fix(deps): patch source-map-js denial of service

[nocoo]

Pin source-map-js1.2.2 to fix GHSA-68fv-2mgg-jv7q. Only the transitive root override and Bun lock resolution change. Existing direct-dependency override conventions, package versions, React code/tests and public API are unchanged.

Issues

Closes #527

Validation

• The unchanged normal index-snapshot hook passed staged secrets, staged-source library build, types, lint and1878 tests across217 files; all four coverage metrics are97.64/95.84/98.79/97.86%. The validated index tree exactly matches this commit.
• Current-head frozen install, catalog build, library type checks, pack verification, strict publint, OSV and full-history redacted Gitleaks passed.
• Expected negative-fixture diagnostics and existing chart/build advisories remain visible. No tests, exclusions, thresholds or hooks were changed.
• Local complex browser consumers and the prepublish aggregate were not run. Existing CI package consumers, showcase and browser gates must pass at the current head before merge.
• No npm publication, tag or manual deployment. Full6DQ and the hook timing target are not certified.

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Updated (UTC)
✅ Deployment successful! View logs	theme-basalt	0d8033d	Oct 06 2026, 03:06 AM