PageDocumentBelowHit.tsx	81%	100%	62%	✅
src/components/PageDocumentEditor.tsx	57%	73%	41%	✅
src/components/PageView.tsx	60%	65%	55%	✅
src/components/Sidebar.tsx	98%	100%	97%	✅
src/components/SidebarSearch.tsx	94%	92%	97%	✅
src/components/SlashMenu.tsx	86%	87%	85%	✅
src/context/WorkspaceContext.tsx	83%	93%	73%	✅
src/extensions/ensureTopLevelBlockIds.ts	91%	100%	83%	✅
src/extensions/musingDatabaseEmbed.ts	70%	90%	50%	✅
src/extensions/wikiLink.ts	97%	95%	100%	✅
src/hooks/useFloatingMenu.ts	93%	97%	89%	✅
src/hooks/usePageIndexing.ts	95%	90%	100%	✅
src/lib/aiClient.ts	81%	86%	76%	✅
src/lib/blockEditorCommands.ts	96%	100%	92%	✅
src/lib/downloadPageDocx.ts	95%	100%	90%	✅
src/lib/editorBlockText.ts	89%	95%	83%	✅
src/lib/editorBubbleMenuPortal.ts	12%	12%	0%	❌
src/lib/emojiSuggestionRender.ts	31%	52%	10%	✅
src/lib/htmlToDocx.ts	73%	85%	62%	✅
src/lib/pageToExportHtml.ts	97%	100%	94%	✅
src/lib/workspaceStorage.ts	89%	93%	84%	✅
src/lib/pageDocument/blockGutterOps.ts	88%	97%	79%	✅
src/lib/pageDocument/blockIdAtSelection.ts	87%	100%	75%	✅
src/lib/pageDocument/lastBlockNeedsBelowHit.ts	91%	100%	83%	✅
src/lib/pageDocument/serializeDocToBlocks.ts	80%	89%	71%	✅
src/lib/pageDocument/tryDeleteEmptyTopLevelBlock.ts	87%	100%	75%	✅
src/types/block.ts	0%	0%	0%	❌
src/types/database.ts	0%	0%	0%	❌
src/types/page.ts	0%	0%	0%	❌

Minimum allowed coverage is 18%

Generated by 🐒 cobertura-action against 5ca5477

[github-actions]

PR guide

Auto-generated from changed paths. Fill in Summary and How to verify in the PR description above.

Touches: tooling config

Diff: 1 file changed, 3 insertions(+), 3 deletions(-)

Suggested verify

• npm run lint
• npm run format:check
• npm run test:run or targeted Vitest files for the changed area
• npm run build

Checklist (applies to this PR)

• No unintended secrets or local-only config committed

Reviewer focus

• Dependency, Vite, TypeScript, ESLint, and Prettier changes that can affect local and CI runs

Commits

• 5ca5477 fix(deps): bump source-map-js to 1.2.2 (GHSA-68fv-2mgg-jv7q)

Files by area

Area	Files
tooling config	1

CI

Required checks: verify runs format/lint/audit/typecheck/test/build as separate per-concern checks for every PR. Coverage tables are posted separately.

---

Template: pull_request_template.md

[github-actions]

Lighthouse CI report

• http://localhost:42633/index.html

Thresholds are informational (warn-level) for now; see ./.lighthouserc.json.